b26a2844baea9fc9e6d7c739b49930b3
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2015-Dec-22 13:21:15 |
| Detected languages |
English - United States
Russian - Russia |
| FileDescription | KIT_02C MFC Application |
| FileVersion | 1, 0, 0, 1 |
| InternalName | KIT_02C |
| LegalCopyright | Copyright (C) 2004 |
| OriginalFilename | KIT_02C.EXE |
| ProductName | KIT_02C Application |
| ProductVersion | 1, 0, 0, 1 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ v7.0 Microsoft Visual C++ v7.1 EXE Microsoft Visual C++ 7.0 MFC |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Suspicious | The PE is possibly a dropper. |
Resource 217 is possibly compressed or encrypted.
Resource 224 is possibly compressed or encrypted. Resource 265 is possibly compressed or encrypted. Resources amount for 89.0059% of the executable. |
| Malicious | VirusTotal score: 6/73 (Scanned on 2024-07-09 16:37:25) |
APEX:
Malicious
AVG: Win32:RATX-gen [Trj] Avast: Win32:RATX-gen [Trj] Microsoft: Trojan:Win32/Wacatac.B!ml Rising: Trojan.Injector!1.FCCE (CLASSIC) Trapmine: malicious.moderate.ml.score |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2015-Dec-22 13:21:15 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 7.0 |
| SizeOfCode | 0x78000 |
| SizeOfInitializedData | 0x519000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0005ED5E (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x79000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x59b000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x770000 |
| SizeofStackCommit | 0x71000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
Imports
| KERNEL32.dll |
GetSystemTimeAsFileTime
CreateDirectoryA ExitProcess TerminateProcess GetStartupInfoA RaiseException HeapSize HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr GetTimeZoneInformation GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapAlloc GetFileType QueryPerformanceCounter GetCurrentProcessId SetUnhandledExceptionFilter LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr VirtualProtect GetSystemInfo VirtualQuery SetStdHandle SetEnvironmentVariableA HeapReAlloc HeapFree RtlUnwind WritePrivateProfileStringA GetFileTime FileTimeToLocalFileTime SetErrorMode GetOEMCP GetCPInfo InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection TlsGetValue EnterCriticalSection GlobalHandle GlobalReAlloc LeaveCriticalSection LocalAlloc GlobalFlags FormatMessageA LocalFree GetCurrentThread GlobalAlloc lstrcmpA ConvertDefaultLocale EnumResourceLanguagesA InterlockedDecrement FileTimeToSystemTime CreateFileA GetFullPathNameA GetVolumeInformationA GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile SetLastError GetModuleFileNameA lstrcpynA GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom LoadLibraryA FreeLibrary lstrcatA lstrcmpW lstrcpyA GetModuleHandleA GetProcAddress FreeResource lstrlenA lstrcmpiA CompareStringW CompareStringA GetVersion MultiByteToWideChar MulDiv CreateEventA CreateThread WideCharToMultiByte GetOverlappedResult GetLastError CloseHandle WaitForSingleObject TerminateThread FindResourceA LoadResource LockResource SizeofResource GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange DeleteFileA Sleep Beep FindFirstFileA FindClose FindNextFileA GetLocalTime GetCommandLineA GetTickCount GlobalLock GlobalUnlock GlobalFree GetFileAttributesA CancelIo SetHandleCount |
|---|---|
| USER32.dll |
GrayStringA
DrawTextExA DrawTextA TabbedTextOutA SetMenuItemBitmaps ModifyMenuA GetMenuState EnableMenuItem GetMenuCheckMarkDimensions LoadBitmapA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA GetClassInfoExA GetClassNameA SetPropA GetPropA RemovePropA SendDlgItemMessageA GetFocus SetFocus IsChild GetWindowTextA GetForegroundWindow GetLastActivePopup DispatchMessageA GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints MessageBoxA GetKeyState SetForegroundWindow UpdateWindow GetMenu GetSubMenu GetMenuItemID GetMenuItemCount GetSysColor ScreenToClient EqualRect RegisterClassA UnregisterClassA GetDlgCtrlID DefWindowProcA CallWindowProcA SetWindowLongA SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamA DestroyWindow IsWindow GetWindowLongA GetDlgItem IsWindowEnabled GetParent GetNextDlgTabItem EndDialog RegisterWindowMessageA ReleaseCapture PtInRect SetCapture EnableWindow BeginPaint EndPaint MessageBeep GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableA IsRectEmpty CharNextA GetCapture CharUpperA PeekMessageA GetSystemMetrics LoadIconA WinHelpA KillTimer SetTimer IsIconic GetSystemMenu AppendMenuA DrawIcon PostMessageA InvalidateRect PostThreadMessageA GetWindowRect LoadImageA ReleaseDC GetDC CopyRect SetRect SendMessageA IsWindowVisible GetClientRect GetClassInfoA LoadCursorA GetSysColorBrush WindowFromPoint DestroyMenu RegisterClipboardFormatA SetWindowContextHelpId MapDialogRect GetMessageA TranslateMessage GetCursorPos ValidateRect SetCursor PostQuitMessage wsprintfA GetWindowDC AdjustWindowRectEx ClientToScreen CheckMenuItem |
| GDI32.dll |
CreateFontIndirectA
CombineRgn PtInRegion GetClipBox SetBkColor SaveDC RestoreDC SetStretchBltMode SetMapMode SelectClipRgn GetViewportExtEx GetWindowExtEx StartDocA PtVisible RectVisible ExtTextOutA Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox SetTextColor SetBkMode SetTextAlign TextOutA MoveToEx LineTo CreateDIBitmap SetDIBits CreateRectRgn EndDoc EndPage StartPage GetDeviceCaps CreateDCA CreatePenIndirect CreateFontA CreateBitmap CreateSolidBrush CreateCompatibleDC GetObjectA StretchBlt GetTextExtentPoint32A CreatePen GetStockObject DeleteObject SelectObject Ellipse BitBlt |
| WINSPOOL.DRV |
OpenPrinterA
DocumentPropertiesA ClosePrinter EnumPrintersA |
| ADVAPI32.dll |
RegCloseKey
RegOpenKeyA RegOpenKeyExA RegDeleteKeyA RegEnumKeyA RegQueryValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA |
| COMCTL32.dll |
#17
ImageList_Destroy |
| SHLWAPI.dll |
PathIsUNCA
PathFindExtensionA PathStripToRootA PathFindFileNameA |
| oledlg.dll |
#8
|
| ole32.dll |
CoTaskMemAlloc
OleRun CoTaskMemFree OleInitialize CoFreeUnusedLibraries OleUninitialize CLSIDFromString CLSIDFromProgID CoCreateInstance CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject |
| OLEAUT32.dll |
SysFreeString
VariantChangeType VariantInit SysAllocStringLen SystemTimeToVariantTime SysAllocString SysStringLen SysAllocStringByteLen VariantCopy SafeArrayDestroy OleCreateFontIndirect VariantClear |
| OLEACC.dll |
LresultFromObject
CreateStdAccessibleObject |
Delayed Imports
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
MOOITOTLG1
200
212
213
214
215
216
217
224
227
228
229
230
231
232
233
235
236
237
239
240
245
246
247
254
262
263
264
265
266
267
269
274
276
279
280
281
282
283
284
285
286
290
292
293
300
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
321
322
335
336
338
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
30994
30996
EDWARDISGAY30
EDWARDISGAY31
EDWARDISGAY32
EDWARDISGAY33
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
57
59
103
199
202
203
205
206
207
209
210
211
219
220
221
251
253
258
259
260
270
275
277
278
288
289
297
303 (#2)
304 (#2)
305 (#2)
308 (#2)
311 (#2)
313 (#2)
343 (#2)
345 (#2)
347 (#2)
30721
3841
3842
3843
3857
3858
3859
3860
3865
3866
3867
3868
3869
3887
30977
30998
30999
31000
31001
31002
31003
31004
31005
31006
31007
31008
31009
31010
31011
201
222
223
255
256
257
271
273
274 (#2)
275 (#2)
341 (#2)
342 (#2)
343 (#3)
344 (#2)
1 (#2)
1 (#3)
103 (#2)
203 (#2)
221 (#2)
251 (#2)
260 (#2)
277 (#2)
305 (#3)
345 (#3)
String Table contents
| Open |
| Save As |
| All Files (*.*) |
| Untitled |
| an unnamed file |
| &Hide |
| No error message is available. |
| An unsupported operation was attempted. |
| A required resource was unavailable. |
| Out of memory. |
| An unknown error has occurred. |
| Invalid filename. |
| Failed to open document. |
| Failed to save document. |
| Save changes to %1? |
| Failed to create empty document. |
| The file is too large to open. |
| Could not start print job. |
| Failed to launch help. |
| Internal application error. |
| Command failed. |
| Insufficient memory to perform operation. |
| System registry entries have been removed and the INI file (if any) was deleted. |
| Not all of the system registry entries (or INI file) were removed. |
| This program requires the file %s, which was not found on this system. |
| This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s. |
| Please enter an integer. |
| Please enter a number. |
| Please enter an integer between %1 and %2. |
| Please enter a number between %1 and %2. |
| Please enter no more than %1 characters. |
| Please select a button. |
| Please enter an integer between 0 and 255. |
| Please enter a positive integer. |
| Please enter a date and/or time. |
| Please enter a currency. |
| Please enter a GUID. |
| Please enter a time. |
| Please enter a date. |
| Unexpected file format. |
| %1 |
| Cannot find this file. |
| Please verify that the correct path and file name are given. |
| Destination disk drive is full. |
| Unable to read from %1, it is opened by someone else. |
| Unable to write to %1, it is read-only or opened by someone else. |
| An unexpected error occurred while reading %1. |
| An unexpected error occurred while writing %1. |
| %1: %2 |
| Continue running script? |
| Dispatch exception: %1 |
| Unable to read write-only property. |
| Unable to write read-only property. |
| Unable to load mail system support. |
| Mail system DLL is invalid. |
| Send Mail failed to send message. |
| No error occurred. |
| An unknown error occurred while accessing %1. |
| %1 was not found. |
| %1 contains an invalid path. |
| %1 could not be opened because there are too many open files. |
| Access to %1 was denied. |
| An invalid file handle was associated with %1. |
| %1 could not be removed because it is the current directory. |
| %1 could not be created because the directory is full. |
| Seek failed on %1 |
| A hardware I/O error was reported while accessing %1. |
| A sharing violation occurred while accessing %1. |
| A locking violation occurred while accessing %1. |
| Disk full while accessing %1. |
| An attempt was made to access %1 past its end. |
| No error occurred. |
| An unknown error occurred while accessing %1. |
| An attempt was made to write to the reading %1. |
| An attempt was made to access %1 past its end. |
| An attempt was made to read from the writing %1. |
| %1 has a bad format. |
| %1 contained an unexpected object. |
| %1 contains an incorrect schema. |
| pixels |
| Uncheck |
| Check |
| Mixed |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.1 |
| ProductVersion | 1.0.0.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | Russian - Russia |
| FileDescription | KIT_02C MFC Application |
| FileVersion (#2) | 1, 0, 0, 1 |
| InternalName | KIT_02C |
| LegalCopyright | Copyright (C) 2004 |
| OriginalFilename | KIT_02C.EXE |
| ProductName | KIT_02C Application |
| ProductVersion (#2) | 1, 0, 0, 1 |
| Resource LangID | Russian - Russia |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x1ad5bad5 |
|---|---|
| Unmarked objects | 0 |
| 39 (9162) | 1 |
| 37 (8755) | 2 |
| C objects (9178) | 9 |
| C objects (9177) | 1 |
| Imports (9210) | 24 |
| ASM objects (VS2002 (.NET) build 9466) | 30 |
| C objects (VS2002 (.NET) build 9466) | 148 |
| 39 (8491) | 9 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 3 |
| Total imports | 579 |
| C++ objects (VS2002 (.NET) build 9466) | 157 |
| Resource objects (VS2002 (.NET) build 9466) | 1 |
| Linker (VS2002 (.NET) build 9466) | 1 |