About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Tuesday, September 3, 2013

Taidoor strings - APT

File: DW20.exe
MD5:  46ef9b0f1419e26f2f37d9d3495c499f
Size: 47104

Ascii Strings:




---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
ARich
.text
`.rdata
@.data
.rsrc
_^][
QSUWh
D$ C;
^_][Y
l$@VWPQU
_^][
_^][
h P@
_^][
_^][
_^][
_^][
_^][
SUVW
-d@@
><\u
D$ s
D$!t
--------------snip
_^][
WPRU
_^]3
_^]3
%|@@
h@A@
hSVW
>"u:F
XPVSS
MFC42.DLL
printf
fclose
fopen
fwrite
rand
__p___argv
__p___argc
__CxxFrameHandler
_CxxThrowException
putc
getc
fread
realloc
__dllonexit
_onexit
MSVCRT.dll
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
OutputDebugStringA
LockResource
GetProcAddress
GetModuleHandleA
SizeofResource
FindResourceA
lstrcpyA
lstrlenA
lstrcatA
CloseHandle
CreateProcessA
GetTickCount
CopyFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetModuleFileNameA
DeleteFileA
Sleep
VirtualAlloc
VirtualProtect
VirtualFree
IsBadReadPtr
HeapAlloc
GetProcessHeap
GetStartupInfoA
KERNEL32.dll
wsprintfA
USER32.dll
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
MSVCP60.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
_stricmp
Kernel32.dll
Start
IDR_BIN
%tmp%\
.exe
%tmp%
WinHttp
Read Error
.?AVtype_info@@
1PAD(
PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

Unicode Strings:
---------------------------------------------------------------------------
IDR_BIN
"-7v
------------------snip
h&About ...
About
System
Bypass Version 1.0
Copyright (C) 2013
Bypass
Hello World!
BYPASS
Labels: ,