Sample details: ed2e0690f13b10cca005de27ca9d2c30 --

Hashes
MD5: ed2e0690f13b10cca005de27ca9d2c30
SHA1: 678a8a8856dafc7579b4db866841e9d32f4a41eb
SHA256: bfd12532449f64de79168bdfad5f40e1531a2a0f4c91e02b3cf6b8921042b26e
SSDEEP: 12288:u6Wq4aaE6KwyF5L0Y2D1PqLjWu43k03TQv1X:0thEVaPqLKpU0K
Details
File Type: PE32
Yara Hits
YRP/PackerUPX_CompresorGratuito_wwwupxsourceforgenet | YRP/UPX_wwwupxsourceforgenet_additional | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay | YRP/UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay_additional | YRP/UPX_wwwupxsourceforgenet | YRP/UPXv20MarkusLaszloReiser | YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsPacked | YRP/HasOverlay | YRP/HasRichSignature | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/screenshot | YRP/CRC32_poly_Constant | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library | YRP/UPX | YRP/suspicious_packer_section |
Sub Files
42bd9850366597ffecf37559c8e7a3d3
Source
http://142.234.200.99/~dave/1_com/2/DKNTYP.exe
Strings
		!This program cannot be run in DOS mode.
44K$/_
,6`G\z
j~3Pf@
QSRw"\
:tNPQV
x6k$:'
#xQIWE.
tkN:	W
>_):q]
h|YTCg\
BZv!r#:w
,!8t<f
EmNxZ0v
tpBRQ.E
XKpe16
=lup	t?|`
0$	(30.
p7x|_wy
5D17PPd
|+hl3t>8
	 23(.
\N*,04
1tTV.'x|T
<Dl\`\.
Eptx1*rG
lX*+Uv
o4G<<eTX
 71$(LwDy
r9lpUM
S,70'8|
PT\\t;o(~
I`d1hm
\L5G\`d+
@DLld<
K48@0X
=y0?543<h
!.R?6P?T)
|9X38?
 @$(X\*
@{^|.O`L
A A$w9
-(A,G4y
|gLPX2X
B B$!(E
lo Cyi
$C,CDDC
 lF048E
U<S@zT
 4;8y.
XF8t1x/
GG'y1O;
G20X=\
IwG`Hr{U
Ry0hTX`
Pwx'hG
 I$I(I
R$E@D6-
T?2wi0O\
J5p?t|C`
TFJJ(sGJ
JJ8vGKK
1@D\N*+
`dhz9y
l*Lgq1`
T*O(L@DL
\N*048q
(,0r9yW
F(PPP6
EPPPjY
rR$(,bZ
Tl5V.'pt
X%5\=i
nQX*+_c
\NHL?~EeS
,08XPT*
=RwyAz'R2
T|C*U:TT!(
LSP?Xp
<@GXF\`
HUUU"~U
{18rRY
nWW&<+
DGXXXY9
LcPT*k
5FnZ[[S
G[[[V.7em
480'4<
3,508`y.
RP*T\D
y<Xtl3|
#+<]@]H]
RY ^$,X
XN*+'\
PDdhl^
(``5$	
=43D_W
]X\	`3h
$_T5XK&
}\. cc
,fcc\*
(,W4B@
1L``&/&v
C=n.j?
+W N\$
j XH}W
A4C%^p
$<WE5zT1cTtL
*	|.NG
zG#a#n#
@b2rP'
aQ\2k{
.<[@._
NF's h
k9?Wib
	?G(n*
i*@?vzW
 6eSSZ.
XR-VdTX
k[LLW.#Z
KVj$SGal
1QdS?\X_
8E8-8c
(	,048
/^0MaEa
uXIsDcd+.3R
oKE\L|
[_dm[E
?%%-4C
 SWPH]
X*;ttC
A=>?M2
t,vt v
9u(vEVS
}?15YPe
ro*BXE
(f9M'R
Yq>JY,
	@9nMtn
J0;&$"
F$WFS	
+SoQW&
+[jHht
0&}~_^
O\S>V}
9H*Wt!
IMkrXh
	b48P(.5,
v`~p0g&
[o  MB
W\a"X 2
i`5x-i
 ^9S<#
:VSyE(>
9<@DY<
X_vl#W
'Va[qp9
vCXsfr
yYg!_z
;Vv	N+0
+HD|Yh
)jAXf;
8QrphL
WPuiG"
)##mF32
kYHP5x75x
*<;f99t6
	&Q%j.Zq
H|?0]z
2/kw'"
j@j ^V
xY;sQs
4,:0Ep<0L04
gbGnFj
Yf;sJQ
VVhU\$
VrCwx8
XY'C>0
F<ii*M
>o6u.q
?If.]G
- 9} 7}
 _/9>tM}
:Q"^_$
}1;cmJ
uQ+0<d
6@)a!!
p[q*zA
t#m=,Y
@TH0jd
AVWP3uI
N@Sj"5
aj\Y~N
Qk:tMW
d48<@&
fJJ~<_
60z_9Vb
_ESvP{
+Bx| 3
;er 8^I
"a=0C7.(
T%i"~'q#
*^P(K+
#7L$wAJGh
LO@X[|p
=Kqby^
;tv-J@
UQPXY]Y[
9]tSnd
Y7RyIb
HHX[?#|
9Es{Qs
9E	#:=B
rJD(D(AhJ.
.-RuQB`
Sj=TH!
awR0V~
t%P4fn
H$v.ER
@)ZE`|
LmHVqX
MfB(H	
%2EXVi
{,q>J!
I['J PV
]o&*Iz
7(i^joQ
"}U_D!
|tdW(!
$,T`EM
y]G%Bw&
fR]imv
\RRj{P
Kq]=ra
PHQ!00:?e$l7
dahWn0u,
MM&Sb7u
\Q3t1q}
xvL:v8
\t0'LAM
0!b-<<
h9 b@f/
7x&/T2
	Y78,<
mA;Y'^:qj
 (qPQ0
p0,pqC
E*	{([
}y@p;r
RMqWob
dxB-F[
TyUpV/
:\G	+!@
&"OM~G]S@!
D\iNS 
0b0\8jw
@P_Vj|
\HN;@ge
 lt[?_
|wC:FY
 r{3,#u1
)CSQu#gA8, 
Q{Vcay
@Q@t	A
S6L%HsfSC
dl$FS#p
*Rq>l`UPQ-
,8Il`%
9);Gds
qFW.(@au
TN9 H!
i	F"^mc]`F
L:YN$S
T;VLuq
LZp_$^
tXu.-'
 -r{/DW
`)p&<^:
Tv{BF>n
ar7fw2
q.%)54Vb
naLk6D
PjxPP0
Sir<[R
r"yF.X
B>=)DX
>	}`N!
|gvVlX
WJ/+wCQ
<@ZI]~7
`T;zwB
zL2<a,X
pd1t"/	W
~A,Ht*
2xr5D`
R9<X?J
6i&Q<Q
7U|~~u
;GHuAN
V]qkk[
?	hfl70
SD,H.,
@xiRDx
|8crtsLH
@-1@ZU
suqu,hh
"Xa#IO
-7T=EK6
gbocG	
hko0BbQ![
RlDVG2
 |BqoM
j+#iS0
"N97vC
)VI"~3
'HF= aN
AZ=ERCPR
h)JN$ 
O$@N;|
~9&NH	
]2TR.[
tt	;6X
`tm*lFT
_Vs\O$
&;Q(XK
0MqPor
+/ go!
^eF'Z7|
)l(X_~
6BF@AN
.0Nnno
w#]{Z,
/|@t%@FR
;@VR^o/XgbU)*
&'qdO[3
Qg/`>(
)K0	'	_
E'Y RV
*zr:t1/	/JEw
5,.qx|
k(/1@0
CuuIv%T=
.paJ(C
 !"##$
%&'()**+,-./K001234
5>?@AB
CDEFGH
P 2QzuF
Drq7C0
`t29t :t
u0u-"u
+~<+^@
i)i,*[U
KUqW("^=
-bM*Q+
@)8fR(N
=RoPp	
xkS-j4
N7P	t	
dA#o(I
av-(}8
@D{4%=
j (E28
>E69>Jk
7HFW"4
(bA e9
@k9990 
~M(9L}`'5
VQmV5>
Qu7xm,
=/G 2#
jch_0T
Nh	=d;0
H^EXK@
B9s u-P
jarfwH
.N(Qh3
+dB.1"+
(t|<"tx<%tt<'tp<$tl<&th
<!td<ot`
\<[tX<\t+l
&i	JwQ
	f1<Cj|
I\B%=Q
}_mAf0
,0E0$(Ah
8yBOu$
h)p"\6
*jTi*$
\ _'iP
#)"dkC
/@	!dWPS$
P.O$i(0
t#=Rq{~
`2s\+&c
9a1)x&
	+(EZ|
VR8bq$\y-
:nPsXX
G}>=J~f
&GFw01O
[Q&ge*
2~0wC~
$.ma!6;
tRJt6J
gXLYu*
l	0eCn
h}${h89
pO8+ZwB
44aDPo6
o+Au.#)
h( Q !
htPBJ@M
)`]MuN
haHXFbP
j:}tMh
!UV4k}c
Gq+/ $
?dC 5 
-mV7ZqUT
BE3^J;
`#LhPc
R|MtIc=
	<	!Oj
IbrM=Ix%
*	#uZG
n0~E@N
@@0^9 o :`
UPLQss
_t*]t%
*+Bsssk
~0/F,|p
@pS0Cj8
VwG]|S=$
RW\atiW
% \aH_
{5L^Ha
if`j dQ
BtkXhcE"(
AM"g'I
0VK(r)
Q.hbD5]L
ywlUGd
@0 $~M
8JX0(_
M20mcx
 ~!GPQ"C
V0X448
5M8<<@@@
Va_A@#
RNFN6 
P^Wha%ZR
LPTX\`
QK*Z	N
kBGHVW	h
5ZQVP"
AD6;7}%M
yZhc*E$
(aMQ2S
;Rz*zX
=Fu<HJ
-|9^$!8^
)\	kG?`-
YD=8/F
Ir^6zCS
; u@,35
^{.@NT.H
w,Ro4;t~]
}$G*Q+
lyt,PL
f@ImoV
tXUH1A
)s]qyl
T|/%[u
W05ROA
UKCqx%Jv
>V,%?0
4R[EV>
6)XD[(
;RrWO 
aC^F`0
C9P<t>
V/BSxM
"@,	P$
2V=br&
u4	qpb
_@}tj8uD
>dbocu
1E]4Jgt
RSPVWV
8ZT#kS
#8t"6W
C V,Ik
rf'z$iX,
_A1oKu
@:*Z	U
0u!#>[
jj[qSV4
K,})$IZ
o!}}wx
qTjEbp
9PSWP*yH
Hq@drN}G
dgbKtA
-{&6ig
rtjAt^
atYStMstHHt<
ht7Nt+nt&Ot
T|tj{Z
Zs# R1
^))H)P
qu=,Pxj	CR~
J$]hx$
2EB}5af
X0B3'`_
ld)]9N
 	kNh|
u}"a8Q#
gM(|)X$
*dh;"}(
RS4G;9r
@`I!*,F0
Aa,yGM
+k7l~4,W<
;V8R&4#L
tvq: S94|@
B:IEcS
";a4WP$
'N##u [hg
3WusG%+
TOQIc Z
1%Mtg=
0X1([+
K+,2<O
Z9,z`hl8
)ovZ42B
@rrL L
(V+jWS
V3b'_0Z,
Q<Me@;U
CT1x7|.
D33`}H
Rl!B&T
C0vHM+
u,Ji!)
x-,>v4U
<\B!&(j
)(3Sz	
o03$;8
JD8y*?#H
!]a|Yk
7FMc1)
%,jA*By
Gp$/qC
Q',Up 
f,JCAf
00,)'M
YQXD;P<
\ ,QA4
qsT%$l
lPkML&i
C	F?tG
X",xB+
S0Net*
+)|D<A%u 
V9\ueF
41MPSj9
s $8<!&
8(b|K(.
ZnbQIWv
I\Zp2g
\;Bb#$
'8?'8Hd9i	
5/i	84++
 )$rI)J
)NVHPc
kJZ	ys
DlP[	(rL+i
,f:e1`
3WQ~HB
{b	"&%[
%M5l\$
_@LaSh
[J1_HSRWhD
@8.SMY
;5|;&@
l j IU
."v0Vg
x<N;!a
T&$@"T
g?7t3P
h`3Fp8[p4
A-.W4l8;
6mB <qU
t&z{U"K
alm0iw
Vnt})Z
5!jV\,tf=
fFdb=&uCb
qFmDs:~4F
(Q7$',
fn)4eH
g1t5)D
q\m!3\w
CB)ya$
]D,ILH
(Pp$\@c
Q"A.Ju
Vak8(e
tj(,4X
J;(,%L
*R=IZX
C$;(,B
gSnc:b1:#
EBA]hof"
4%Ht2Hub
-&!E*y
Ix$bUC
T-HSvhk -
048<^a
F")dOW@
uw	1^a
<00R|OS
mUCl`O$G.K
=@pZ`H
e|$41Jl
4O"J_Q[
/;KuE`
(G QA#
r4c(K+
p(m-yL
+(`a#a
2@pUsWA2X,#
yp0.CYY&v
+>*Qi;}
r9-%)=
x*M!NO
{L#QP*
I"]P\[
}K,x9(
9j@PKs
$k0-9[
[8X@tV
-  -a8] 
*3koa"
Q7?CP^~
u[@hST
H3icA2^
t`HtNHuf
[;dH+5
d[EznV
[-EeEB
plU/\M
-FKN\t
WY;Nt5
i>\A'+
c5yvSPv
~}PlKhm
F*Q{~GP
<iq4r%
bad allocationm
orExitPr"ess
6v'OJt
FH:mm:
)Augus0Jul
wgFfurd0
Th$s'Wed?
sYJ)Kkd
J[IJKLMNO
&TUVWXYZ[\]^_`abcdefghijklmnop
0vwxyz{|}~
UnkJwn exc8
VWOVAC?;_
}?i3>lzOy
qpnGkjO
!`/x<y
?(null
_nextaft
logb'yn
7hypot
ceil(F
jo>imO
yUNFf8
FCJD#jcUTFm
16LQUNICOD
NY.UserO|
bjectInform1Wf6La
A0iveP
ageBoxW
NJ('8PWF
 ComplPe 
eIArFy'']
c threZ
@g<d:`
nXru!ih
e> ^KS
ize;`eh %H
allsig
(jdisE
kA*dGpa-
<D840,
V61#QNAN
D/SSNZP
#0SOI:v
emaXjvNM
jpp:t@ah
8jC"OS
]Gic#|7
Pkernel32
sWow64?[)
gNaSys
VoKSpvt
luginD
 K[	RA
6_./qo
:2?1db
\10?2k
wL+n+@
ACCEPOMMq
AIHRUN
KI~HEL
bl<~Ouhi
_AborM
c nhted
_L2hfv
AdpWLnm
kJhfpQN
2h +Mk
SylDmqf
p~???*
nd ofZ+$
recogn
wP<~ {} qu
| K to
?miss.
mT7LdX
POSIX 
NULLH{oH
`t(s) P
O(@@ 0\
Koixjl|
> 2y-2
4-bcu6`
2|"xWt
Vi, 32As[
DEFINEo
VERB)q
_9CPu`
qE'D?zQv
EA06bf
02Xg!g
[u5s3/}
`]{WE2G
G*mKm]'?s/Z;
#S'Sh[E
5V]l?O3
wFkA7K
S?W7_F
ZG3[SW
'?G[:V
X+gW-m	$V
P<k/WG
-7?#Fz
BZ--A;?7w^
 \4*D[
)]ID:~L
 aZWOW
pShwi~wYB
:ssg^bWI
bG?f	W
OKGn#T
dST&xE
\{GgM#H
\]W1gz
ICMP.DLL
CcW.tK
p	)p%m7
ESm'g?_;
wowbfL
7Modul&
#*6ci[
U?IC*6
:6S/UG_p
advapi
%uBf)/
.?2hw]
BgO'Fb5@
/?/j9	
,Nj%s'
-9Q\Z{0,
iL?NO_START_O
=PCQK.
D6"I?R@
<lhd`\
@XBvp	
ACPgR/S
Qkkbal
h.h,v 1.1 2004
9:50:3
jonbennett Exp $
yh`XPH
l`L<,<
23$--%"!' 	&
/s.ak[
Vpr3>r
SCc(Gd
jb[e;p
{C32W[>G!
4GwW7I
DKo/>f
nQr~.6
&6`u9~
UfVC*7
nDp*+2V
kv5buh
+xZasW
MTCur,o;
Id&Rais
MulDiv
ideLrTo
lByH(l
f>S=lzWQ
FlushB
olhelp32S:phopE
5h, my
i57kl[
m9oiQ(R
ayp9|sks
^acX)%VU
,joC^pTd(T
Add,OA
l8-;\`
cBln?)
a1!iew
Xz/x)+
pMkZrd
LSIDFNm
#GU22t)
txmoK#
lxyd&k0L
0+Fk@p
YdTGmR
ZUBT;u
Wca=MkzC
s>mpPP
XPTPSW
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
    </dependentAssembly>
  </dependency>
</assembly>
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
MPR.dll
ole32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
USER32.dll
USERENV.dll
VERSION.dll
WININET.dll
WINMM.dll
WSOCK32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
GetAce
ImageList_Remove
GetSaveFileNameW
LineTo
WNetGetConnectionW
CoInitialize
EnumProcesses
DragFinish
LoadUserProfileW
VerQueryValueW
FtpOpenFileW
timeGetTime
H}AU3!EA06
h!b.kC
Dz:T,e
Dx_#g2C
ZA%MS8@ 
gDEw&2m
U"mpX_
}|-xy6
P*qA[DYNX
_9M<JBW
o`viz-
^LD>fa
7}1&/X
H<|.Ni
AgR6<	O
Iyk!i@@N
P/6OIS
bW0>u[]G
G@FwGt;
NTGh|'
Po{ZC 
>|Fu}0r
VcYo$t6
bw9/|yQ
>;"#Ap
_[x)DM
L;&4I-
Iyu\,l
7YA3+.u
svr&4Zg
]j?s7<
 "+s4(S:~V" 
*d}4!Q
\|%zaC
	ZIPm|
L:+p^:
yDb\{l
hs\c6,
ie"s5=
w'hJY^ixT
}Q jk 
p0L=g2,
\95KzKJ_[	
:k''<)3
5:U8l/{n
f_y!f.=
G>O:K}
1^?YdcQ5
S\P(T9
w5l6%cn
o#,K#M
a~40FEEt
Fv>SPkQ
:^@|$T
p_)90>
GbME3Q7
e}	[+Wb
WrSl$+p
E|MCR'
@Ajx-{
_N&-ey
=',;?8
'VUfvm
/>/-y9
)p,:A=
<\JTe[8
<$*VpN
i_hc/6r|
O@t`}D
zfPdX@\
e4`#Rx
m=	6wH
+LAFU6
Jo5H@M
xy0.h^W
q7P.+B
A"#%04pk
)_AcWpJ 
W;^y3m_n
 y"=om
^cgcmW
pH8y/[
XZ ZIJA
!~yCFJ
~i^	5E
w83C"{
L@Lo-/9l
/*%NEn
{+sh=U
K	?}5hq
Oq~s9G
n]|lp*
as^o)_
7@T`2b
^/SgwD}
"*u$]D
"a8-EA
IH)J`w
fh<8o,
u^y`S/I
49sbrD
S!B6m{
4y{N2.w
So^0k\
w>NBd:
	?AX^T
,aplW`
2RwLc8
mqcHjp
7c([J9"p
sh:aW6
fm=BMZ
a6+xLx
PlHH~'
lqDC60Aw
D_1^32o
|bC@MO
#+v9A<
qa +:"
},'Y{6M
 jw+i\
@rv>`%
v`P^A=(B
1]nCK.
E5(0d|
;yXPZq
#m$V"r-
cTmQzt
?rX~717
wlCO	(
}C^DUH
E53!sn7	1|
 ?:f Z
G\P39	=A
t*XN3R2
$q#j92
!H2u+E
w{RmTK
556&R}
3ZNOm!
~D)#p'
7`D\,S
uYFnL{
)B4$O[
89	^Uz
iug8jm
izh'^Yf
,7<wx`O
	X0uTI
C`,Z{(
_7dQ^z
>ggTW@{0
?Mp_LL
rJn!PfQ
5~N_:N>M,
Q$pg;M
iE<;i,
>ENhCfgw
nET)C4
+7~83t
$=ao} 
d]*Gj4
5{L;9;
MKbhGlH
L5\U-a
^T;{#F
$Sb`Q5g
NZ|$A"
5f(1w	
d&lG's
Hbd8^m
=cv9OV+-
l[wH[}t~
Dq[ Lp
e54vQ[d
jf	ZOB
QL^l_|
S+6:G4"
+(R#9,
0Sqh<)
\.oy5X
2MiWff.
2bp'o<>
P08)Cl
NvT`	z!T
sb_:z<F
l:^@pRC
SCJp[wS k^R-
_M@-9t
/JmsYi
AU3!EA06