sub_outside():
MSVCRT.malloc
MSVCRT.free
|
_DllMain12():
KERNEL32.DisableThreadLibraryCalls
|
sub_9AE0E5(026a):
MSVCRT.memcpy
|
sub_9B1F1B(03c0):
"content-length"
|
sub_9A8119(03e3):
KERNEL32.CreateFileA
KERNEL32.GetFileSize
KERNEL32.GlobalAlloc
KERNEL32.ReadFile
KERNEL32.GlobalFree
KERNEL32.CloseHandle
|
sub_9A87A8(065a):
WS2_32.ntohl
KERNEL32.WaitForSingleObject
KERNEL32.GlobalFree
KERNEL32.InterlockedDecrement
MSVCRT.rand
KERNEL32.CloseHandle
|
sub_9A961F(0ae9):
MSVCRT.memset
MSVCRT.rand
MSVCRT._snprintf
KERNEL32.GetSystemTime
KERNEL32.SystemTimeToFileTime
"http://www.%s"
|
sub_9B2221(0e2c):
MSVCRT.strcmp
"Connected"
|
sub_9B1F83(0f26):
MSVCRT._memicmp
"location"
"st"
|
sub_9ABA09(131b):
MSVCRT.memset
""
|
sub_9A754B(16cc):
MSVCRT.memset
"ncacn_np"
"\\"
"HHDHH"
|
sub_9ABD83(19db):
WS2_32.getsockname
MSVCRT._snprintf
MSVCRT._strlwr
MSVCRT.strlen
MSVCRT.memcmp
MSVCRT.strstr
MSVCRT.rand
KERNEL32.Sleep
KERNEL32.InterlockedIncrement
KERNEL32.GlobalFree
WS2_32.shutdown
WS2_32.closesocket
"\r\n\r\n"
"\r\nuser-agent:"
"\r\n"
"windows nt 5."
"HTTP/1.0 200 OK\r\nPragma: no-cache\r\nCont"...
|
sub_9A8F0D(1c13):
KERNEL32.CreateThread
KERNEL32.CloseHandle
|
sub_9A98FC(1c13):
KERNEL32.CreateThread
KERNEL32.CloseHandle
|
sub_9A7D84(1ed8):
KERNEL32.GetSystemDirectoryA
KERNEL32.GetVolumeInformationA
|
sub_9B2D2B(1f2a):
MSVCRT.calloc
MSVCRT.strncpy
MSVCRT.sscanf
MSVCRT.free
"GetGenericPortMappingEntry"
"NewPortMappingIndex"
"NewExternalPort"
"NewProtocol"
"NewInternalClient"
"NewInternalPort"
"NewEnabled"
"NewPortMappingDescription"
"NewLeaseDuration"
"errorCode"
|
sub_9AC693(21a9):
KERNEL32.Sleep
"http://www.maxmind.com/download/geoip/d"...
|
sub_9B1C1B(21bd):
MSVCRT.memcpy
MSVCRT.memcmp
"service"
|
sub_9ACE59(2216):
MSVCRT.fclose
MSVCRT.free
|
sub_9A7E5C(22c6):
MSVCRT.memset
WS2_32.socket
WS2_32.WSAIoctl
WS2_32.ntohl
WS2_32.closesocket
|
sub_9B2C56(2506):
MSVCRT.calloc
MSVCRT.sscanf
MSVCRT.free
"DeletePortMapping"
"NewRemoteHost"
"NewExternalPort"
"NewProtocol"
"errorCode"
|
sub_9A953B(265a):
MSVCRT.strtok
MSVCRT.atoi
MSVCRT._strnicmp
", "
|
sub_9AB966(26f0):
MSVCRT.memcpy
|
sub_9AF568(2ddc):
MSVCRT.free
MSVCRT.fclose
MSVCRT._errno
|
sub_9AF810(2ed9):
MSVCRT._errno
MSVCRT.fread
MSVCRT.memcpy
|
sub_9B1D81(31d4):
MSVCRT.strcmp
MSVCRT.memcpy
"URLBase"
"serviceType"
"controlURL"
"eventSubURL"
"SCPDURL"
|
sub_9A7FF2(320d):
MSVCRT.rand
|
sub_9A6A3A(358d):
KERNEL32.GetModuleFileNameA
KERNEL32.GetComputerNameA
MSVCRT.strlen
MSVCRT._snprintf
KERNEL32.CreateMutexA
NTDLL.RtlGetLastWin32Error
KERNEL32.CreateThread
KERNEL32.CloseHandle
KERNEL32.MoveFileExA
"c:\\windows\\system32\\conficker_unpacked.dll"...
|
sub_9B2A48(36e9):
MSVCRT.strncpy
MSVCRT.sscanf
"GetExternalIPAddress"
"NewExternalIPAddress"
"errorCode"
|
sub_9A6847(3731):
KERNEL32.GetVersion
KERNEL32.GetSystemDirectoryA
MSVCRT.rand
MSVCRT.strncat
KERNEL32.MoveFileA
KERNEL32.CopyFileA
KERNEL32.MoveFileExA
MSVCRT.strncpy
KERNEL32.CreateFileA
KERNEL32.GetFileSize
KERNEL32.LockFile
WS2_32.WSAStartup
KERNEL32.Sleep
"c:\\windows\\system32\\conficker_unpacked.dll"...
|
sub_9A8A08(3c0e):
KERNEL32.Sleep
MSVCRT._snprintf
KERNEL32.CreateEventA
NTDLL.RtlGetLastWin32Error
KERNEL32.GlobalAlloc
KERNEL32.CreateThread
KERNEL32.CloseHandle
KERNEL32.OpenEventA
KERNEL32.SetEvent
MSVCRT.memset
KERNEL32.InterlockedExchange
"l%08x%08x%08x"
"w%08x%08x%08x"
"l%08x%08x%08x"
"w%08x%08x%08x"
|
sub_9A9099(3fe8):
MSVCRT.wcslen
KERNEL32.GlobalAlloc
MSVCRT.wcscpy
MSVCRT.wcscat
KERNEL32.GlobalFree
ADVAPI32.RegCreateKeyExW
ADVAPI32.RegSetValueExW
ADVAPI32.RegCloseKey
"%SystemRoot%\\system32\\svchost.exe -k "
"SYSTEM\\CurrentControlSet\\Services\\"
"DisplayName"
"Type"
"Start"
"ErrorControl"
"ImagePath"
"LocalSystem"
"ObjectName"
"Parameters"
"ServiceDll"
|
sub_9B2909(4053):
MSVCRT.strncpy
MSVCRT.sscanf
"NewUptime"
"NewConnectionStatus"
"NewLastConnectionError"
"errorCode"
|
sub_9A7CD4(4138):
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegCloseKey
"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
|
sub_9A6810(44e8):
MSVCRT.strlen
MSVCRT._stricmp
"c:\\windows\\system32\\conficker_unpacked.dll"...
|
sub_9AC53D(4663):
MSVCRT.fopen
MSVCRT.fclose
KERNEL32.DeleteFileA
|
sub_9A6DB9(46bc):
WS2_32.gethostname
KERNEL32.GetComputerNameA
MSVCRT.strlen
MSVCRT._snprintf
"%08x%08x"
|
sub_9A8471(48e2):
KERNEL32.GlobalAlloc
MSVCRT.memcpy
KERNEL32.GlobalFree
|
sub_9A927B(49d3):
MSVCRT.strlen
KERNEL32.GlobalAlloc
MSVCRT.rand
KERNEL32.MultiByteToWideChar
KERNEL32.GlobalFree
"netsvcs"
|
sub_9A81A0(4bf9):
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle
KERNEL32.DeleteFileA
|
sub_9B234F(5199):
MSVCRT._snprintf
MSVCRT.strncpy
WS2_32.socket
WS2_32.ntohs
WS2_32.inet_addr
WS2_32.connect
WS2_32.closesocket
"%s#%s"
"\r\n\r\n\r\n"
|
sub_9B2F2C(51cd):
MSVCRT.calloc
MSVCRT.strncpy
MSVCRT.sscanf
MSVCRT.free
"GetSpecificPortMappingEntry"
"NewRemoteHost"
"NewExternalPort"
"NewProtocol"
"NewInternalClient"
"NewInternalPort"
"errorCode"
|
sub_9A97BF(552b):
MSVCRT._snprintf
KERNEL32.InterlockedExchange
MSVCRT.free
"http://%s/search?q=%d&aq=%d"
|
sub_9A6E48(5881):
WS2_32.inet_ntoa
MSVCRT._strdup
MSVCRT.free
|
sub_9A8F81(5be4):
ADVAPI32.RegOpenKeyExW
ADVAPI32.RegQueryValueExW
MSVCRT.wcslen
KERNEL32.GlobalAlloc
MSVCRT.memcpy
MSVCRT.memset
ADVAPI32.RegSetValueExW
KERNEL32.GlobalFree
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"...
|
sub_9A7454(5f97):
MSVCRT._snprintf
MSVCRT.memset
"\\\\%s\\IPC$"
|
sub_9A7607(611b):
MSVCRT._snprintf
MSVCRT.memcpy
MSVCRT.rand
"\\\\%d.%d.%d.%d"
"\\"
"\\..\\..\\"
|
sub_9AF43F(63f6):
MSVCRT._errno
MSVCRT.fread
|
sub_9A7364(6605):
MSVCRT._snprintf
MSVCRT.strlen
KERNEL32.GlobalAlloc
MSVCRT.memcpy
|
sub_9A7356(66cf):
MSVCRT.free
|
sub_9A7348(66cf):
MSVCRT.malloc
|
sub_9A8F2C(6987):
KERNEL32.LoadLibraryA
KERNEL32.GetProcAddress
KERNEL32.FreeLibrary
"srclient.dll"
"ResetSR"
|
sub_9A9CF3(69fd):
MSVCRT.memset
MSVCRT.memcpy
|
sub_9AC843(6b93):
KERNEL32.GetSystemDirectoryA
KERNEL32.GetTempFileNameA
KERNEL32.GetTempPathA
KERNEL32.DeleteFileA
MSVCRT.srand
MSVCRT.strcat
MSVCRT._snprintf
KERNEL32.CreateThread
KERNEL32.WaitForSingleObject
KERNEL32.CloseHandle
"0"
|
sub_9B1E2A(6fba):
MSVCRT.strlen
MSVCRT._snprintf
MSVCRT.malloc
MSVCRT.memcpy
WS2_32.send
MSVCRT.free
":%hu"
"POST %s HTTP/1.1\r\nHost: %s%s\r\nUser-Agen"...
|
sub_9AD496(7118):
MSVCRT.memcpy
|
sub_9AFA38(7198):
"invalid distance too far back"
"invalid distance code"
"invalid literal/length code"
|
sub_9AD6B5(7275):
MSVCRT.memcpy
|
sub_9A9C30(7466):
MSVCRT.memset
|
sub_9A88D6(753b):
MSVCRT._snprintf
KERNEL32.CreateEventA
NTDLL.RtlGetLastWin32Error
KERNEL32.InterlockedIncrement
KERNEL32.GlobalAlloc
KERNEL32.CreateThread
KERNEL32.InterlockedDecrement
KERNEL32.CloseHandle
"n%08x%08x%08x"
|
sub_9A6D4E(77a9):
"WWW"
|
sub_9AC384(7921):
MSVCRT._snprintf
MSVCRT.memcmp
KERNEL32.GlobalFree
|
sub_9AF64C(81ac):
MSVCRT.malloc
MSVCRT.strlen
MSVCRT.strcpy
MSVCRT._errno
MSVCRT.fopen
MSVCRT._fdopen
MSVCRT.fprintf
MSVCRT.ftell
"%c%c%c%c%c%c%c%c%c%c"
|
sub_9A82E1(84a0):
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.send
WS2_32.WSASetLastError
|
sub_9B2811(8f2b):
MSVCRT.malloc
MSVCRT.strncpy
MSVCRT.memcpy
|
sub_9AE1BD(9080):
MSVCRT.memcpy
"invalid window size"
"incorrect header check"
"unknown compression method"
"unknown header flags set"
"header crc mismatch"
"invalid block type"
"invalid stored block lengths"
"too many length or distance symbols"
"invalid code lengths set"
"invalid bit length repeat"
"invalid bit length repeat"
"invalid literal/lengths set"
"invalid distances set"
"invalid literal/length code"
"invalid distance code"
"invalid distance too far back"
"incorrect data check"
"incorrect length check"
|
sub_9A85C8(9301):
KERNEL32.GlobalFree
|
sub_9A8054(93f7):
KERNEL32.GetModuleHandleA
KERNEL32.GetModuleFileNameA
KERNEL32.CreateFileA
KERNEL32.GetFileTime
KERNEL32.CloseHandle
KERNEL32.SetFileTime
"kernel32.dll"
|
sub_9B27E6(96fc):
MSVCRT.memcpy
|
sub_9AC1D7(9867):
MSVCRT.rand
WS2_32.listen
KERNEL32.InterlockedExchange
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.accept
KERNEL32.GlobalAlloc
KERNEL32.CreateThread
KERNEL32.CloseHandle
WS2_32.closesocket
|
sub_9A986A(a0b7):
KERNEL32.GetSystemTime
KERNEL32.Sleep
"http://trafficconverter.biz"
"http://trafficconverter.biz/4vir/antisp"...
|
sub_9ABADB(a1a3):
WS2_32.socket
KERNEL32.GlobalFree
MSVCRT._strlwr
MSVCRT.strstr
WS2_32.shutdown
WS2_32.closesocket
""
"vista"
"service pack 1"
"service pack"
"windows server 2003"
"service pack 1"
"service pack 2"
"service pack"
"windows 5.1"
"windows 5.0"
"windows 4.0"
"unix"
|
sub_9B2260(a1c8):
MSVCRT.memset
MSVCRT.free
MSVCRT.strcmp
"urn:schemas-upnp-org:service:WANCommonI"...
|
sub_9A9F13(a336):
MSVCRT.memcpy
|
sub_9B2186(a413):
MSVCRT.free
|
sub_9AC4A4(a7ef):
MSVCRT.fwrite
|
sub_9A8385(a96e):
MSVCRT.memset
WS2_32.ntohs
WS2_32.ioctlsocket
WS2_32.connect
WS2_32.WSAGetLastError
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.WSASetLastError
|
sub_9A7B0B(ac2b):
KERNEL32.LoadLibraryA
KERNEL32.GetProcAddress
KERNEL32.VirtualAlloc
KERNEL32.VirtualFree
"netapi32.dll"
"NetpwPathCanonicalize"
|
sub_9A7F99(b4b4):
ADVAPI32.OpenSCManagerA
ADVAPI32.OpenServiceA
ADVAPI32.ControlService
ADVAPI32.CloseServiceHandle
"SharedAccess"
|
sub_9A80F1(b51e):
KERNEL32.GetProcessHeap
NTDLL.RtlAllocateHeap
|
sub_9A8105(b51e):
KERNEL32.GetProcessHeap
NTDLL.RtlFreeHeap
|
sub_9B28AE(b52b):
MSVCRT.free
|
sub_9A6EE2(b9d4):
MSVCRT._snprintf
MSVCRT._stricmp
|
sub_9A8214(bbbb):
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.ioctlsocket
KERNEL32.GlobalAlloc
WS2_32.recv
KERNEL32.GlobalFree
WS2_32.WSASetLastError
|
sub_9A9427(be75):
KERNEL32.GlobalFree
|
sub_9A85F4(c059):
KERNEL32.WaitForSingleObject
MSVCRT.rand
KERNEL32.GlobalFree
|
sub_9ACA2E(c28d):
MSVCRT.fseek
MSVCRT.fread
MSVCRT.malloc
|
sub_9A6FD2(c4bd):
WS2_32.inet_addr
|
sub_9A71BA(c5b5):
MSVCRT._strlwr
MSVCRT.strstr
WS2_32.inet_addr
"ip address"
|
sub_9A9818(c68a):
WS2_32.gethostbyname
WS2_32.inet_ntoa
MSVCRT._strdup
KERNEL32.CreateThread
KERNEL32.CloseHandle
|
sub_9B15F5(c921):
WS2_32.gethostbyname
MSVCRT.memcpy
MSVCRT.memset
WS2_32.socket
WS2_32.ntohs
WS2_32.connect
WS2_32.getsockname
WS2_32.inet_ntoa
MSVCRT.strncpy
MSVCRT._snprintf
MSVCRT.strlen
WS2_32.send
MSVCRT.realloc
WS2_32.closesocket
"GET %s HTTP/1.1\r\nHost: %s:%d\r\nConnectio"...
|
sub_9B2029(c9bf):
MSVCRT.strlen
MSVCRT.strncpy
|
sub_9A74B7(c9db):
"ncacn_np"
"M"
"S"
"AAA"
|
sub_9A870B(cce9):
KERNEL32.WaitForSingleObject
KERNEL32.CreateThread
KERNEL32.CloseHandle
KERNEL32.GlobalFree
|
sub_9A78CC(cdc8):
MSVCRT._snprintf
"%d.%d.%d.%d"
"\\\\%s\\IPC$"
|
sub_9B1C76(d11d):
MSVCRT.memcmp
MSVCRT.strcmp
MSVCRT.memcpy
"service"
"urn:schemas-upnp-org:service:WANCommonI"...
"urn:schemas-upnp-org:service:WANIPConne"...
"urn:schemas-upnp-org:service:WANPPPConn"...
|
sub_9A67C0(d12b):
USER32.GetKeyboardLayoutList
KERNEL32.GlobalAlloc
KERNEL32.GlobalFree
|
sub_9ACCC3(d156):
MSVCRT.malloc
MSVCRT.strlen
MSVCRT.free
MSVCRT.strncpy
MSVCRT.fopen
MSVCRT._fileno
MSVCRT._fstat
MSVCRT.fread
MSVCRT.fseek
|
sub_9A7CA0(d237):
KERNEL32.Sleep
"services.exe"
"c:\\windows\\system32\\conficker_unpacked.dll"...
|
sub_9B28D8(db68):
MSVCRT.strcmp
|
sub_9B21B5(dc02):
WS2_32.select
WS2_32.recv
|
sub_9A9E56(dc60):
MSVCRT.memset
MSVCRT.memcmp
|
sub_9B25D9(dcaa):
WS2_32.socket
MSVCRT.memset
WS2_32.ntohs
WS2_32.inet_addr
WS2_32.setsockopt
WS2_32.bind
MSVCRT._snprintf
WS2_32.sendto
WS2_32.closesocket
MSVCRT.malloc
MSVCRT.memcpy
"239.255.255.250"
"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255."...
|
sub_9A96EE(dcac):
MSVCRT.sin
MSVCRT.log
|
sub_9A991B(dd14):
KERNEL32.GetSystemTime
KERNEL32.GlobalAlloc
MSVCRT.labs
MSVCRT.strcat
MSVCRT.rand
KERNEL32.CreateThread
KERNEL32.WaitForMultipleObjects
KERNEL32.TerminateThread
KERNEL32.CloseHandle
KERNEL32.Sleep
KERNEL32.GlobalFree
|
sub_9AC747(ddc8):
MSVCRT._snprintf
MSVCRT.strcmp
"%d.%d.%d.%d"
|
sub_9A7F51(df79):
KERNEL32.GetCurrentThreadId
KERNEL32.GetCurrentProcessId
KERNEL32.QueryPerformanceCounter
KERNEL32.GetTickCount
MSVCRT.srand
|
sub_9A7D25(e28e):
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegQueryValueExA
ADVAPI32.RegCloseKey
"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
|
sub_9A8022(e56c):
MSVCRT.rand
|
sub_9AF3DF(e5c0):
MSVCRT._errno
MSVCRT.fread
|
sub_9AC5AF(e5c1):
KERNEL32.GetModuleHandleA
KERNEL32.GetModuleFileNameA
KERNEL32.GlobalAlloc
KERNEL32.GlobalFree
"ntdll.dll"
"\\VarFileInfo\\Translation"
|
sub_9A7A90(e5e6):
MSVCRT.wcsstr
MSVCRT.wcslen
"\\..\\"
|
sub_9B2081(e9a9):
MSVCRT.strlen
MSVCRT.malloc
MSVCRT.strncpy
MSVCRT.strchr
|
sub_9A7077(eca2):
MSVCRT._snprintf
MSVCRT.rand
|
sub_9B1801(ef2f):
MSVCRT.strstr
MSVCRT.strchr
MSVCRT.memset
MSVCRT.strncpy
"://"
|
sub_9A9312(efef):
KERNEL32.GetSystemDirectoryA
KERNEL32.GetTempFileNameA
KERNEL32.GetTempPathA
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle
KERNEL32.WinExec
"0"
|
sub_9B2B1F(f04f):
MSVCRT.calloc
MSVCRT.sscanf
MSVCRT.free
"NewRemoteHost"
"NewExternalPort"
"NewProtocol"
"NewInternalPort"
"NewInternalClient"
"NewEnabled"
"1"
"NewPortMappingDescription"
"AddPortMapping"
"NewLeaseDuration"
"0"
"errorCode"
|
sub_9AC0EF(f24f):
MSVCRT.memset
MSVCRT.srand
MSVCRT.rand
KERNEL32.Sleep
WS2_32.socket
WS2_32.ntohs
WS2_32.bind
WS2_32.closesocket
|
sub_9A799A(f293):
MSVCRT.memset
MSVCRT.memcpy
KERNEL32.VirtualProtect
|
sub_9A728D(f38a):
MSVCRT.rand
KERNEL32.GlobalFree
|
sub_9ACBC3(f7e7):
MSVCRT.fseek
MSVCRT.fread
|
sub_9AC334(f7f5):
KERNEL32.InterlockedExchange
KERNEL32.CreateThread
KERNEL32.CloseHandle
KERNEL32.Sleep
|
sub_9A7C20(f88f):
KERNEL32.CreateToolhelp32Snapshot
KERNEL32.Process32First
MSVCRT._stricmp
KERNEL32.Process32Next
KERNEL32.CloseHandle
|
sub_9A7B75(f9a0):
MSVCRT.strlen
KERNEL32.OpenProcess
KERNEL32.VirtualAllocEx
KERNEL32.GetModuleHandleA
KERNEL32.GetProcAddress
KERNEL32.WriteProcessMemory
KERNEL32.CreateRemoteThread
KERNEL32.CloseHandle
"LoadLibraryA"
"kernel32.dll"
|
sub_9A9DB4(fd35):
MSVCRT.memset
MSVCRT.memcpy
|