Sample details: 5deffe13f10daac64c40712ba96e887f --

Hashes
MD5: 5deffe13f10daac64c40712ba96e887f
SHA1: d404ce12691b9647963e3771eed09f401a777ed0
SHA256: 29443a295e5aef943ee69d0892a2f7f7b8dbd1b9798795396f7e795c077d94da
SSDEEP: 12288:woc0kKYJHi/Rs28qzU7jhOPZieMogX/d9b:Kd2h2hyjgvd9
Details
File Type: MS-DOS
Added: 2019-04-25 17:54:23
Yara Hits
YRP/MPRESS_V200_V20X_MATCODE_Software_20090423 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/mpress_2_xx_x86 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/HasModified_DOS_Message | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/win_registry | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/suspicious_packer_section |
Source
http://ablelog.gq/wp-content/themes/colk.exe
Strings
		!Win32 .EXE.
.MPRESS1
.MPRESS2
_YR>`N}
|.[G-W
^[_ofy
:!kN%*
jiOpjv
:K;fS"3
[sa)08
ZGC*2j
7!qd5B<	
qm'dH*H
mJv2&rT
Fo#]t_
^8#|&N)v
p|?LC@
r)HxI-3
z1T !j."f
r}d]1I
8nm%JX
l\k<)_$
p7.Jwi
r<lx<p&
tjS %Mc
u).j=f
<6gXnk
FdX00.
$v0]Nj4w
q}@geE
sE0'h'K
 mg,]K
M(UB/s<
`mS[;\
\HpKBH
zQ0?YJ
>,5H@/
F%,x'%hp3
y#r5JP
_8AWil
@H!asS
4Y.(wvT
Mqwf>3
tPQ|4) 
dGv=a	
iH	tG?
:IxI0'G
=rn?u8
S]X+ThS
+.5;h:
f*'Bm;J
(k>p#H
:6@".q;
4;efLh
1JX&d<Z
bO"N<En
S3KU`e
HTOD?p
t7.'$C(
({CTfk
j!5Oy(vv7
D}XYI!
]heFOm6A
HZd zRe
DxN+"c+
ZXofCyK
&AP~83
J,1r@@
CQKt:d
8d|*]f
NCM4%B
g"aTou 
9A@,dU
g"^8b<
4Lw*&W
i!ziR	
^_RM0M%
TPy<?i
7%#-y	
c.tP	Q
7eB@wu
RNd,w5}
`P<}?\uP;(;
L^B:G:
6D EOZ
.ZX\$!
NC7\)]
t.\91l
%ObY81
)sJShs
t^>8g%^
9BW#2d#.w@b
TXdt4|j
7f#/\+
c	.1VR
6pC>C&"uH
2jeW7e
;e	+ xvr
Zj(k:J6
	IVGvd
WNtS~S
,(:')y
=IdF	^
qajr\E
WfGIpP
191}3"
M65AQx
eH_#W|o
4]lkW#
 \/*Xq
8cf\n)
=_UPv6Lc
yQ|	r{
 	;f,$
G(1V:G
o@{|!T
D9u& Q
IzJZ6N
tVv4E 78
.mI3b*
S+Uf_8
+A|oJO$s
O0MC.>)
fp.$LB
k+E>g7
zuw";%
' U`M	9q6
7sgfV?
vxFz$aF
>OfY6S
PS:-+]/z
G2]P/f
&k!o'pM
L0i,2m
jg{S9*
$l6NO(aH>
<@a)?A
ByaUXO
k>~y7{ 
AfYp	n
2ip6l^
O^<y%kB
o-:JXo
C(KHr#-f
A<#4-G
!+'5f.)77
e0{5G_
6+}:Zg
9{?X6r_
/ZZ)nWjIS2s@
-%E]p1
pcjF-_
ZZJHIA
sj/8;^
+&+\GN
)aQ	G 
3)vj`Ia
SQHs m
<uE&J;|
Sa8_JZ
Uelaq&%
=RC@oU
6!+*g1
)1P1]A
A|@o?]
n0wN-T0
@e_tZ~
slr%f<mD
gHXJ~v
NYx^l8
|JTmRCF
>RZPbG
J!0Q-3
r6k@-E
G;{6.$
:Py/4"
.3yldCZ);
dq|&Qn[e
[TSRQu
Ww"sZ@
IEp9?HMI
kd|y-`
Ywcik]hRXZ
u?uj]U
hIc%>JO
y)l5ffn
%W.yU	FTz
X-3&>^
	4r{tk
[FCX@:[
zpla9 U
N8S8Q%
kcN0$=
3\Je$#
G6Pht`
/%!so{
';9H?`}
Yp]1pd
;?wDVu
$>uGH:
)-<=_#VUpq
urcIN1
wAso/v
#SSaN>
0UM_0o
UBmE8*B
h3aO_ 
LTNN'S
GSq\_(
mj'0u&
~]?ZpP
=A@j-|
Drs<gen
@r*B(ex
R2W@v{
P}-QE9
H[1DDU
H|S=^5
)dwHOM
KL:XoGn
J9Du>{*zQ_
?r#@hU}
^Xj96(W
SJJ1pi
\	>}~b!
|WV1F+
qzz&_T
%$iv.5%
}#\v+"
'b/&Ha
&[BMG{
$j0sSv\
9ydCj'Q
4a-fA$
.,P]e8P
`gC01e
/RlNZ>0
/&%QW&
8++6@8
yA>8%=
W-vJ :
/;b>2=
x0mf]>Y
wUq?<\
`uW(L,
]L[e'3
ON^+{|
BqP9>g_
LvEi5;
\+0U	fq
X'baMZ
G#'HYb
>WEza-
8,D,Nb
Dai`0lw>
*3V(eW
0E~-_*
zEsRn$
n~V6Wzhn
OYUi'UC
?$<wH0
*he(!{
Q2[Ery
8]>8vfo
t=EO2h
TV=N,v
4HcF9G
.2]p~v
<Ce?@'3
\c!ve"y
<@RmX&E
gS\<g8
()gFE{iZ6
sf,Ij8k
ueB'&(c?n
.Z>ycb
"y?Vz{
ARR5Bi
^4	-/%
\uRu_2 
	d@ZQ\\
DO(K`E:
]V]pnK
e_~vah 6U
p;oIzX
,=	te\
%xvwde
P3&f#z
I"TxcHUD>wtM
Pxttn0
;-! cW
fSf(X,[
AzL\;l
tqxS(P
,[iOmg=
^PJ)VN
&d}E=@j]
v]zCx:
={%7+uxWb
~nRLy\
R^z(0h'!
.-C;;k
<%SFhudooi
9X`)3p3
~hM27F3
byG[6B9
m.]Q@K@.
fyboYY
jU1AS7
6Z/%`i}
mRgz=z
n*$Q]L
R4)4cL
S):%QJ
$@N9	P
:"Il[X
5r;/bM<
(Q?l0e
z{-ljP
YAi>4G
jxFh=G
B%R7&KUn
S}\>"i
(8Tb	r
<	Xjz}
Rby`ieV
[w'VCi
"Gv1yu
7||8nv
c$.[e>
(p<S5X|
<DMN=3
b*DnfI
$[_GVr
&|Jx#Z
W"N^ -
2-"nz'F
RPbw2N
0DEO`N
kcNE&uQz
9<l]E:
,^\HluX
a"V+Ml
#^.}~x
M)2S!+*
^u@wF?
	hH1zv_
B2@wHy'
h/WWXl
 e:@>3~
q9T.Qcq
XKen93"/
47O5$o
v}H0Tc
nB8j$\
v?M<b}
r^BD/Qa
2\xL4T<
QEx@Mz
dL462,Z.
Yf"d1M
q|_w\3
!>kS_L
@kc2C:
=))y}2:
oxi/,9
u^:;SO
?|Z"NVF
v)y8*G
frL?1R
9FjN'8
Sr]~Hs
C4R:xF
G4yELy
^}(."J
Fk\4Pz
j}vms#4wl
4 _n-YJ
9\LaT\n
e6GKm*
ranF$Q
V(Oe=Z
.m|@;HrDy
Fbwe@JN+@
w JFN/
nKX1_8}
A#gpEh7s
pu";gm
Ev`lBL
f#>AFX
AS{~b&T&
^'0os* *
{;wO5T
I3IeI{Z
<-rSOB
$X*HTb
;X 8v%]
TGs6w~'h
]DD	&\
]P~zM:
\C)dmH
zW%Up>	
^A"?ZQ
;X>]p+v
Od9nvr
V]xpq'J
|^=)?!
)0=`)xs
H{+N?Mn
`7t%Le
fd'{S>ll
#K1'C\
;0DB^3
WP~f&9
G:35,R
1[35B;
HASvJf
mi+ B^
6S<}c	
%Lk|GbA
(9#CVE/
c([RBZ)
Zfj2(>Vr
j*jj,#
swflKb
 R7CE[
N`[QA2
,riTtHr
ZY|+$;7
j+IIjw
Af!#6G
 !K+lz
@OM%&L
$Z}7OC=
ix@-xd
N;1sAn
S|OVny
jTPX=B
SXu&(Q
o_>yQX1
w+h6NjB
9w"-r]n
}ocw%h
"S9+|X81iC
6Mty.`
bP[BT]q
UMU;|Vu
p'nJMz
SXdq9s
upO@ok
6C$6 h
I}%k]0
@/9M3&
_Vm#ys
JS	'l}-
{4qSu0
l	Xj|PU
?!8aAa
G#. Q5
w%?f0#L~B
`=_O|lTcr
Mzy#xc
s_ ,`}
o7F|ja
u|~h%T
GB:6_}"
z!v'\eP
Nfs[OHS
10ZK~l
!qB.Vg
`9r.:z
0JowrT
Yy!%+_NGE<|r
p%_U&s+@w
W=eX~B8
a7,k>c
3XjR_)
mh|HNj;Bt
!wp;N-
wF2-,n
,{$*C}
W+W.7>
f\hF'|
,G	Yd	
Me84?!E
Ybr&Y/
G B=&G
{5c&&9
n$T}y-Q
%J\g]P
y c	 '
3ZOXZ=
{FF;N"
K|rzsW=P
rIukCc
(]v~7@U
t[_q/L
9E|cUi
.Fp>nTD
J;pu2"
eN*&%}
MVA 6"C9
MK"9|<
?Z'O,Fs
?Dc#uj
J<@TXv`
Hotp%o
_+#!%eBmf
\Y#< B
fK_C<XO
3&r|V.;
~b^m^8
-+wG *
O(#\8G
no1inh
_)5`pH!0Q
wVV.[#
rI: ht
(MS-2F
{XYe%Jg
{Za.(k<
i]R HP
c}a)Ta-
.j V[#h
k3LDH<n
>AC,e"5/
;XQ2?_
_OEv_x
6V_U7"
*P<@ye
ZZ_^P0
(wxrfY}D7n
;pba9/
vwu*QRwn?`i
}KTrz)
4VGW9*
$2DW*)
>w(Q:-
97Q);AS
j{QV #
K9z3=yn
l<Dnuco
|8?Pc#{
'$p.7>
7(e:s!*
uiV%S'
;K1{:7
Y#+sa/-
_uaMVr
FFZ.7oRI
#|@)$g
@Z!`JTR
$*ah=Qg
>0h	cV#K
\'-1([
v_*9=ph
q]\KDCg
Ts0~$([
mN\G:]
~_htn*%
slE	0-4
$(eYP[Y
y7E,FH
aa;5	]2
){*+Wdq-2
G9k_VH
r=gDL2
-@'jzb#o
gIe=zv,
rxmw:4
-lwg3W
(h+2vxXC
F#Yv=S
T3=F+f
Q,&qV]
p=B;LVjP
#_,gL<L
X*U}Og
^_=qd	
00D~,J
|AqC(7N1
'7R?1}q
n'&d)O
!7jY-O
uWmug^
r6?/SRH
<l0gw 
5	jzte
KFFL!Y
Y0;y#I
8'U_d?v
4#u[>u
%/<y>2/P
Ea'.QCA
C596?s
5d3f[<-@LY
aTxGe$vB
(4D]|>
a`A-cH
u{ym:w3X
	~uu[D%
O^.vTX
	;nQ2O
c0M$l3
NHPrkV
-GQz^M.t7
F9yk:K
^8N8L`H
uhaH*|
[xF/dLD
$bQqzN
7!.X#5
Ns	$I'R
1%yB#b#
M!Dld[
b]9^jxr
#fk!UF*8@(5(
F|=(7E
trP}#8J
q-Rcgh
~kan)rz
"3z<Qp
PDP9o/
Gre/!rNt[
BT%V^n?N
ir1Hqz/
]*ptp8c
:Ro+d}
Z_Nt{~
oc}|%j;Z;
Oirj0j
M^cB@X
d/3}Lw1
GD\2:<
m)k#5>
)YG?!=R'
"Nvvj1h
Y`douu/LD
	fA6HE
b>)X:$
v_HgV2h
lY;0[(
u0   K
f"%.D@
YN@uZ1
1sv#||
sj:pw]
>rCM@O
/(H.98!
	$IURP
xDvH0.
0Lw@rH
&[ q$~
H $@;D
g'c ra
i["":-
$}MFzK
IG#<}J{
EBDcV 
	.!R{q
v9_P-m
t.3uD3M
lU}T*bt
((t5)Q@#t7
_q	}}cU
gs+)#*
O^69^J
]tM%(ZF
FH82Wi
cchN:Y
p82r"hD
4qXS0o
Ur9\qDP
D!=>{T
<x0qnB
-{X6?S
twQk[e
u>Xi#[L
-N:J"F
.=\kED
Y+dF"t
	jG?NM
Ep]=gcoA
Yg([sl
=$c]`g
G?9q)0](
;=WFof;
YCckG.n@	
sFgk4`E
haON#W
]2	$K,
b63)=5x
\4g1<0
%"BS4^W
fQx%dt
<(L=m.
=B?x"[
+@HrE1
9lJc_G
L8@(KX
] $Z@i
a;X&c|v
	,%M.j
//Ibvg
3mB}}rzb
k'>$7G
W\v]	{
Q<~^-WX^
r62X[P
C&`O>Y=
()BOtj
spqeJmF
g"ehS^[
gCl5&@
Y<:'Vm
3O4A|;
G[	H,0
fczKIc
7BB?H Y
`Ev?T&
QvbSmL
6m,of9
o3,-((p
kU\r}<
ib|~zRHC
{cX?x3
4-9X_M
[- iOv
Y}q2r8
	b*4<#J.Y
P*s/h`')/
;HtXS|$ y
_s=a6P
-!ogVp
yH8?rc
u;]'GF
j.q^Mt
	!#me`F
)j&zB#uR
WNj*q_
HFbGMO
9A OAB
zx{G"C
q4?j/4
| MOeY$
FQ^GWb
$JSKg	asa
"uvm#r
",!=*W
:s^9h8
O.7{Wou3
Dk*dQf
(=tw#Y
n{\:pf
a*!|A[
!S#c6wb
>J`t 2
+o_{n`
!|?5auM
tr6-I;
ESMHk>S
iPzyUJH
p'S+<e
L&R]5	
dWbs=~f
VtT&o?(
xV*k\9
]9&Ba\U5,.%
%SP%C6
ControlData
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
oleaut32.dll
SysFreeString
advapi32.dll
RegCloseKey
user32.dll
CharNextA
gdi32.dll
SaveDC
version.dll
VerQueryValueA
ole32.dll
OleDraw
comctl32.dll
ImageList_Add
wininet.dll
InternetOpenA
SHFolder.dll
SHGetFolderPathA
t$t#t$l
D$t#D$h
D$t+D$\
.)D$H+
s`)L$4
D$t+D$\
9l$\w`
 #_-38k.48r8@E~8@E
).2~"'*x
CLRj2:@<
BLS[&,1.
LV\fBMT;
IT[O5>D(
^gknP]f>	
P\dKKW`(
Yel\Ygq8
nvyyUcl?Vdn#
]ksIdt
er{Qgx
Ydkkjx
P\cQ`oz5
9BIWQ_h=eu
"X '+e%,3p(04x(04{%,1x
eotq/8? 
[iqRJXb
irvpat
Vaeofv
IV]Qj{
DDDVyyy
k!%'o28;}?EH
431oxvr
$#!F}zu
DB?wzxs
642ixvq
>=:rrpl
cjno/7<
/.,X|zu
=<9wqok
542bxvr
KJFNdb_
da]nSQO
10.:omi
VUPW^\Z
<:8v??>
/.,_GFE
-,*^^^]
"! DPPO