Sample details: 68a9c9891dfb976f695c2c07c9a3a655 --

Hashes
MD5: 68a9c9891dfb976f695c2c07c9a3a655
SHA1: 21b6db4b921d65e330cf255d423ae4b839b0c587
SHA256: 21049cb1829936c718594239deb6abed8e6733cfb51c1e7052d56e755b841800
SSDEEP: 12288:vwT+Uu9jynmZN+UbDJ9qJQbePoLia1+esTCmBh08r30RcaS071lZC:kNuCmZNDZ9quqTaw2mBh0zR71i
Details
File Type: PE32
Yara Hits
YRP/ASProtect_v123_RC1 | YRP/ASProtect_v12x_New_Strain_additional | YRP/Microsoft_Visual_Basic_v50 | YRP/ASProtect_v12x_New_Strain | YRP/ASProtect_v11_BRS | YRP/ASProtect_V2X_Registered_Alexey_Solodovnikov | YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov | YRP/VMProtect_1704_phpbb3 | YRP/ASProtect_v12_additional | YRP/ASProtect_123_RC4_130824_Solodovnikov_Alexey | YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov_additional | YRP/ASProtectSKE21xexeAlexeySolodovnikov | YRP/ASProtect13321RegisteredAlexeySolodovnikov | YRP/ASProtectv12xNewStrain | YRP/ASProtectv123RC1 | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsBeyondImageSize | YRP/domain | YRP/contentis_base64 | YRP/network_dropper | YRP/keylogger | YRP/win_registry | YRP/suspicious_packer_section |
Source
http://krs-kr.co/ayz.exe
http://krs-kr.co/ayz.exe
Strings
		This program must be run under Win32
.adata
WK5fJI:
 O.xHk
c*Xd;j
.d?mu:
|MJb.f
%49y k
KF M7J)
4(K7|C
0yqgWUG:
"/#fmh-
nY{0G1-
%q({Pi
eT}vq:
BS6qaR
YFH1}/
5	RrXV
Z$yc4O
+i~J{E@
'u/%ABF	w
F;p5N;
uAtLsRK
}hug1B
O`W5$Y
cG0T=&3
aS8OF<
B)Dks(
/"ZP[G
~F&R"p^
=}>2*d
2MWhDy8
HPpD#*}Im
=?;qJP
+UJ_pH
Z:C6jASw*
`vk!t_
v-,%sZ
'i7?^.
)f}T4]
p@PkTY
+?7v#$m
S_-b=4
),# B	o
2Mzz]{l>
Pw 1V2
1KM4,K
sny7gT
asZW-Y_
GcR>=2
P'RfcEZ
q3([[}
Q.$}b;a
UTA#/AP
_W)B^2RJ
q7:V!*R
0o4PQk)
c<*MLB
Q{=1+`oU^
+`0xdF
N+X3Qp
8>xl Q
zJZ+zT
.h8^St
9(4]4q
,N:H'<
A73c.D
 N+ Z,
Llz!i	
Rrn+D{T
IlzaMg
!;EgsX
6* 83U#
@'d|0)
)^gU]g
fr	4[=
(<(-(&
_:p?7p;@V
}\g2h]ZN
	~S?r71F
jt Bp-$5
b36Zp8
riI	nB6P
Wr9wD3L
qA4}n_
0-PSk$	
Nlcv<Z
ee%-XL3
.F;V`"
VKx1|qo2(%>RO
~W7.o5
#[btso
%\-NLf
(&	&P:
|,B8k#
2B9	k[
[`I(N )c
&TI6]&O
-G--RT
~J8'wz
4jj`CS
@(gOzz
xSziJ`j
[C,"h^O
LTIA7g<L
{wtP/ l[
+>^	ZiI
A}nbAw
+@r[I}
h>$|9v~'
W30a(H
[Uq_xT:G
f)x|b	(
x><5:G{
l*gB#F
K#Z?0a
t"3@{r
{3Csj_4Ke
v8ER5d
g~NY ]
`=bjY$
92PAl)
)KDvFU
1 0npx
1t:P9XQr
|UV5Y;
;ef: D
6 q8Rjy
1c3.GmNG
]4=Px:
PK_1|S.
uq+<ud
tN2JkV
s=Yxs)b{
EVoXvS
GR4xBW
pXV!tR
z+npcD
Ap C@50
{P.mIM
Bi4I;,
J3lPtf
1Ww}.e
#Ij-x]
1xF"71_
g*!Y$l
<*(dE2]
|?tn:Z
!`A ?1	r
 -evKV
NKHl"S"
_WK;fHM
*`H_|9l
3(XfT}
@/	.<x
!k>):`s
6y7e5{
c=B?qG
*IE1bK
GvM`?(
zQs#'s
nA{(+3w
yp]V^.
qwENw?
%Ob_lI
yE{3U#
(Z)vmM&V
_J<a5Wk9<
M~9 E{pv#UW
e%y[\^
Sm"\]43`?	
iu%YOM]
d5D./e
!9rG-w
-<Hvzx:
|.8f{I
Nc<)pi
bi.%oc&
q!NP,U
*tz<!Y
mUdN]b
,|k>bUN
P#,\m@7
[IW{*v
|Q-#1t
BWP3^?
/:'7BV3
1L"WOg
F7-UMA
K k\\]
"Ia,zj
\g-(%0h
V6!z=J
w=gn4L1
tzx*p;=
j@YF"4
56S+/`
`p4&'+9
t3 Ubc2
T@^N=h
KJ.(` 
7a$<"|
P@ UjU
mkkT](Ov
R`f%/ 
VVR@vG<
[]P:?L
?iy+iH
I[#uL{
$J=G%NG
<wQ6>'
~?5wVD.7
]h/@L:Wo
j^EoH`
O{:bLW
q>|!	K
++'@:Y
pz)i61
42Ub;,
BYZi)e}
{?[,F)
8XOu `
+_Kcif]
U?<,~RG
tQ GL5
,1rum"
F{]nAs
	e1b}TgY
EKjx)@
#jm_F ]=
DXe@8PWyk
LD6Ynp{
Oia+0$iV
+Vd'5w
<4W{D)i
c$T%2%
{4[RS]%G0%
+]$\Ewc
1S_>d-yT
+( E32
Z[@,8(
a3r$g[tN
kS_dVv
<!vD^C
qF+Rf#
%+z)fj\
jkWIlFF?*
T(:XxU
O	dotHp
| [|&e~'
.E=7oe
m=e']N
P"gss(0@
Z!>|-#
\uBD.e
FTc:K>dRs$
gK	b-:
: rv|`
e8Td?/
e8wY#F
/q'6^~
plr:3D
28_bJp
D)P6`(]'q
z/X,F,"
#R t&:z
*G]ak-
rXLiYx
ed^.KQ
)>Z,El
s=+An]L
QY5OQe
3K0ST}
O@cCE	
wdw`6q
s>>.> ?
<:npH)
NBrZ\Z
v+7	`"
INt251
J4)Y<]
.9][;M
5MZ{)g.
?@-Qf~
_:S,!(
,k-k1W
C)-a(/w
=+yuS%
_} Vget
Fa{!jJ
MCFlJC
5k;eM:c
UnJ& Y5/2
y{5]_6
 X_Pg2
|Y"$X`
oLl&u$
$~!.nj
(IuZdwU~'_G
w6	vv^
paucvk
(7m0c9W
?7GVib
Jb	UiS
 >eKnK)
c+-B*i
()=\9)
}Vu>('
-T-RGk
_~bK,>
e9{!]=
#)>!U]~&'
m17\q'#1>
:dOq8W
a5Hc5_
Ex)~^m
{G)C[)j_
I#[yU{
|6?:>b
pC<cK~
!60RHapL?
?-8*mY
k;[A7L
I:=q=u
!gs@ m
/=<#V#
TF\b/k
go:qS]
j`$pF9"
E-0:4u
9k@^x!BUgm
IR"`X)[
jba9(x
hgNV+d
I5kf,k{
ncEG^V^W
CQsCBP
y4]Kl+
QZ98<.
W@n_jb9U
Z/@/#:
m81D>B
/39:W2
	j2aS: 
3c7FSK/
/X'p3@
ikE LYy-
\'8:D)
Jaim,fa
Zz?7p.
;,iMG|
=k8F*6
01hBRO
.1yIP"
OuJc0%
fMO*,]|
x=3{	-
bv	MfUR4
<"QRax
g2~OCe
}eV<OhP
4nix.$
@JS4^d"g
Jf OVd /H
E 3fm	:IJxD
c[cD2JX
I^XhuOm
:$c#)?:w
Y[STa]
HiH1-=
DX4tyG
w7Oc5<Y
C`9W/C
dr<&%z
q 9JDX
jvx|J4v
:$j%|1
-n'IyX
JJxP|u|C57d8O
,YGSM7
xt&X?Z
@KqDPV
\Y-'Cw	,
f.KsDo
Ust^PC
}4iOhe0
J]MJIzt
HE!d~	
d\ey@RVX
<U/2*'
1qI^8S
&'sY6$
mhdms.
tM[1^	)
{m%O=Q
8R&M@ 
*]ZMQ#
Zi	HQ;4
5?,?K)
L="NH@
Ug>BR@
C"p\Bp
_A!_[9
3vl&bm
C*C{5uy
D\/ Fd
tefAj<
n~TwmJ
!@:+yr
38W I1
dk7fj`
1B<$,^
[L2) qA
*{+"-xz
q5\\u)
,}#a{"
DDh'<V
9jM5MO
0`T:su
:'zh:C
{~ZS~o
,b*ScJ@
AE@Q42
aLQ.6p
EV{V&K
=._n91
v,2@g[
*=3h3^
l[fr()I.h
@qEQ^<
!cWScZ.kSM
*+3u!)i
-p}_|iTK
o@7MI/'
BeLZKb
]19I?TF
)hq>8*
=h90-D-$
T.EZ[c=
f[IP12b
@5'lSvoki
U70(UA
H;5/6Plk~tV\(p
Av7Lm2
gCmBX&F<
N x0rO>/|
t8jJ8t
;<,;i%Qq
K<i(cJ
f}dI<X
CZl(vc%@	
ZR_B{g
yIt(hTo-
Dif5zr
V"O~we
Xpe'23
|Xl<34
6[oEmjr
vVpYR=
nulZ:]
cTPgI<y
@Kks}@
"V+AE[
i.{nUaw
"9M<X^
X.$7&edu
;pTaD!F
PRu?B}
[ZCiTk
Y/%qd='
 C9Wr0p
=1 'i[
X<s@.b
6vn40]
.+nS|Cs.
gOiSV;
ho|/-*
NDWdKC
'-_P!G=
}gI?H%P
2	4w/W
]|)1<"q
4oNL5bFoO
Wrq!WB>$o
kZiDm>
',T@I'
{L`Nn9G
<s{bCsH
[~etf+C
DxiHRc7
`KePUta
fm&;V-
I|;1yU
"ra,uj
	GhOPh
{:i >Q'
hO6-ru
8N>LwQ
TdnoO~
ex'}z\vnRr
31z31h
viHe (
dU9%>&
.=A,Vm
8Wz7Nf
N:_QPT
]KL*8 
Nt+pq,]y|
(8Z)4i
j5-nkqk
6;Ul@N
;{:ZwFm
ktWYP 
b8vGFT
RQzz]\
0V}e~B
]JS.40
se+HbC
HQ=r^b
6/CjBQot
7	V(ON
4J:k}q
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
user32.dll
advapi32.dll
oleaut32.dll
advapi32.dll
version.dll
gdi32.dll
user32.dll
oleaut32.dll
comctl32.dll
shell32.dll
urlmon.dll
shfolder.dll
oleaut32.dll
kernel32.dll
GetKeyboardType
RegQueryValueExA
SysFreeString
RegQueryValueExA
VerQueryValueA
UnrealizeObject
CreateWindowExA
SafeArrayPtrOfIndex
ImageList_SetIconSize
ShellExecuteA
URLDownloadToFileA
SHGetFolderPathA
VariantChangeTypeEx
RaiseException
uUKKKU[ouy
~VKJQ[
tVUQU[t
y\LJJJJJJ[w
VJJWtlVUQQMMMMQQUl
/$$$&&&&&&&&&&&&&$&&&&&&&&&&&&$&$&$$&$&$$$$$$$$$$
/$&))))))))))))))),)))))))))),&,)))))))&)()&&&&&&&&&&&$&$$$$$
1$&))))))))))*)*,d
h-*****)B
f3.))),4
f.))))&)&&&&&&&&&&&&
1&)*************-
.******_
Y))))))))))&)&&&&&&
1&)**88888888888:
B8888*8_
Y***)*))))))))&)&&&
2&*8888888888888?
H888888a
Y8******)*))))))))&
2)*;8;;;;;;;;;;;A
H;;;98;k
Y88********))*)))))
],+;;<=;=<======N
|H<<=a
gCDC98*********))))
]+9=<>>>>>>>>>>>E
D888*8*******))$	
]+:IIIIIIINIIINIS
H88888********)$%
]:>NNNNRNRPRRNRNT
zgc:;888888******)$%
^:ERRRRRRSRRRRWRX
`;;;;;888888*8*****$%
^?PSSSWSTWWWSSTS\
`==<;;;;;;888888**)&%
a@FTTXTXXWXXXXXWl
}F;;;888888*****&%
aESXX\X\[X\X\\XXl
x;;;;;888888***&'
xFT\\llllllll[l\n
a;;;888888*****&'
xGXlllmmlmlmmllllnqqqpm[TTWTliiiiTRPNP@SGGGFGG>;;;;888888****&(
cT\lmlmsmsmmlllll\\\\XXTTTWSSRSRRRPNPNI>>>><===;9;8888******)&(
zTT\\\\\\\\\\\\TXTXTTTSTSFFEFEEEE@?E????:::::+:+++,+,,,,,),)))(
zRSSSTTTTTXTTTTSSSSSFRFEEEPEEAAA????:::::::--+---,,,,,),)()&&&(
hhhhhhhhhhhfhfffffeeeede7e7777777556
Gggfv@
&vvggd
wwgbvt
1wwwr"gf@
1wwwr"vv@
wr""gf@
wr""&f@
ww"w""@
wr'""@
!H&1<B
XZ}l|y
&~W?$J
RE\Bor	la<n
UMaskV
uXez$Y
X#1L]'!
Tx^B 4
Por:ti
7W0`yw
", 8@A
jX{O%(l
*"^Yh1
!TDM-B
a=2\lf
kern0l32
LongPa
QH}B^D
0)\~Y{
d-4|s=
prlH9X0d"`#\
`4"0#,
Memory:
EDivB(
DpHtk;9l
BFaHod
c[D#2m)
=K{cXu
).c?'a
QJz};oi
,(t$N@
 !Rec_
L'<TQ$
Nz1=Jt
Y?={W5
m0),Wt
$	jA(5
h	mTg,
'Y$aCl
B'-"}N
E`f6u)
omIniF
jZ^S_0V
ansd@r
p& $i S
q'YQTh
@4vNX@*
#/P!~f
JKLMNOP.Q
yz0123
	u_~QX?m
h0 %2{
7=;%	}
HJ=|n_
C?PY$]
t4!8;UQ
@_*eoL
	xL@^/
vrn=;L
a'tc.|-
o?kb}xW
lo#pyt
.Cache 
Obta1{
 <7ACY
256ToM
Int: L8
?S r}9x<c
sk#C}:
M\"Hd$
VBC`~%
l:-	np
egist\
GCOpot
Hbp\^RaIrX
_K{>}B
Bxy4 v,z
10:Bhm
&'00@K
 s3w%rq)
PActiNv
`I|#uZ
u(IfFN
\Z$M;EX
t*#@q1B~x<
fes8-al
9rhHE%
\ "	'D0	9
(R) 9or
ouwi q\W
ansm;etg
RX1u<Ix
adp*H$
Z_Yz[PX
u7r2yS
|$WN42x
'RDC45
(8P'QR
GgL0"tM
kbq%eip
LO Us>
.With[
	!Sub*
fqrm@`Vg
uEip@)%
ZtCh#6
{s|J?.
 H@ce9fA
~,H0G8:`5
trgpC;	bw
uzgi{pU
'R[Q$&
sN3 {H
\3'sSY
&"P( U
U/&u7{
^ Y\Ps
T'he~@
SI"`J_
qCan-'t
f~HRq%
?RB>@=
${)Tk9
:CK=u)
jlQ]Z@^
VskHM7
(h=V,.
>RHAxL
R}8|^a
K>`+pB
3l]| tL
!)Q5r0
xC0>RQ
%@sFNJ
%2z	f$
-@\Zh	
@A/!>[
 !tGPb
Runtim
~~(&0"
wx(zv 
 dsi.Xkl
"05p`)
00"4NZ
Cri^Gca
]EBoxSH
IsB9"R
L'PGTgb
B'JGRgZ
z/|P~X
(0rBtl
!5r't/vR
#16AX9
x"z*L2
0'4GDgd
' G$g(
T'8<t{
r=tAvExI
zM|Q~U
@<T: :
VLV]3[
rTtX]`a
f:q;{<
wSt[He
J^V	=ro	
jr/tObq?
	@X\Oo
V|i~{]
f2jCg3k
R]@?/C
D|r9t=]
U4^'iD
wI}\?r
~:+;_<c}=
>k?o@s'wa
'0Ah8c(
<69_H-
FK[c0"
4r#t`]B
/?r;^*
*,n/,=
[^YjXbH
e%P`=[B
@8zyjS
s5E<uj
CfM)?ag
?brmuhSQo
R`kjqb
CO;1 UTQZUo
u])Z%R
u6Ms5S5e
H23)ng
J@n~$Z
!zEtN~?2]'_Z
pKsTts
{=**2A{	
pT{2tb
n<HoX@
Ht&S:	N\9
CT!H_c2WB
.;w_[k;
?aIAtf
Q_3-bxE
NR:o2c.
%#7b3|
Np/q"T
4@ynL *
<!*<+	
Xq*[B4q
\J1DSD
jT6G["{
%Cg_jKR
@d}0Ohx
4':sAnC2
e_|42DH
Mb-@dqx*
"7JU67
y.hQS]l
gCf{RN
$I"LDI%
&$NWK.
WT'nYQ
r<o#XI
qjM- 6zr
4^WUL8
@vp3{p
V`-f&@@q
|w.g{?I
NNl>3iD
	x'l(P
u<XE`)|j
7+d{{u
-u(e4w
<#2Zhkr>
 <r}		
5Q`JJ[
r3e<g]
tdEzDC
U0:,e/}
y[l"j%
9%"9j:
FAv#Bs[0
S&|zU8
,M<{6yj
rV#^(l
B:"aR0=
4aa>7^
*]	Eiw
Ox#WSuh
d8|QD1
@<@bM(
Lv"_\Ce
P|;FueyO
cyyzxq
mE Vnj?C
 =P7L$q8R
?r^!ZN
*^+mDm
&7U^rb8
8yi|]A
tc(dZj
w{[uf!O
q6124^[
m?:=C@8bC
WI1ZQ;
-Hq].M
5J4+[_-
"OTw[{
n@oCm5
D}3_{l
#a7SDX
('&JN7z
sJK[8t
/e"c- 
Pa@c48
j<q.e6
FNGh7"
%~,GU}
z+<e?w}
RlAF/{H
}<@@Ks
LIM>	g
P@G<~Sn
|7qp0~
]0j"<f
;)gJ|D
B7Y=WV
I-4EP'A
.,69X>
WXR~j,
QzT2Oo
r$" l8
()0'$+
eqVc1[
vq\OZX
+IopvL
;0.\!Z
;0qx*$6
%N T,q
CP,v~;0*
Kw+u,E\
jJ@VBG
m<ZGL	$%N
,VIQk~
9.95[vyq
J2DPtg]
2J3G8A
mE$p%t
G8V%gk
)6(*~0~g
s&5y J
+!@Ovt#
?,*dsKme
	[t8VU
L	4F:_#
6@e1RMV
n>pdw\
[XwN[T-
gQ8!^`PO
Yk{Aga
C(o-"}
Qdspa~
dnVYsg
hnKgT3`
}gU\	|
<<gXRO
)TF_	3
H"zE;$
"0UK\l}
c809Yk
E,:T:F%
".I9S2
X8F 	qta[
"m 4<RT
>rz>9M
!6lbCq
00sUgI
i=:GI&O
d<)59pO
r%eSaP
8Iz	A|
@.)o`X
!dGWs4
-2:ct|
dc+<F,
_X1JZz
*s}G2<
]J$OJP
ilh&R7
8V\mMp
lQ7Vci
b@lh\o
73'gQ!a?
x6%ONT*
`21N?YkJ4"p
BbOcWY\j+
*)|gK/2
#P ~bz
7kRp^!c
90C|Ika
EQg	P~
~M'Tw'
J#x'06
f!bB,B
zgCY.2't
czU"*0
G&BcV8lh
O:7E:p
t6TR,q
qct.Q!@N
~bv G6
cC|.~m
a!aYYH!/?
u%{f7TF
"QaKed
|HF/\)
50n3x)
sol,~c
500x_Z
,m`}V 
Q*i?2Q*
E3$:#q3
).K@ z
5FtB;%
;Cftf bbW
_^:3|	
`lqK%O
[\e*#nd
hF,h|	
bb/~()
>d)5*3IG
]b`LX~
NQQ&FJ
$k"]'(
y$=<aI
M`Gg7kij
>)hqa_
qq<.BC
<WjkP,
(}eY't
cx7J\hQ\
8'CYlR=
he?&I{P
q/rV}w_8
lmBz3o
&@M.<(G
er]M"I
rOcjS}`
9bnp56
i$Pb`6
@z(T~ 
QPtl33
m_zGXm(C
#9Gr}Q
Q\!l-X
lF"i#l;!
"]Cr0n
GZ&);j
/,` vq
el@nfo
=D{+W.9
d0?BBX
erl/SRmF
,[)WlV
%s%&]?
Ze8Qo_Ja