ceb1980e1d1cd26d20d071964bf8b19adfeb62e16f6b75723ac95a26918550ed

Sharing

Copy URL Twitter E-mail

General

Target

ceb1980e1d1cd26d20d071964bf8b19adfeb62e16f6b75723ac95a26918550ed
Size

555KB
MD5

6381fb48c66b1235c7c5ab33855339d4
SHA1

96c56e25e594f3e2b0cc0c6e62171e7b8a5c7f96
SHA256

ceb1980e1d1cd26d20d071964bf8b19adfeb62e16f6b75723ac95a26918550ed
SHA512

b44f334674515673c1622ce96f639f1a8fa5c9d7e39b1fd604d691957c32b95da342fd107c6c238f699ed84b5bd117439601d47f321b9a5a29e856894c05ffc0
SSDEEP

12288:/t1QrLfgfSSRh+dHvGKDWm+owYSSQPBoIh:/PQrvCh+dH+K6m+o1APBoIh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ceb1980e1d1cd26d20d071964bf8b19adfeb62e16f6b75723ac95a26918550ed

Files

ceb1980e1d1cd26d20d071964bf8b19adfeb62e16f6b75723ac95a26918550ed
.exe windows:5 windows x86 arch:x86

7c2e2090a177b0a56b2cb8973b468071

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\winapps\gu6\exe\vc\FileShredder\sourcecode\Release\FileShredder.pdb

Imports

mfc90u

ord2103
ord1601
ord4510
ord2277
ord4654
ord3183
ord1769
ord1668
ord3497
ord616
ord4652
ord1779
ord1708
ord3627
ord750
ord2263
ord586
ord790
ord814
ord1047
ord6780
ord6686
ord6355
ord2726
ord6205
ord4265
ord1298
ord1665
ord4527
ord611
ord4131
ord294
ord2478
ord782
ord580
ord6170
ord6514
ord1248
ord2360
ord4543
ord6604
ord6493
ord2141
ord6187
ord6547
ord3537
ord2470
ord4398
ord4992
ord6494
ord3685
ord1726
ord677
ord3547
ord4656
ord1682
ord1770
ord2278
ord767
ord3642
ord1714
ord778
ord3286
ord4660
ord1719
ord2283
ord4044
ord2901
ord2597
ord6349
ord3167
ord1102
ord3741
ord3158
ord6311
ord4171
ord3160
ord4040
ord5497
ord686
ord436
ord791
ord3944
ord935
ord2479
ord6013
ord4405
ord1599
ord5632
ord4631
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1492
ord4682
ord5653
ord4266
ord5167
ord2909
ord6275
ord6579
ord4262
ord5008
ord6723
ord4455
ord710
ord462
ord3165
ord4000
ord1938
ord662
ord398
ord639
ord374
ord3794
ord613
ord337
ord3768
ord3933
ord693
ord3252
ord4658
ord2280
ord4664
ord938
ord286
ord6096
ord811
ord2326
ord813
ord285
ord3220
ord280
ord799
ord1108
ord2069
ord744
ord524
ord2593
ord5979
ord4516
ord3338
ord3361
ord2209
ord3360
ord664
ord405
ord3018
ord1553
ord3015
ord2501
ord2490
ord665
ord406
ord4270
ord775
ord3651
ord1716
ord1783
ord2595
ord266
ord265
ord2676
ord4490
ord4518
ord2551
ord3515
ord4741
ord2904
ord4774
ord5182
ord1651
ord4268
ord6065
ord2274
ord1137
ord6095
ord525
ord6577
ord1603
ord4519
ord6659
ord1250
ord1254
ord4448
ord4423
ord2592
ord2097
ord4410
ord4541
ord3488
ord333
ord2469
ord6091
ord1354
ord1353
ord3622
ord636
ord367
ord3543
ord2106
ord296
ord600
ord2537
ord1183
ord3486
ord785
ord595
ord3661
ord4681
ord4910
ord4348
ord2891
ord4071
ord4081
ord4080
ord3278
ord2764
ord2893
ord2774
ord3140
ord2966
ord4728
ord3112
ord2983
ord2771
ord5650
ord1727
ord1791
ord1792
ord2139
ord5625
ord1442
ord3226
ord6376
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord5404
ord3682
ord6804
ord4213
ord2087
ord3217
ord5674
ord5676
ord4174
ord6802
ord1641
ord1272
ord4347
ord4996
ord2368
ord2375
ord2630
ord2612
ord2610
ord2628
ord2640
ord2617
ord2633
ord2638
ord2621
ord2623
ord2625
ord2619
ord2635
ord2615
ord971
ord3563
ord5680
ord5663
ord6018
ord3115
ord4905
ord3670
ord2447
ord6482
ord1098
ord4211
ord794
ord589
ord967
ord969
ord965
ord960
ord5683
ord5685
ord6466
ord1728
ord4702
ord5154
ord3743
ord4043
ord4967
ord1607
ord3489
ord5664
ord4603
ord6800
ord5512
ord2074
ord5602
ord4663
ord1493
ord4345
ord1751
ord1754
ord6411
ord3355
ord1722
ord1786
ord2286
ord801

msvcr90

__CxxFrameHandler3
memset
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
rand
srand
_localtime64_s
wcsftime
_swprintf
wprintf
_time64
wcsncpy_s
_wcsdup
_wcsnicmp
_recalloc
calloc
_resetstkoflw
malloc
wcstol
wcsstr
_wcsicmp
memmove_s
memcpy_s
free
_purecall
_wtoi
wcsncmp
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException

kernel32

GetFileTime
CreateFileW
GetSystemDirectoryW
GetCommandLineW
GetCurrentProcess
MulDiv
lstrlenW
InterlockedExchange
LeaveCriticalSection
GetFileAttributesW
Sleep
ReadFile
TerminateThread
GetExitCodeThread
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
DeleteCriticalSection
CreatePipe
GetLastError
GetModuleFileNameW
FileTimeToSystemTime
EnterCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
CloseHandle
WaitForSingleObject
CreateThread
FindClose
InitializeCriticalSection
FileTimeToLocalFileTime
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
InterlockedCompareExchange
WriteFile
SetFilePointerEx
VirtualFree
VirtualAlloc
LocalFree
FormatMessageW
GetVolumeInformationW
GetDiskFreeSpaceW
ExpandEnvironmentStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
GetModuleHandleW
FindFirstFileW

user32

GetSysColor
SendMessageW
DrawEdge
DrawStateW
GetWindowDC
DestroyIcon
GetIconInfo
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
PostMessageW
ReleaseCapture
IsWindow
EnableWindow
OffsetRect
GetFocus
ExitWindowsEx
UpdateWindow
DrawIcon
IsIconic
LoadIconW
GetCursorPos
FrameRect
GetWindowRect
SetRectEmpty
GetWindowLongW
ScreenToClient
ClientToScreen
GetScrollPos
InflateRect
DrawFocusRect
IsRectEmpty
CopyRect
SetRect
GetSystemMetrics
GetParent
InvalidateRect
KillTimer
SetTimer
PtInRect
RedrawWindow
ReleaseDC
GetDC
FillRect
GetClientRect

gdi32

SetDIBColorTable
GetCurrentObject
DeleteObject
CreateFontW
CreateFontIndirectW
DeleteDC
CreateSolidBrush
GetStockObject
GetTextExtentPoint32W
GetDIBColorTable
StretchBlt
GetObjectW
BitBlt
SelectObject
GetTextMetricsW
CreatePen
CreateCompatibleBitmap
CreateDIBSection
CreateCompatibleDC

msimg32

TransparentBlt
AlphaBlend

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

shell32

SHGetSpecialFolderLocation
SHGetDataFromIDListW
DragQueryFileW
SHGetDesktopFolder
SHEmptyRecycleBinW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW
SHGetFileInfoW

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

PathIsDirectoryW
PathFileExistsW

ole32

CoUninitialize
CoInitialize

oleaut32

SysFreeString

msvcp90

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

gdiplus

GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdiplusShutdown
GdiplusStartup

register

GoHelp

skinsmanager

InitializeLibrary
InitializeSkins
UnitializeLibrary
GetSkinsColor
GetSkinsToInt
GetSkinsOption
GetSkinsFile
GetAllKeyArrBySection

guwndmanager

WindowsPosHookWnd
WindowsPosInitialize

languages

ord4

log

OutLogLine
CloseOutLog
CreateOutLog
SaveOutLog
ClearOutLog

uxtheme

DrawThemeBackground
OpenThemeData
CloseThemeData

crashreport

ord1

Sections

.text
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 103KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7c2e2090a177b0a56b2cb8973b468071

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc90u

msvcr90

kernel32

user32

gdi32

msimg32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp90

gdiplus

register

skinsmanager

guwndmanager

languages

log

uxtheme

crashreport

Sections

.text Size: 148KB - Virtual size: 148KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 232KB - Virtual size: 232KB

.reloc Size: 103KB - Virtual size: 104KB

.text
Size: 148KB - Virtual size: 148KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 232KB - Virtual size: 232KB

.reloc
Size: 103KB - Virtual size: 104KB