2.6
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.72
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Crypt-SDK [Trj] | 20191002 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Kryptik.ld | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191002 | 2013.8.14.323 |
| McAfee | None | 20191002 | 6.0.6.653 |
| Tencent | None | 20191002 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727110795.812125 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727110796.00025 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(2 个事件)
动态指标
连接到动态 DNS 域
(1 个事件)
| domain | checkip.dyndns.org |
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
查找外部 IP 地址
(1 个事件)
| domain | checkip.dyndns.org |
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\olacweegim.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\olacweegim.exe |
网络通信
与未执行 DNS 查询的主机进行通信
(3 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
| host | 104.174.123.66 | |||
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 104.174.123.66:443 |
文件已被 VirusTotal 上 51 个反病毒引擎识别为恶意
(50 out of 51 个事件)
| APEX | Malicious |
| AVG | Win32:Crypt-SDK [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Upatre.Gen.3 |
| Antiy-AVL | Trojan/Win32.AGeneric |
| Arcabit | Trojan.Upatre.Gen.3 |
| Avast | Win32:Crypt-SDK [Trj] |
| Avira | TR/Dldr.Upatre.MY |
| Baidu | Win32.Trojan.Kryptik.ld |
| BitDefender | Trojan.Upatre.Gen.3 |
| CAT-QuickHeal | Trojan.GenericPMF.S5448997 |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.EMD@5syzmz |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.5942be |
| Cylance | Unsafe |
| Cyren | W32/Upatre.KX.gen!Eldorado |
| DrWeb | Trojan.DownLoader19.41853 |
| ESET-NOD32 | a variant of Win32/Kryptik.DQSY |
| Emsisoft | Trojan.Upatre.Gen.3 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.KX.gen!Eldorado |
| F-Secure | Trojan.TR/Dldr.Upatre.MY |
| FireEye | Generic.mg.b18ea565942be2fa |
| Fortinet | W32/Kryptik.DQAA!tr |
| GData | Win32.Trojan.Kryptik.CE |
| Ikarus | Trojan.Win32.Crypt |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Upatre.rhh |
| K7AntiVirus | Trojan ( 004ce6cb1 ) |
| K7GW | Trojan ( 004ce6cb1 ) |
| Kaspersky | Trojan-Downloader.Win32.Upatre.frrs |
| MAX | malware (ai score=87) |
| Malwarebytes | Trojan.Upatre |
| McAfee-GW-Edition | BehavesLike.Win32.Upatre.lh |
| MicroWorld-eScan | Trojan.Upatre.Gen.3 |
| Microsoft | TrojanDownloader:Win32/Upatre.AF |
| NANO-Antivirus | Trojan.Win32.Upatre.dugowl |
| Panda | Trj/GdSda.A |
| Qihoo-360 | HEUR/QVM10.1.4839.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Upatre |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Dyreza-HK |
| Symantec | Downloader.Upatre |
| TrendMicro | TROJ_UPATRE.SM37 |
| TrendMicro-HouseCall | TROJ_UPATRE.SM37 |
| VBA32 | BScope.Trojan.Downloader |
| VIPRE | Trojan-Downloader.Win32.Upatre.tfl (v) |
| Yandex | Trojan.DL.Upatre! |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-09-03 19:53:16
PE Imphash
542d42466aeb606fc2041068aba446d6
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00006cdc | 0x00006e00 | 6.760548576826007 |
| .rdata | 0x00008000 | 0x000035a2 | 0x00003600 | 4.767326221169764 |
| .data | 0x0000c000 | 0x00002d20 | 0x00001a00 | 3.554390132639098 |
| .rsrc | 0x0000f000 | 0x00004e20 | 0x00005000 | 5.38616958528634 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_CURSOR | 0x00013850 | 0x00000134 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_CURSOR | 0x00013850 | 0x00000134 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_BITMAP | 0x00013668 | 0x00000098 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_BITMAP | 0x00013668 | 0x00000098 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_ICON | 0x0000f348 | 0x00004228 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_DIALOG | 0x0000f2e0 | 0x00000062 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_CURSOR | 0x00013988 | 0x00000014 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_GROUP_CURSOR | 0x00013988 | 0x00000014 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_GROUP_ICON | 0x00013570 | 0x00000014 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_VERSION | 0x00013ba8 | 0x00000278 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
| RT_MANIFEST | 0x000139a0 | 0x00000208 | LANG_RHAETO_ROMANCE | SUBLANG_DEFAULT | None |
Imports
Library KERNEL32.DLL:
• 0x408018 GetStringTypeW
• 0x40801c MultiByteToWideChar
• 0x408020 LCMapStringW
• 0x408024 HeapSize
• 0x408028 RtlUnwind
• 0x40802c Sleep
• 0x408030 IsValidCodePage
• 0x408034 GetOEMCP
• 0x408038 GetACP
• 0x40803c HeapReAlloc
• 0x408040 SizeofResource
• 0x408044 GetDateFormatA
• 0x408048 GetTimeFormatA
• 0x40804c FindResourceA
• 0x408050 LockResource
• 0x408054 LoadResource
• 0x408058 LoadLibraryA
• 0x40805c SetLastError
• 0x408060 IsProcessorFeaturePresent
• 0x408064 GetCPInfo
• 0x408068 GetFileType
• 0x40806c GetCommandLineA
• 0x408070 HeapSetInformation
• 0x408074 GetStartupInfoW
• 0x408078 SetUnhandledExceptionFilter
• 0x40807c GetProcAddress
• 0x408080 GetModuleHandleW
• 0x408084 ExitProcess
• 0x408088 DecodePointer
• 0x40808c WriteFile
• 0x408090 GetStdHandle
• 0x408094 GetModuleFileNameW
• 0x408098 GetModuleFileNameA
• 0x40809c FreeEnvironmentStringsW
• 0x4080a0 WideCharToMultiByte
• 0x4080a4 GetEnvironmentStringsW
• 0x4080a8 SetHandleCount
• 0x4080ac InitializeCriticalSectionAndSpinCount
• 0x4080b0 DeleteCriticalSection
• 0x4080b4 EncodePointer
• 0x4080b8 TlsAlloc
• 0x4080bc TlsGetValue
• 0x4080c0 TlsSetValue
• 0x4080c4 TlsFree
• 0x4080c8 InterlockedIncrement
• 0x4080cc GetCurrentThreadId
• 0x4080d0 GetLastError
• 0x4080d4 InterlockedDecrement
• 0x4080d8 HeapCreate
• 0x4080dc QueryPerformanceCounter
• 0x4080e0 GetTickCount
• 0x4080e4 GetCurrentProcessId
• 0x4080e8 GetSystemTimeAsFileTime
• 0x4080ec HeapFree
• 0x4080f0 HeapAlloc
• 0x4080f4 RaiseException
• 0x4080f8 LeaveCriticalSection
• 0x4080fc EnterCriticalSection
• 0x408100 LoadLibraryW
• 0x408104 UnhandledExceptionFilter
• 0x408108 IsDebuggerPresent
• 0x40810c TerminateProcess
• 0x408110 GetCurrentProcess
Library COMCTL32.dll:
• 0x408010 InitCommonControlsEx
Library USER32.dll:
• 0x408118 LoadStringA
• 0x40811c LoadIconA
• 0x408120 RegisterClassExA
• 0x408124 GetMessageA
• 0x408128 TranslateMessage
• 0x40812c DispatchMessageA
• 0x408130 PostQuitMessage
• 0x408134 SetWindowTextA
• 0x408138 SendMessageA
• 0x40813c DefWindowProcA
• 0x408140 PostMessageA
• 0x408144 CreateWindowExA
• 0x408148 ShowWindow
• 0x40814c UpdateWindow
L!This program cannot be run in DOS mode.
7"aich
`.rdata
@.data
@@@@@@
RP=`@@
_^]PuVF8%
MVWQ_3
GHuGHHGH
Au^H9E
v_^[]UE
Vj jdh
Vj jdh
jiVjdhH@
U3UH_@
@@@@@@
uUEPSS}"
=?sJMsB
;r6P2F
Y;t)UEP
@-B^CVCo
!`(=!W
H187,,*/
&2CZ2,-KB]
`'=._'-
K$;CF',&
1X#21Y'=C^6,.zB
7B/.7_
^&`-:/k+2
;3L66CH6
n-+7n0;7k+2
A'^1Y'
_0;7D0;7_;
/Y02--
20e#0/-
77L. /NB
,H1-CU+*1N'-CZ+0-Yl:/d,*1H6
7]67--
0&C'*3C
^-H007B,0 zB
*3H,:&X'-
d,*1H6
0&C'*&b2*,zB
7|7;:C$1C
r{f-g-f--.-Y'&l-#./N#*,
1*A#qm
tpjl2.&H
an~*Hb
Bk~+B/;w
lfcL$?*
qkp--2 H'9.H:;z
{n"_+=&
'&CE'=*
&''^l1$
Blm rpq
{mlH0o7_Bou
pnCL',mL0^t por
lhlH0o7_Bhm
qpr solH0o7_Blu wjq
loCL',mL0^w
soCL',mL0^s
sim qpu
#;rY#,t
pmm lfCL',mL0^t
lhlH0o7_Bop vmq
liCL',mL0^z
sjlH0o7_Bo{ wkq
lmCL',mL0^z
ljCL',mL0^v
siCL',mL0^r
pkCL',mL0^{ sjr
pkCL',mL0^w
#;rY#,r
llu vit-m?1
#;rY#,p
#;rY#,u
sjCL',mL0^v
lkCL',mL0^z
#;rY#,{
pp{-m?1
spq-m?1
tow-m?1
pom p^"_sp"-zoz
sim-m?1
pps-m?1
#;rY#,r
llq wnp-m?1
rir Bq&
#;rY#,r
thq-m?1
w^"_sp"-sfm
sfCL',mL0^{
qglH0o7_Bhm
poCL',mL0^t rhz
tflH0o7_Bhm ppz
wjlH0o7_Bhm
wn{-m?1
upu-m?1
{ps qfr
vjp-m?1
#;rY#,r llq
vpw-m?1
6?C low vnr
C}AHUCANSCALQCAROCAPMCAVKCATICAZGCAXECA^CCA\ACAb
CA`}CAf{CAdyCAjwCAhuCAnsCAlqCAroCApmCAvkCAtiCAzgCAxeCA~cCA|aCA
CA"?CA =CA&;CA$9CA*7CA(5C
(ZC-B6
qgfeo~_J
)B^e>].
#C^KAGKs
8G5?B,C
UCM"BG'LiB^
P'NiB^
|'NiB^
X7hM!B-
GF#P-B^T
8A%h6Z
+xp$K8i)$
B8GK%FZK%F7
e-B^oK8i
T-7s+tp$
f$)r8G
8G-Xm%
a6}MCd+(Z)7
\f- !~qfg
.AgGv !
MEf_~.W@
`Cdhm,
/+4=(]p
DV,B^i(
/AgAh7K
a6}RyCd+(Z)z
FT-B^l
V`XB-XGG]
7g>Q?U-B
Yi(pg6QD
^1d6[td-1
6B-hC-Y
%U)kCE^
UB-BK{dC-
jgU(k^
ZJFRFXu
@@@@@@
S^`N`H
j$Y~\d9
QY^`[_^]
R9\(L(u
_^[]AU
Mu^FF#
NMIIII
Virt^_
cBxCGU8+TXC
YY]jXh@
8csmu*x
YYuTVWhBC@
3]j hh@
3PPPPP_
@Y<v*V
^SSSSSyj
;tFtA3
t.t$<"u
t?VSPp#
3Y[_^5\@
3PPPPP
FA>\t>"u&
3wf93t
f90uW=@
VVV+V@PSVVE
E;t8P!
YE;t*VVuPuSVV
j@j ^Vj!
;rSWf9M
YYt:V5
YF\=H@
~lt#Ww
43_V5|@
YYt0V5
1E3PeuEEEEd
Y__^[]Q
E_^[]E
9csmu)=@
E3E3;u
UQSV5@
;r>Pu(
woVW=@
F$|3@_^
Y+t"+t
+tY+uC}
Uw\]Yp
u>OdMGd
u wdSUY
ffffffE
YM_3[,
3PPPPP
B(;r3_^[]
1E3PEd
tAt2t$
t?P5P@
3M_^3[
ft'Ou"+
jPfDJXdf
WPWPWv
whu;5 @
8]tEMap<u
TM_^3[j
PY^hS=
YYu,9E
3W;to=@
oYY~PE
PJY9_t
uV$Y_^[]
t4V0;t(W8jYt
Fpt"~l
j PYNj
lVYYYEE
YuSVWT$
URPQQhf@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
r)$pj@
DDDDDDDDDDDDDD
S3VW;~ E
@;u+H;}
39](SSu
]9]tWuu
};~Bj3X
3;t?uWuuu
t"SS9] u
EWYuwEYe_^[M3
Mu(Eu$u u
ES3VW]9]
39] SSu
ESJEYe_^[M3
uY3MW0u
6v v$v(v,v0~v4vv
nv8fv<^@v@SvDKvHCvL;vP3vT+vX#v\
vlvpvtvxv|@
P6YF0;
P$Yv4;5@
PnYF<;
P\YF@;
PJYFD;
P8YFH;
P&YvL;5@
Y^]USVWUj
P(RP$R
UPjhw@
t:|$,t
;t$,v-4v
UQPXY]Y[
FGIuX^_]
KuZUVD$
UV3PPPPPPPPU
$s ^UV3PPPPPPPPU
$sF ^UWVSM
[^_%(@
:>Kf=?V4,h[) -S
ColumnModeTip
DocReloadWarning
DeleteFileFailed
FileLockedWarning
FileAlreadyOpenedInNpp
NbFileToOpenImportantWarning
MZu& R0>JT<gHY,(2Q&J7
hlF=kXiTmS:^5HPa
HOLY SHIT MY
GARDEN'S ON FIRE!!
Anonymous #10
just read a list
of "the 100 things to do before yo
D"Ch>OjEPj
bad allocation
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
Unknown exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
UpdateWindow
ShowWindow
CreateWindowExA
PostMessageA
DefWindowProcA
SendMessageA
SetWindowTextA
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassExA
LoadIconA
LoadStringA
USER32.dll
SizeofResource
GetDateFormatA
GetTimeFormatA
FindResourceA
LockResource
LoadResource
LoadLibraryA
SetLastError
KERNEL32.DLL
InitCommonControlsEx
COMCTL32.dll
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
RaiseException
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
IsProcessorFeaturePresent
pZYofIbXNXAVg
CannotMoveDoc
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-+.,:?&@=/%#()
FbgMYpfaTjTFBGOIpAUILNjBZ_bar`C[Xh
XO\PpDRqRUllbih
Rowster
Matgoback
button
richedit
static
1234567890
riched32.dll
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVtype_info@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
";Jq,/
8LQ[3=
js|o{nxptlolqorpxny}n{|n|nuosnoptrvpvpvqxqxqwsyqwqxqxrxppop
}{{}z|{yy{z{
~|{ussqonponommoll~||
vttlhijhh~{z
,!3 1!1 1 3
-!:3>)7
3"4#6#7!2 1 1 2 1!1 1 1 /!2
,!4"4!4!4#3 .
(!2!5"5!4"5!4!4!5!4!4 ."3
!!,!0"5"4!4!4"4!3
($6#4!4"4!4!4"6!4!4!3"4
")#0#6"4$5"4"4 .$9
' 1#2#0
%"4"4#4"4"4$5"4#4#8 3
#'$5%8"3#4"3"3!0%8
,`pdrbi\\,2
# 0$2MZdrenel4:!1!6!1
$dreriuhrjqIT ."3"3$4"3"3"4"3"4#5"5
&,'4&8$4$4#3$3$4);#5 0!/';$4';$6);&9':$5#4"6"1#4%;*=#3*=#6#5%8%8':'8#3#3#4#3$4#3#3#4$5"4 (
$((4':$5%3#2#4&8&8%2!/.B/B&:+>&5"0#1(;0D/C,@+A%6!+$2%6(:2D*:,=(:%6)8%4%4'5%4'5%4%4%5&6%7 *
UUUUUUUUUp
DDDDUU
DDDDUU
DDDDUU
UUUwwww
UUUUUUUUUU(
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.2.31"
processorArchitecture="X86"
name="Misolder"
type="win32"/>
<description>Misolder</description>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>x
c a t i o n .
A l l t h e s a v e d m o d i f i c a t i o n s c a n n o t b e u n d o n e .
C o n t i n u e ?
S a v e C u r r e n t M o d i f i c a t i o n
S u m m a r y
r a n g e s
b y t e s ) i n
s e l e c t e d c h a r a c t e r s (
C u r r e n t d o c u m e n t l e n g t h :
L i n e s :
W o r d s :
C h a r a c t e r s ( w i t h o u t b l a n k s ) :
F i l e l e n g t h ( i n b y t e ) :
M o d i f i e d :
C r e a t e d :
F u l l f i l e p a t h :
P l e a s e u s e " A L T + M o u s e S e l e c t i o n " o r " A l t + S h i f t + A r r o w k e y " t o s w i t c h t o c o l u m n m o d e .
C o l u m n M o d e T i p
R i c h T e x t F o r m a t
H T M L F o r m a t
A r e y o u s u r e y o u w a n t t o r e l o a d t h e c u r r e n t f i l e a n d l o s e t h e c h a n g e s m a d e i n N o t e p a d + + ?
D e l e t e F i l e f a i l e d
D e l e t e F i l e
P l e a s e c h e c k i f t h i s f i l e i s o p e n e d i n a n o t h e r p r o g r a m .
S a v e f a i l e d
T h e f i l e i s a l r e a d y o p e n e d i n t h e N o t e p a d + + .
A l l t y p e s
% Y - % m - % d _ % H % M % S
n p p B a c k u p
C a n n o t o p e n f i l e "
$ I N T _ R E P L A C E $ f i l e s a r e a b o u t t o b e o p e n e d .
A r e y o u s u r e t o o p e n t h e m ?
A m o u n t o f f i l e s t o o p e n i s t o o l a r g e
C a n n o t c r e a t e t h e f i l e " % s "
C r e a t e n e w f i l e
% s d o e s n ' t e x i s t . C r e a t e i t ?
U s e r D e f i n e d
- m u l t i I n s t - n o s e s s i o n - o p e n S e s s i o n
S e s s i o n f i l e
C l o s e o t h e
m s c o r e e . d l l
r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
@ M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
K E R N E L 3 2 . D L L
W U S E R 3 2 . D L L
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
( ( ( ( ( H
h ( ( ( ( H
H
@ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @
@ @ @ @ @ @
O p e n i n N e w I n s t a n c e
M o v e t o N e w I n s t a n c e
C l o n e t o O t h e r V i e w
M o v e t o O t h e r V i e w
C u r r e n t D i r . P a t h t o C l i p b o a r d
F i l e n a m e t o C l i p b o a r d
F u l l F i l e P a t h t o C l i p b o a r d
C l e a r R e a d - O n l y F l a g
R e a d - O n l y
M o v e t o R e c y c l e B i n
R e n a m e
S a v e A s . . .
C l o s e A l l t o t h e R i
C l o s e A l l t o t h e L e f t
C l o s e A l l B U T T h i s
D o c u m e n t i s m o d i f i e d , s a v e i t t h e n t r y a g a i n .
M o v e t o n e w N o t e p a d + + I n s t a n c e
C l o n e t o o t h e r V i e w
M o v e t o o t h e r v i e w
s i n h a l a . x m l
b e n g a l i . x m l
a r a g o n e s e . x m l
a r a g o n
t e l u g u . x m l
u y g h u r . x m l
s a r d i n i a n . x m l
h i n d i . x m l
l i g u r i a n . x m l
Z e n e i z e
e s p e r a n t o . x m l
E s p e r a n t o
b o s n i a n . x m l
B o s a n s k i
a z e r b a i j a n i . x m l
r b a y c a n d i l i
t a m i l . x m l
l a t v i a n . x m l
l a t v i e
u v a l o d a
m a c e d o n i a n . x m l
k y r g y z . x m l
u z b e k C y r i l l i c . x m l
u z b e k . x m l
z b e k c h a
k a z a k h . x m l
a f r i k a a n s . x m l
A f r i k a a n s
t a g a l o g . x m l
T a g a l o g
l u x e m b o u r g i s h . x m l
t z e b u e r g e s c h
m a l a y . x m l
B a h a s a M e l a y u
s e r b i a n C y r i l l i c . x m l
s e r b i a n . x m l
S r p s k i
b e l a r u s i a n . x m l
s p a n i s h _ a r . x m l
o l a r g e n t i n a
b a s q u e . x m l
E u s k a r a
g e o r g i a n . x m l
c r o a t i a n . x m l
H r v a t s k i j e z i k
a l b a n i a n . x m l
G j u h a s h q i p e
i n d o n e s i a n . x m l
B a h a s a I n d o n e s i a
b u l g a r i a n . x m l
s a m o g i t i a n . x m l
e m a i t i u r u o d a
e x t r e m a d u r a n . x m l
E s t r e m e
d a n i s h . x m l
s l o v a k . x m l
S l o v e n
s l o v e n i a n . x m l
S l o v e n
g a l i c i a n . x m l
G a l e g o
s w e d i s h . x m l
S v e n s k a
g r e e k . x m l
l i t h u a n i a n . x m l
L i e t u v i
f i n n i s h . x m l
a r a b i c . x m l
f r i u l i a n . x m l
F u r l a n
t h a i . x m l
o c c i t a n . x m l
O c c i t a n
n o r w e g i a n . x m l
n y n o r s k . x m l
N y n o r s k
h e b r e w . x m l
@ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @ @
@ @ @ @ @ @ @ @ @
M i s o l d e r
M S S a n s S e r i f
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 3 9 9 C 8 F 0
C o m p a n y N a m e
M i s o l d e r
F i l e D e s c r i p t i o n
M i s o l d e r
F i l e V e r s i o n
1 . 1 . 3 . 3 2
I n t e r n a l N a m e
L e g a l C o p y r i g h t
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
P r o d u c t N a m e
M i s o l d e r
P r o d u c t V e r s i o n
V a r F i l e I n f o
T r a n s l a t i o n
C : \ b f 3 2 d 3 b 0 \ b 6 6 2 e f 4 9 . e x e
C : \ 4 g a P h 0 t y . e x e
C : \ b i P q 9 _ t U . e x e
C : \ T J a T e R N v . e x e
C : \ _ G a o z Z I R . e x e
C : \ a U C t 9 y r h . e x e
C : \ e Y 1 r v 1 s G . e x e
C : \ 2 A C e c u b 7 . e x e
C : \ F a U 1 V H y h . e x e
C : \ V H 8 H z m r _ . e x e
C : \ 7 P O S w e N 9 . e x e
C : \ o e 9 Y 0 v o 4 . e x e
C : \ u j h D Q s H X . e x e
C : \ C l z K y X 6 b . e x e
C : \ m D 6 P j C i Z . e x e
C : \ d m D F l s N m . e x e
C : \ O X t H l _ J J . e x e
C : \ D n i l Q o V s . e x e
C : \ 5 r G I z 9 l O . e x e
C : \ c Z C 9 O 7 E m . e x e
C : \ R 1 1 E Q V k 5 . e x e
C : \ P 3 h 8 7 j R B . e x e
C : \ m s 6 B g H Y k . e x e
C : \ h G b h L 3 K D . e x e
C : \ u g Y _ r M R j . e x e
C : \ V O R E I F O a . e x e
C : \ M v T W F 7 A r . e x e
C : \ T 7 i S R K r 1 . e x e
C : \ a P f u z v C C . e x e
C : \ A P m 1 I v t e . e x e
C : \ S 2 q A p L u m . e x e
C : \ c 1 0 f c 9 7 c 9 d d b e 7 9 3 e 7 5 3 d 0 5 1 f e 3 3 5 c 7 0 5 2 a 5 7 8 3 c 9 7 9 e 8 1 f 5 3 7 4 5 e f e 5 7 1 2 a 9 1 4 f
C : \ T g 7 J J 4 R G . e x e
C : \ y g 2 s K l y f . e x e
C : \ j g s i k w 1 T . e x e
C : \ T t a c M i i H . e x e
C : \ 1 l N D 6 W 5 6 . e x e
C : \ P F Y w t S U g . e x e
C : \ j D j l O T 2 O . e x e
C : \ h E i T n e O l . e x e
C : \ F M 1 Q E X 4 R . e x e
C : \ i R o l C T I Q . e x e
C : \ e L U J r m W h . e x e
C : \ o L t I 7 1 Y P . e x e
C : \ 6 J M 7 _ O W c . e x e
C : \ m e y K s m Y P . e x e
C : \ 6 0 O G l v p Q . e x e
C : \ 3 a 8 1 c 8 7 7 e 4 4 6 a 0 0 e c 4 3 c 3 c b 2 e 5 d 6 5 8 b a 3 0 2 8 3 2 6 9 5 0 e 1 6 8 8 1 e 5 2 f a 8 5 3 b 6 c 5 f 4 b 0
C : \ h q 2 o X X s R . e x e
C : \ t e z 3 L L T Y . e x e
C : \ H _ C V m W _ v . e x e
C : \ B g H q Q f 6 U . e x e
C : \ 5 a H F 1 _ 8 o . e x e
C : \ o X 8 c F 3 B T . e x e
C : \ Q l N L h e L U . e x e
C : \ p Y y S o x b P . e x e
C : \ Z L h 5 b S 5 j . e x e
C : \ h w V L H F 7 f . e x e
C : \ Z E 7 t Y j E 2 . e x e
C : \ 9 H Z d X Q A c . e x e
C : \ 3 s z 2 S 6 t S . e x e
C : \ c v v V m 3 b F . e x e
C : \ o 2 9 t h o P l . e x e
C : \ 4 8 O L Z T Z F . e x e
C : \ w D R Z 0 O V A . e x e
C : \ 8 e f 1 d f 7 b 3 d 6 b 8 d d 7 2 0 9 1 0 4 5 6 6 2 d 9 4 c 0 7 7 6 8 4 1 3 1 8 . e x e
C : \ q V n d 8 9 _ e . e x e
C : \ f d 7 5 a 2 f 2 1 0 0 0 4 7 9 1 8 4 4 e 1 3 a c 7 e e 2 c 8 a c 9 8 c 6 a 8 1 c 7 1 a 9 5 f 1 6 8 1 2 2 4 6 0 8 9 e e 7 b f 2 c
C : \ 0 1 6 9 5 a 0 d 3 6 3 7 8 e 5 6 f b 8 0 d b 4 9 f a f a f 6 b c f 2 2 3 e f 4 6 6 e 9 6 3 1 7 1 7 7 6 a f 5 e 2 9 d b 5 0 d 7 5
C : \ e 5 a b a 8 0 6 7 5 3 0 0 8 5 5 3 d 6 0 7 a 2 5 d c a b a d d 7 4 e c c b b f 1 a f e a f 3 5 4 3 e f b 0 b b 5 8 4 3 c 6 b e 7
C : \ 6 5 2 1 e 0 e 0 6 1 0 9 f e 6 f 8 a c e a 9 0 f 0 7 d 5 f e 5 b 0 5 7 9 5 8 b d c c a 6 b c 1 c 1 5 5 5 e 6 5 b 1 1 8 3 a f 5 4
C : \ U s e r s \ L i s a \ D e s k t o p \ g l h 0 M l U Z . e x e
C : \ b 4 f d 3 7 3 f 5 7 b e 0 1 7 f f d 2 2 d e a b 5 8 d d 7 c 1 c 2 9 8 6 c d b c 1 7 8 a 5 a b 2 9 2 f 3 5 2 9 0 7 3 3 b 1 6 e e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ c b c 2 1 0 d 3 9 1 c b f a b 1 7 2 e 0 d 9 1 c f 9 8 f 9 5 c 3 d 5 a 5 9 9 6 d c 6 9 0 e 4 4 e 2 1 e b 8 6 6 6 9 9 e b a 2 3 8 . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ M B d K G 5 M k . e x e
C : \ 4 5 9 1 1 6 9 f 5 6 a 2 a 6 b 8 0 d 0 0 f a b c 0 3 2 e 8 0 2 6 5 f 8 d c 8 b 9 1 3 2 c d 6 1 e 8 0 3 2 8 4 3 7 7 e 5 5 c 2 5 3
C : \ U s e r s \ L i s a \ D e s k t o p \ o i W 6 a P 3 g . e x e
C : \ U s e r s \ J o h n \ A p p D a t a \ L o c a l \ T e m p \ h z q Y d T D g e a . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ X f k R w I a R . e x e
C : \ 9 1 8 8 b 1 0 b d a 9 3 4 0 b e 6 d 2 1 4 6 d 8 9 1 1 2 e 6 c 9 3 b 1 c e 7 7 3 a 5 9 b 1 0 2 e d a e 3 9 4 b c 4 0 8 c b b 6 a
C : \ 6 9 a 6 3 1 7 3 5 a d 5 7 c a f c d 1 c 7 3 4 6 5 1 4 2 2 5 6 3 3 3 e d f 9 f c 2 2 b 0 4 1 c d 8 a b f 6 3 b 5 2 c 0 d 9 5 0 a
C : \ U s e r s \ L i s a \ D e s k t o p \ u 9 7 u S S f j . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ . . e x e
C : \ 1 6 4 c 9 7 d 7 6 6 c 5 8 4 8 f 5 5 1 5 2 f 9 9 4 7 5 2 b e f 4 c d 5 4 0 a f f 9 4 5 4 e c 2 c 5 0 7 4 c 1 f 0 b 9 0 b 9 8 0 5
C : \ e a 2 5 8 d 6 d 8 f a 7 e 5 f 5 e 7 1 6 7 a 1 7 4 5 d c 2 0 2 c 7 c c 8 2 f 8 2 d c c 9 4 5 4 9 6 6 c 7 3 6 7 f d 3 a b c 2 9 0
C : \ b 3 c 3 4 e 0 1 3 4 8 8 0 4 2 e d 2 4 a 0 f 5 b 6 6 6 1 b b a d a 7 f 9 c 4 b a b 3 e 8 3 6 7 2 5 c 5 9 2 c 3 9 5 f e c 6 4 0 c
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 8 5 4 9 e 5 1 e 5 2 6 d e a d 0 9 0 f 4 9 b 0 6 1 6 0 e d 0 d a e e 8 2 b f a 6 0 d c 7 9 9 5 4 5 4 1 6 4 4 a 1 8 c 8 3 6 1 c 6 . e x e
C : \ a 7 e 5 c 2 a a f 3 1 3 6 e e d 7 5 8 0 c 1 a 2 d 4 1 7 f f d 4 0 1 9 b f a e 3 1 5 1 7 c 3 e 9 a a 9 9 0 c 2 8 b 7 c 8 3 3 2 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ o l a c w e e g i m . e x e
C : \ 6 4 d 1 f 5 6 a 6 9 a a b 2 d a 5 3 a 6 6 f 4 5 6 9 e 6 6 0 f 3 1 f f 6 6 5 f d f 4 b 8 f d c 5 e 8 d 9 1 3 b 1 5 f e b c 9 1 5
C : \ 3 8 b 4 3 6 d b 4 a a 4 d e 3 5 d 2 7 4 d 2 f b 7 0 3 6 d c d d 9 3 5 e e 5 5 9 1 c b e f 7 f 0 8 1 3 f 2 3 9 7 4 5 9 3 7 1 f a
C : \ U s e r s \ L i s a \ D e s k t o p \ a Q k 5 y k H k . e x e
Process Tree
-
e74c8a49f8983df716d4c29292b72ae28a2c98d285a4decd5bc8d00d4ca4c85a.exe (2236)
"C:\Users\Administrator\AppData\Local\Temp\e74c8a49f8983df716d4c29292b72ae28a2c98d285a4decd5bc8d00d4ca4c85a.exe"
- olacweegim.exe (2108) C:\Users\ADMINI~1\AppData\Local\Temp\olacweegim.exe
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| checkip.dyndns.org |
A 158.101.44.242
CNAME checkip.dyndns.com A 193.122.6.168 A 132.226.8.169 |
132.226.247.73 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 132.226.8.169 checkip.dyndns.org | 80 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 8.8.8.8 | 53 |
| 192.168.56.101 | 51758 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 34c1185be13f41cd_olacweegim.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\olacweegim.exe |
| Size | 74.0KB |
| Processes | 2236 (e74c8a49f8983df716d4c29292b72ae28a2c98d285a4decd5bc8d00d4ca4c85a.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 8bbeecc937580e87ef56dbd2c183ec34 |
| SHA1 | 510c4c6e92caee32bfa49d5edc0a2e657b2f95f5 |
| SHA256 | 34c1185be13f41cd412161e39dbbc55a745655039d785232427e2ac17e5252cf |
| CRC32 | 3D088388 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.