bee9ac7512cb662e6b99b03a3c0f57c5fddea3696bd3d058bd13bb82304c888cN

Sharing

Copy URL Twitter E-mail

General

Target

bee9ac7512cb662e6b99b03a3c0f57c5fddea3696bd3d058bd13bb82304c888cN
Size

757KB
MD5

1f69d8ecf8bc59dcb45d12a088c67fb0
SHA1

7e70653f2ff1d0960d040c7b50440bf31dcaeeb6
SHA256

bee9ac7512cb662e6b99b03a3c0f57c5fddea3696bd3d058bd13bb82304c888c
SHA512

b76ae9f3f41260805fc4268c95d1446b492522df7579778b358ba134bd008c65ac0940b8aacd6267e4d26b1a3e87443b25493a2a2719c53238932dca2f73e461
SSDEEP

12288:ADDJfT/g+MpvfYNFevozyhPNLlnPg1igNp61fbjZdooqu0lakJS8vW/qvt6DOfOn:GDxg+MlfY3sfnPgcgS1TH3FhmxmlkUD5

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
bee9ac7512cb662e6b99b03a3c0f57c5fddea3696bd3d058bd13bb82304c888cN
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/ActiveRefresh.exe
unpack001/Plugins/ftp2rss.dll
unpack001/Plugins/pop3.dll
unpack001/Plugins/yahoomail.dll
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/InstallOptions.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_1

Files

bee9ac7512cb662e6b99b03a3c0f57c5fddea3696bd3d058bd13bb82304c888cN
.exe windows:4 windows x86 arch:x86

7d8c16ee511989dba08d838c22062a91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create

kernel32

SetErrorMode
GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
FindNextFileA
DeleteFileA
FindFirstFileA
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetModuleHandleA
ExitProcess
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
EnterCriticalSection
Sleep
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GlobalFree
LoadLibraryA
GetProcAddress
CreateThread
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
CopyFileA

user32

CreateDialogParamA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DestroyWindow
SetTimer
SetWindowTextA
SetForegroundWindow
ShowWindow
CharNextA
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
PostQuitMessage

gdi32

GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateBrushIndirect
CreateFontA
SetBkMode
SetTextColor
SetBkColor
SelectObject

advapi32

RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$1/ActiveRefresh/settings.xml
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

2974852fdb738688c98d82902c6fc614

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
MultiByteToWideChar
GetPrivateProfileStringA
lstrcmpiA
GetPrivateProfileIntA
lstrcatA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalAlloc
MulDiv
lstrcpynA

user32

MapWindowPoints
PtInRect
SetCursor
LoadIconA
DrawFocusRect
CreateWindowExA
GetDC
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
DrawTextA
LoadCursorA
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
CallWindowProcA
PostMessageA
MessageBoxA
EnableWindow
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetDlgItem
GetWindowLongA
DestroyIcon
GetDlgCtrlID
SetWindowLongA
LoadImageA

gdi32

SetTextColor
DeleteDC
GetTextExtentPoint32A
GetTextMetricsA
SelectObject
CreateCompatibleDC
DeleteObject

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

shell32

SHGetMalloc
ShellExecuteA
SHGetDesktopFolder
SHBrowseForFolderA
SHGetPathFromIDListA

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/special.ini
ActiveRefresh.exe
.exe windows:4 windows x86 arch:x86

537512da3dcbd5212449980dd18820ec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

PlaySoundA

ws2_32

gethostname
WSAStartup
WSACleanup
WSAGetLastError
send
recv
socket
getservbyname
htons
connect
gethostbyname

wininet

InternetSetOptionA
InternetOpenUrlA
InternetGetConnectedState
InternetCombineUrlA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA
InternetConnectA
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetReadFile

imm32

ImmSetCompositionWindow
ImmGetCompositionStringW
ImmGetContext
ImmSetCompositionFontA
ImmReleaseContext

kernel32

GetProcAddress
lstrcpyW
MoveFileA
GetFileSize
DeleteFileA
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetUserDefaultLangID
GetSystemDefaultLangID
TerminateThread
FindClose
FindFirstFileA
FindNextFileA
GetUserDefaultLCID
SetThreadLocale
CopyFileA
GetTickCount
GetSystemTime
GetDateFormatA
GetTimeFormatA
GetFileAttributesA
CompareStringW
CompareStringA
GlobalSize
GlobalFree
QueryPerformanceCounter
IsDBCSLeadByteEx
lstrlenW
MultiByteToWideChar
LoadLibraryExA
IsDBCSLeadByte
InterlockedDecrement
lstrcmpA
GlobalUnlock
GlobalLock
GlobalGetAtomNameA
lstrcpynW
lstrcpynA
GetCurrentProcessId
HeapFree
GlobalDeleteAtom
GlobalAddAtomA
WaitForSingleObject
ResumeThread
SetThreadPriority
FreeLibrary
Sleep
CreateEventA
lstrcatA
SetEnvironmentVariableA
IsBadCodePtr
IsBadReadPtr
FlushFileBuffers
SetUnhandledExceptionFilter
SetEndOfFile
CreateFileA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
GetTimeZoneInformation
GetStringTypeW
lstrcmpiA
GetCommandLineA
LoadLibraryA
GetCurrentThreadId
HeapDestroy
HeapReAlloc
HeapSize
ExitThread
CreateThread
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
GetStartupInfoA
RtlUnwind
GetFileType
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
LocalAlloc
LocalLock
LocalUnlock
LocalFree
InterlockedIncrement
CreateDirectoryA
GetModuleFileNameA
GetLastError
CreateMutexA
CloseHandle
HeapCreate
VirtualFree
IsBadWritePtr
TerminateProcess
TlsAlloc
ReleaseMutex
lstrcpyA
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
lstrlenA
MulDiv
GetVersion
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetStringTypeA
GetCurrentProcess
RaiseException
DeleteCriticalSection
InitializeCriticalSection
FindResourceExA
LoadResource
LockResource
SizeofResource
FindResourceA
WideCharToMultiByte
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SetFilePointer
ReadFile
WriteFile
SetEvent
SetStdHandle
GetModuleHandleA
SetLastError
TlsFree
TlsSetValue
TlsGetValue
UnhandledExceptionFilter
GetOEMCP

user32

GetScrollInfo
SetScrollInfo
GetScrollPos
ShowScrollBar
GetClipCursor
ClipCursor
InvertRect
MonitorFromRect
GetMonitorInfoA
SetLastErrorEx
GetDlgItemInt
SetDlgItemInt
GetKeyboardLayout
IsClipboardFormatAvailable
RegisterClipboardFormatA
ScrollWindow
GetMessageTime
TrackPopupMenu
IsDialogMessageA
SetForegroundWindow
SetWindowRgn
DrawIconEx
ShowCursor
LockWindowUpdate
GetClassLongA
DrawFocusRect
DrawFrameControl
ClientToScreen
SetDlgItemTextA
CreateDialogParamA
CloseClipboard
GetClipboardData
OpenClipboard
GetCursorPos
EnableWindow
SetMenu
SetWindowPlacement
IsRectEmpty
GetWindowPlacement
CreateWindowExA
DestroyWindow
CopyRect
GetDoubleClickTime
wsprintfA
GetClassInfoExA
RegisterClassExA
LoadBitmapA
ModifyMenuA
RemoveMenu
AppendMenuA
CreatePopupMenu
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
TrackPopupMenuEx
IsChild
PeekMessageA
GetSubMenu
IsMenu
GetMenuItemInfoA
DrawTextA
GetClassNameA
ReuseDDElParam
UnpackDDElParam
InvalidateRect
LoadStringW
PostQuitMessage
CreateIconFromResource
SetFocus
WindowFromPoint
FrameRect
FillRect
GetActiveWindow
GetWindowThreadProcessId
CharLowerA
GetMenuItemCount
SetMenuItemInfoA
MessageBeep
GetFocus
IsWindowEnabled
ScreenToClient
GetKeyState
PtInRect
ReleaseCapture
GetDlgCtrlID
GetCapture
SetCapture
UpdateWindow
EndPaint
BeginPaint
DialogBoxParamA
RegisterWindowMessageA
LoadAcceleratorsA
LoadMenuA
LoadStringA
IsWindow
GetWindowTextA
GetWindowTextLengthA
TranslateAcceleratorA
InsertMenuA
DeleteMenu
SetClipboardData
EmptyClipboard
CallWindowProcA
DestroyMenu
DrawStateA
SendMessageA
UnhookWindowsHookEx
PostThreadMessageA
DestroyAcceleratorTable
RedrawWindow
CreateAcceleratorTableA
InvalidateRgn
GetDesktopWindow
SetWindowsHookExA
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
LoadIconA
GetDialogBaseUnits
DialogBoxIndirectParamA
CheckDlgButton
EnableMenuItem
GetSystemMenu
DrawIcon
CallNextHookEx
SetMenuDefaultItem
MoveWindow
EqualRect
InflateRect
SetRectEmpty
PostMessageA
GetMessagePos
CharNextA
IntersectRect
DrawEdge
OffsetRect
GetWindowDC
GetSystemMetrics
DestroyIcon
SetCursor
LoadCursorA
SetParent
IsWindowVisible
GetMenu
KillTimer
GetWindowLongA
GetSysColor
SetWindowLongA
SetRect
EndDialog
LoadImageA
SetWindowPos
UnregisterClassA
ShowWindow
SetWindowTextA
ReleaseDC
GetClientRect
GetDC
SetTimer
GetDlgItem
GetParent
GetWindow
SystemParametersInfoA
GetWindowRect
MapWindowPoints
GetSysColorBrush

gdi32

SaveDC
RestoreDC
SetViewportOrgEx
Polyline
Polygon
PatBlt
CreatePolygonRgn
CreateBitmap
SetPolyFillMode
GetTextExtentPoint32A
CreatePalette
ExcludeClipRect
CombineRgn
GetClipRgn
FrameRgn
CreateRoundRectRgn
TextOutA
GetBkColor
GetCurrentObject
EnumFontFamiliesA
SetTextAlign
RoundRect
Ellipse
ExtTextOutW
GetTextExtentPoint32W
GetTextExtentExPointA
GetTextExtentExPointW
CreateRectRgn
GetClipBox
LPtoDP
DPtoLP
GetTextMetricsA
CreateFontIndirectA
FillRgn
CreatePatternBrush
CreatePen
CreateSolidBrush
SetPixel
GetStockObject
ExtTextOutA
SetBkColor
Rectangle
LineTo
MoveToEx
IntersectClipRect
SelectClipRgn
SetWindowOrgEx
GetNearestColor
GetDeviceCaps
CreateDCA
SetTextColor
SetBkMode
BitBlt
SelectObject
GetObjectA
StretchBlt
RealizePalette
SelectPalette
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
CreateRectRgnIndirect
DeleteDC

comdlg32

ChooseColorA
ReplaceTextA
FindTextA
GetSaveFileNameA
GetOpenFileNameA

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegDeleteValueA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA
FindExecutableA
SHAppBarMessage
Shell_NotifyIconA

ole32

ReleaseStgMedium
DoDragDrop
CoResumeClassObjects
RegisterDragDrop
OleInitialize
CLSIDFromString
CoUninitialize
CoTaskMemAlloc
CoRevokeClassObject
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CreateStreamOnHGlobal
CoInitialize
OleUninitialize
OleLockRunning
CoGetClassObject
CoTaskMemRealloc
CLSIDFromProgID
RevokeDragDrop

oleaut32

SysAllocStringLen
OleCreateFontIndirect
SysFreeString
LoadRegTypeLi
SysStringLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
LoadTypeLi
VariantInit
VariantClear
DispCallFunc
VarUI4FromStr
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SysAllocStringByteLen
VarBstrCat

shlwapi

PathFindExtensionA
SHAutoComplete

comctl32

ImageList_LoadImageA
ImageList_Create
InitCommonControlsEx
ImageList_GetImageInfo
_TrackMouseEvent
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Draw
ImageList_GetIconSize
ImageList_GetIcon
DestroyPropertySheetPage
PropertySheetA
CreatePropertySheetPageA
ord8
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragMove
ImageList_DragShowNolock
ImageList_DragEnter
ImageList_DragLeave
ImageList_ReplaceIcon
ImageList_DrawEx
ImageList_DrawIndirect
ord6

Exports

Exports

_Scintilla_DirectFunction@16

Sections

.text
Size: 932KB - Virtual size: 929KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Plugins/ftp2rss.dll
.dll windows:4 windows x86 arch:x86

79c9563d069dc078419c871003fc3cae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\SisyphSoft\Source\Plugins\ftp2rss\Release\ftp2rss.pdb

Imports

kernel32

InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
lstrcatA
lstrcpyA
lstrlenA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MultiByteToWideChar
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
SetFilePointer
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
GetOEMCP
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
IsBadWritePtr
TerminateProcess
GetCurrentProcess
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA

user32

DefWindowProcA
CreateDialogParamA
LoadIconA
GetWindowTextA
GetDlgItem
SetWindowTextA
SendMessageA

wininet

InternetFindNextFileA
FtpFindFirstFileA
InternetConnectA
InternetOpenA
InternetCloseHandle

Exports

Exports

RSSPlugin
createOptionDialog
description
epilogue
getOptionsDlgData
icon
load
menustring
name
pattern
prologue
setupOptionsDlg
unload
update
viewmode

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/pop3.dll
.dll windows:4 windows x86 arch:x86

c0f646c39a38ed9c795841e54623c3c7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
SetLastError
Sleep
GetTickCount
MultiByteToWideChar
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
SetFilePointer
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetUnhandledExceptionFilter
GetOEMCP
GetCPInfo
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
GetStringTypeA
GetStringTypeW
HeapCreate
VirtualFree
IsBadWritePtr
SetHandleCount

user32

DefWindowProcA
CreateDialogParamA
LoadIconA
SetWindowTextA
GetDlgItem
GetWindowTextA

ws2_32

socket
connect
send
recv
closesocket
select
WSASetLastError
gethostbyname
inet_addr
htons

Exports

Exports

RSSPlugin
createOptionDialog
description
epilogue
getOptionsDlgData
icon
load
menustring
name
pattern
prologue
setupOptionsDlg
unload
update
viewmode

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/yahoomail.dll
.dll windows:4 windows x86 arch:x86

b81bd0a74cb2e74af6f6337a70a92ee6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetCrackUrlA
InternetOpenA
HttpQueryInfoA
InternetSetOptionA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle

kernel32

HeapAlloc
FlushFileBuffers
SetStdHandle
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
WriteFile
MultiByteToWideChar
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
SetFilePointer
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
ExitProcess
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCurrentThreadId
GetCommandLineA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetOEMCP
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapCreate
VirtualFree
IsBadWritePtr
GetStringTypeA
GetStringTypeW

user32

GetWindowTextA
GetDlgItem
SetWindowTextA
LoadIconA
CreateDialogParamA
DefWindowProcA

Exports

Exports

RSSPlugin
createOptionDialog
description
epilogue
getOptionsDlgData
icon
load
menustring
name
pattern
prologue
setupOptionsDlg
unload
update
viewmode

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Scripts/britanica.xml
.html
Scripts/dictionary.xml
.html
Scripts/google.xml
.html
Scripts/microsoftBA.xml
.html
Scripts/searchmsdn.xml
.html
Scripts/stock.xml
.html
Scripts/whois.xml
.html
Style/Clean and Simple.xsl
.xml
Style/Default (Large Font).xsl
.xml
Style/Forum (Blue).xsl
.xml
Style/Forum (Brown).xsl
.xml
Style/Terminal.xsl
.xml
Theme/Notify.wav
Theme/__temp.html
.html
Theme/onepanel.html
.html
Theme/reply.GIF
.gif
Theme/rssitem.templ
Theme/twopanel.html
.html
Uninstall.exe
.exe windows:4 windows x86 arch:x86

7d8c16ee511989dba08d838c22062a91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create

kernel32

SetErrorMode
GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
FindNextFileA
DeleteFileA
FindFirstFileA
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetModuleHandleA
ExitProcess
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
EnterCriticalSection
Sleep
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GlobalFree
LoadLibraryA
GetProcAddress
CreateThread
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
CopyFileA

user32

CreateDialogParamA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DestroyWindow
SetTimer
SetWindowTextA
SetForegroundWindow
ShowWindow
CharNextA
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
PostQuitMessage

gdi32

GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateBrushIndirect
CreateFontA
SetBkMode
SetTextColor
SetBkColor
SelectObject

advapi32

RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

2974852fdb738688c98d82902c6fc614

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
MultiByteToWideChar
GetPrivateProfileStringA
lstrcmpiA
GetPrivateProfileIntA
lstrcatA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalAlloc
MulDiv
lstrcpynA

user32

MapWindowPoints
PtInRect
SetCursor
LoadIconA
DrawFocusRect
CreateWindowExA
GetDC
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
DrawTextA
LoadCursorA
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
CallWindowProcA
PostMessageA
MessageBoxA
EnableWindow
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetDlgItem
GetWindowLongA
DestroyIcon
GetDlgCtrlID
SetWindowLongA
LoadImageA

gdi32

SetTextColor
DeleteDC
GetTextExtentPoint32A
GetTextMetricsA
SelectObject
CreateCompatibleDC
DeleteObject

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

shell32

SHGetMalloc
ShellExecuteA
SHGetDesktopFolder
SHBrowseForFolderA
SHGetPathFromIDListA

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
activerefresh.chm
.chm
base/Entertainment.xml
.vbs .xml polyglot
base/General News.xml
.vbs .xml polyglot
base/Health.xml
.vbs .xml polyglot
base/MiscNews.xml
.vbs .xml polyglot
base/Popular Web Portals.xml
.vbs .xml polyglot
base/Science News.xml
.vbs .xml polyglot
base/Software Downloads.xml
.vbs .xml polyglot
base/Software News.xml
.vbs .xml polyglot
base/Technology News.xml
.vbs .xml polyglot
base/Weblogs.xml
.vbs .xml polyglot
base/base.xml
keyboard.html
.html
license.txt
localization/activerefresh.russian.xml

Sharing

General

Malware Config

Signatures

Files

7d8c16ee511989dba08d838c22062a91

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 17KB - Virtual size: 20KB

2974852fdb738688c98d82902c6fc614

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

shell32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 934B

537512da3dcbd5212449980dd18820ec

Headers

File Characteristics

Imports

winmm

ws2_32

wininet

imm32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

Exports

Exports

Sections

.text Size: 932KB - Virtual size: 929KB

.rdata Size: 148KB - Virtual size: 144KB

.data Size: 16KB - Virtual size: 24KB

.rsrc Size: 168KB - Virtual size: 166KB

79c9563d069dc078419c871003fc3cae

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

wininet

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 17KB - Virtual size: 20KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 934B

.text
Size: 932KB - Virtual size: 929KB

.rdata
Size: 148KB - Virtual size: 144KB

.data
Size: 16KB - Virtual size: 24KB

.rsrc
Size: 168KB - Virtual size: 166KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 72KB - Virtual size: 68KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 84KB - Virtual size: 81KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 12KB - Virtual size: 8KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 17KB - Virtual size: 20KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 934B