About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Saturday, August 17, 2013

Sality strings - CRIME

File: sality
MD5:  ceaf4d9e1f408299144e75d7f29c1810
Size: 997537






Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
"RichVE
.text
.rdata
.data
.rsrc
.penask
.adata
. rdata
O$47E
`H,V+-
[<<v------------------------------------------snip
[^YX
kernel32.dll
ExitProcess
user32.dll
MessageBoxA
wsprintfA
LOADER ERROR
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
 (08@P`p
|$,3
T$ v
(C@;
t$h3
D4l|M
_^]2
;;F,s
,;F0s
 ;F4s
;F8s
0:@D
_^][
T4$F
`u(j
L4#H
L4$F
_^][
_^][
_^][
D$$W3
5:@D
D$ %
;|$(
8_^]
_^]2
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
mpr.dll
ole32.dll
oleaut32.dll
shell32.dll
user32.dll
version.dll
winmm.dll
wsock32.dll
RegEnumValueW
ImageList_EndDrag
GetSaveFileNameW
MoveToEx
WNetUseConnectionW
OleSetContainedObject
DragQueryPoint
GetWindowTextLengthW
GetFileVersionInfoSizeW
waveOutSetVolume
444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444
44444
555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555
4444
??????????????????????????????????????????????????????????????????????????????????????????
4444
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6
4444
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6
4444
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6
4444
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6
4444
DBBEBCEBBBCBBBEDDBBBDCCBBBBCBBCBBDDBCBBBCCCBCBBCBBEDBDEBCCBBCDBCEBCBCBBBBBBDCCDCCBDDDCBBD6
4444
EEECEEEEEBCCBCBEBEBECCBEEBCCEDECEEEDDBCDBECBEECECCECEEEBEDDBCEEBBDEEEEBBECCEDEEEEDBCECBBC6
4444
EEEEEEEEEEEEEEEEEEEEECDEEEEEDEECECEEEDEEEEEEEDECEDEEEEEEEECECEEECEEEBEEEECEBECCEEEEEEEEEE7
4444
EEEEEFEGEFFEGFGEEEEEFEGEFHFGGEEEEEGHEFFEFEEFFFEFEEEEHEGFEHEEGEEEFEEEEHEEEEEEFEEEEFGGEFFFE7
4444
FHHHHFGFHGFHFGEFFEFFHEFEFFFFFFFFGHHHFHGHHHFHHHHFGFGFGHGGEHFHFGGHGGGGHHFFHGHGFFEEEHHEHGHHF8
4444
HIHIIIKHJKKHHIHKHKHKIJKHIJHJIHIJHKJHHHHHIJIIIKHIHIIHHIKIKKKIKIJJIIHKIHKJJJIIKKHHHKHKHIIIH:
4444
KKKIKKKKKKKKIKIIKIKKKKKIKKKKKKKIKKKKKKKKKKIIKKKKKKIKKKKKIKKKIIKKKKIKKLKKKKKKKKIKKKKIIKKKK9
4444
LMLLLKKNKKNLMKKLKKLLKLKKLKNLLKLLLKKLLMKKNKLNKKNLLKLNMKKLKLKKNNMMLMLLNLKMKKLMKLKLLNKLKLNNL;
4444
NNNNMNNNNNLNLLNNNNLLNNLLNNLNNNNLLNLLNLNLNNLLLLNNMNLLNLLNNNNLNLNLLLNNNNLLLNLNNNNNNNLNNLLLN>
4444
OOONOOONOQNONONOOONONONOONONNORONOQNONOOOONRNORNNQNNOOONOOOONOOOQOQONOQNNRONQNNOORNOONNNN<
4444
RRRRRRRROORORRROOORRRORROORRRRRORRRORROOPRRRRORROORRRRRRROROROOSRRRRRRORRRRRRRROORRORRRRR<
4444
RSSRRRRSSSRRSVRSRRRSSSSRVSSRRSRRSRSSSSSSUURSSRRRSSRSUSUSVSRSSRURSRRSSUSVURSSSSSRRVRSRRVVS=
4444
SSVVVVSVVTSSTVTVTSTVVVVWTSTVVWTVVVVVVVVSVSSSSSVSWSSWWVVVVSSVVVVVSVVVSVVVVVWVSSVVVWSVVSSSS@
4444
WVZWWWVWWZZWWWVWWWWWWVWWWYZWWWWWVWVWWVWWVZZZWWWWWWWZWZWWWVWWVZWWWWWWYYWVWWVWWWWZZZWWYVWWV@
4444
Z[Z[WWZZWWZZZXXZZZZWZXZZ[X[[[ZZWZZZZZWZZXWWZXZWZWZZZZZZZZZ[ZW[ZZ[ZZ[ZWWZ[[ZZWZZZZ[[WZZZZZA
4444
[[^[^[^[[]^[^[[[[[[[[[^^[[[[^^[[[[[^^[[[^^[[[[[[[^]^[[[[^[[^^[[[^ZZ[[^[[[^^^^[[ZZ[[][[[[^-
4444
^_^\^_\^[__^^_^^__^^^^___^__^\_\\_^^^^\^^_[__^^__^_^__^^\[^^_^_^^_^\_^_^^\^\^[^[[__^\^^^\-
4444
ba_`__aa_____aaaab__a_aa``ab__a__a___b__a____`___a__a______a_a_b_a__a__`_aa`a__aa_abaa``a.
4444
abbbbbbbababbabebababbbbbbbbbbbbbbbbbabaaababbabbbbbbaabbabbaabbabbdbabbbaaabbabbabababbb.
4444
eeebeccbefbefefeffbbbeffeecbfbeeeeb
efebebefbceefeceefefffffbfebeebeeebebfeebfecbbbeeecffc/
4444
ffiffffffffififfffffffffffffieffffffffffiifffiiffffiffiifffffffiffffffiffffffhffffffffiif/
4444
ijjgijggjfifjjgijijjjjigjijgjiiijijjiiiffjijjjjjjijjijijjiijiijjjiigfijjjjjijjjjjjjgijjjj0
4444
jjmjjjjjllllljjjkljlkjjmljljljjjkkjjjmkljjjjkjjjmljjklljljljjjkllkjmjjlljlkllmkllkklljllj1
4444
mmlmmlmmmmlmmmmmkmmlmmlmmmmmmmmmmmmmmmmmlmmmmlmmlmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm2
4444
npoppnomnomnmppnopomopommmnopmpnmonpppomopmooopmoppponpppmmpnompmompopnnompnopmmmmmoopoom2
4444
ppppppqpppppppppsqpqprpppppppprpqppqrrprpqspppqrppprpppprqqrppppqpppprprpqpppqppppppppppr'
4444
pssssssqrssssssspqssssssprqsssssssqrqssqsrrsqssrrqrsssrqsspsqqsspsqqsssspsssssqqqrrsqssss(
4444
vtwvtvvttstvwwvtwsvsswvtsvtsvtwstwvsssvvtsssssswvswsssswsttvsssswwsssvwstwvswvssswtvvsvvv(
4444
wwwwwwwwwwwwxwwwxwwwwwwwwwwtwwwwwwxwwwwwuwwwwwwxtwwwwwwwwwwwwwwwwwwxwxwwwwwwwwwwwwwxwwwww)
4444
xyyzzzwyzyzzzzwzwwxzzyxzzzyyzzxxzzwxxxyxxxzzzzxyyyywzzzxyyxzzxzxzxyywyzzzwxxzxzyyxzzxwzzz*
4444
xyyzzzwyzyzzzzwzwwxzzyxzzzyyzzxxzzwxxzz|zz|{zzz{|zzz{z{zzzzzzz|z{z{z{{z{zzzzzz{{{zzz{z{{{+
4444
zz{{zz|{zzzzzz|}zzzzzzzzzz{z{|zz{zzz|{}}}}{}}}}{}{}}}}{}}}}{}}}}}}}{}}{}{}}{{}}zz}}}{}}}},
4444
}}}{{{}}}{{}{{{}}{}}{{}}}{}}}{z}{}}{}{}}}}{}}}}{}{}}}}{}}}}{}}}}}}}{}}{}{}}{{}}zz}}}{}}}},
4444
}}}~}~}~~~~~}~~~~
~~~}~}}
}}~~~
}~}}~}}~~}~~~~~~~~
}~~}
~~~}}
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
4444
44444
333333333333333333333333333333333333333333333333333333333333333333333
4444444
333333333333333
444444444
33333333333333
4444444444444444444444444444444444444444444444444444444444444444
444444444444444444444444444444444444444444444444444444444444444444
444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444
ddddddddddddd
IIIIIIIIIIIIIId7
ttttttttj
<<<<<<<T
1111111(o
Id7TI
Id7(1IIIIIIIIIIII
IIIII`
7777
rllll
7lllll
[o>w
h7dllll
[o>wSSTTTw:nLglll
[o2T<<<<<<<11<t9Ll
[o$(111111111((#
[$9s=
yyyy3Wq
33$?m[
[[[[[[
[[[[[[
lllll
[fPFMlllll
[sTtpk
_glllll
wwww
nhGFlllll
[i>wTTTTTTTTwpN
IMlll
[i)<<<<<<<<<<<<<<:nK_l
[i}<<<<<<<<<<<<<<<<<wl
[c*(((((((((((((((((wl
>X_l
2Xil
[>6cj0
2Aml
"' 6Hx
.LjR=W
 .Jbjx=
[[[[[Y
[[[[[[
[[[[[[[
lllll
[q~b[Fllll
ha[]dlll
nKB\`lll
[f}tttttttttt
nKG[llll
ha[llll
XwwwwwwwwwwwwwwSSSTTpNJBllll
SSSSSSSSSSSSSSTTTTTTTTT:kK^l
<<<<<<<<<<<<<<<<<<<<<<<<<<u9l
A><<<<<<<<<<<<<<<<<<<<<<<<<<
V211111111111111111111111111
2((((((((((((((((((((((((((
|%##########################
[iix
*'5[Dj
"'/5H[DPY
._j=
! 6J[[Lj=
! 6J[[
DDDDl
-Yjoz{
[[[[[jxzW
[[[[[[[[
[[[[[[[[7
{{{{{x
{{{{{x
{{{{{x
333333333333330
{{{{{{{{{{{{{{0
{{{{{{{{{{{{{{0
{{{{{{{{{{{{{{0
{{{{{{{{{{{{{{0
{{{{{{{{{{{{{{0
{{{{{{{{{{{{{{0
{{{{{{{{{{{{{{0
{{{{{{{{{{{{{{0
{{{{{{{{{{{{{{0
wwwwwww
{{{{{x
733333333333333333333330?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
0?{{{{{{{{{{{{{{{{{{{{{{0?
3333333330
?{{{{{{{{{{{0
?{{{{{{{{{0
?{{{{{{{0
3333330
=m|O
P[VQP
/6!H
Y_Qi------------------------------------------snip

Unicode Strings:
---------------------------------------------------------------------------