a188096a363e08165349e500ecf4586139d0c2a303a0fc454092e2651912ef04

Sharing

Copy URL Twitter E-mail

General

Target

a188096a363e08165349e500ecf4586139d0c2a303a0fc454092e2651912ef04
Size

1.2MB
MD5

484c57f8a680d15f5020d1a0e08d341d
SHA1

ecbea2fb229d85da1830722fb8ecad3e6d57a839
SHA256

a188096a363e08165349e500ecf4586139d0c2a303a0fc454092e2651912ef04
SHA512

bcb1913d5a0857e65e69989c1ceee8f27afd5fb3dd608586d994d054b714926dc8790809c3cfeb5240b542b9bdf58d4c843ad6eba077824b571110947be7c7dd
SSDEEP

24576:RxgiAu5Ewydq0AmKxppmHpPMD7o1Dd88x/nyYdWO:RxgiAuiwyYmHpk7oFdRxv8O

Score

N/A

Malware Config

Signatures

Files

a188096a363e08165349e500ecf4586139d0c2a303a0fc454092e2651912ef04
.exe windows x86

f9afea8a6c515e9b7305b4154c2363bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipDrawImagePointRectI
GdipDrawLines
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipCreatePen1
GdipSaveImageToFile
GdipDeletePen
GdipSetStringFormatAlign
GdipSaveImageToStream
GdipDeleteGraphics
GdipGetImageEncodersSize
GdipFillRectangleI
GdipGetImageGraphicsContext
GdipMeasureString
GdipLoadImageFromStream
GdipCloneBrush
GdipDrawCurveI
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipSetPenLineJoin
GdipBitmapLockBits
GdipDrawString
GdipDrawPath
GdipFree
GdipClosePathFigure
GdipFillRectangle
GdipDrawRectangle
GdipAddPathLineI
GdipDeleteCustomLineCap
GdipSetPenCustomEndCap
GdipAddPathStringI
GdipGraphicsClear
GdipFillPath
GdipCreateSolidFill
GdipCreateFont
GdipCreateLineBrushFromRectI
GdipSetStringFormatLineAlign
GdipCreatePath
GdipSetSmoothingMode
GdipSetPenBrushFill
GdipDisposeImage
GdipDeletePath
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipAlloc
GdipCreateAdjustableArrowCap
GdipDeleteBrush
GdipBitmapUnlockBits
GdipSetPenStartCap
GdipSetCustomLineCapBaseCap
GdipCloneImage
GdipDrawImageRectRect
GdipCreateFontFamilyFromName
GdipAddPathArcI
GdipGetImageEncoders
GdipGetImageHeight
GdipDeleteFontFamily
GdipCreateStringFormat
GdiplusShutdown
GdiplusStartup
GdipDeleteStringFormat
GdipGetImageWidth

kernel32

GetExitCodeThread
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceFrequency
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
ReadFile
GetModuleFileNameA
SizeofResource
CreateSemaphoreExW
HeapFree
SetLastError
SetPriorityClass
EnterCriticalSection
GetCommandLineW
GetCurrentProcess
ReleaseSemaphore
Wow64DisableWow64FsRedirection
GetModuleHandleExW
ExpandEnvironmentStringsW
TerminateProcess
GetModuleFileNameW
WaitForMultipleObjects
GetUserDefaultUILanguage
LeaveCriticalSection
SetFilePointer
GetTempPathW
CreateMutexW
InitializeCriticalSectionEx
FindResourceA
GetLocaleInfoW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FreeResource
OpenProcess
HeapSize
CreateToolhelp32Snapshot
CreateEventW
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
Process32NextW
OutputDebugStringW
GlobalSize
SetEvent
WaitForSingleObjectEx
LockResource
GlobalAlloc
DeleteFileW
OpenSemaphoreW
Process32FirstW
GlobalFree
HeapReAlloc
CloseHandle
RaiseException
LoadResource
HeapAlloc
GetLocalTime
GetCurrentDirectoryW
DecodePointer
HeapDestroy
GetProcAddress
GlobalLock
CreateMutexExW
LocalFree
MoveFileExW
GetFileSize
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
CopyFileW
WideCharToMultiByte
QueryFullProcessImageNameW
GetTempFileNameW
DebugBreak
CreateFileMappingW
DosDateTimeToFileTime
MapViewOfFile
GlobalUnlock
lstrcmpW
MoveFileW
IsDebuggerPresent
GetTickCount
GetEnvironmentVariableW
GetFileAttributesW
LoadLibraryW
FreeLibrary
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateFileW
LCIDToLocaleName
LoadLibraryExA
EncodePointer
GetLocaleInfoEx
LCMapStringEx
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
UnmapViewOfFile

user32

DestroyCursor
WindowFromPoint
RegisterClassExW
CreatePopupMenu
MessageBeep
SetWindowTextW
UnregisterClassW
GetSystemMetrics
CallNextHookEx
SendMessageW
ScreenToClient
GetIconInfo
CreateWindowExW
EnumChildWindows
GetMenuItemCount
MonitorFromWindow
MessageBoxW
EqualRect
SetWindowPos
IsWindowVisible
GetDC
InflateRect
DestroyWindow
SendMessageTimeoutW
GetMenu
GetWindowRect
FindWindowExW
MonitorFromPoint
PostMessageW
CallWindowProcW
GetKeyState
UnregisterHotKey
AdjustWindowRectEx
DefWindowProcW
GetMenuItemInfoW
GetMessageW
ShowWindow
GetWindowThreadProcessId
GetWindowLongW
GetWindowTextW
BringWindowToTop
TranslateMessage
GetClipboardData
LoadIconW
FindWindowW
LoadCursorW
GetClassNameW
SetWindowsHookExW
SetClipboardData
SetCursor
wsprintfW
SetWindowLongW
GetClientRect
AppendMenuW
GetClassLongW
IsClipboardFormatAvailable
UpdateLayeredWindow
DrawIconEx
GetKeyNameTextW
KillTimer
PostQuitMessage
SystemParametersInfoW
GetClassInfoExW
GetParent
RegisterWindowMessageW
PtInRect
SetForegroundWindow
LoadImageW
InvalidateRect
IsWindow
GetAsyncKeyState
OpenClipboard
DispatchMessageW
SetTimer
GetCursorInfo
DestroyIcon
VkKeyScanW
GetMonitorInfoW
CreateIconIndirect
ClientToScreen
CloseClipboard
EmptyClipboard
PeekMessageW
CountClipboardFormats
TrackPopupMenu
GetDoubleClickTime
AttachThreadInput
RegisterHotKey
GetForegroundWindow
MoveWindow
UnhookWindowsHookEx
SendInput
EnumWindows
GetMessageTime
GetAncestor
SetCursorPos
ReleaseDC
GetCursorPos
DestroyMenu
IsRectEmpty
GetWindowTextLengthW
SetFocus
EndPaint
BeginPaint

gdi32

BitBlt
CreateDIBSection
SelectObject
SetDeviceGammaRamp
CreateCompatibleDC
StretchBlt
GetStockObject
GetDIBits
GetDeviceCaps
DeleteDC
GetObjectW
SetDIBits
DeleteObject
CreateCompatibleBitmap
CreateFontIndirectW

comdlg32

GetSaveFileNameW

advapi32

RegGetValueW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

shell32

Shell_NotifyIconW
ord190
ShellExecuteW
CommandLineToArgvW
SHOpenFolderAndSelectItems
ord155
ShellExecuteA
ord171
SHEmptyRecycleBinW
ShellExecuteExW
GetCurrentProcessExplicitAppUserModelID
ord680
SHGetPathFromIDListW

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

dwmapi

DwmRegisterThumbnail
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail

winmm

mciSendStringW
mmioInstallIOProcW

imm32

ImmGetDefaultIMEWnd

shlwapi

PathRenameExtensionW
ord213
PathCanonicalizeW
PathFileExistsW
ord184
ord176
PathRemoveFileSpecW
PathFindFileNameW
ord214
ord12
PathQuoteSpacesW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ws2_32

WSAGetLastError
setsockopt
ioctlsocket
sendto
getsockopt
recv
recvfrom
socket
send
getsockname
WSAStartup
listen
select
closesocket
bind
accept
__WSAFDIsSet
ntohs

wininet

InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
InternetReadFile
InternetSetOptionA
InternetCrackUrlA
HttpOpenRequestA
InternetQueryOptionA
InternetQueryDataAvailable
HttpQueryInfoW

msvcrt

strtol
_time64
atoi
frexp
wcslen
pow
sqrt
wcscmp
isdigit
towupper
strncmp
strerror
wcstol
_ultow_s
_callnewh
_initterm
_initterm_e
_set_fmode
__p__commode
_controlfp_s
abort
__pctype_func
isupper
___lc_codepage_func
_wcsdup
___mb_cur_max_func
islower
__strncnt
isspace
strcpy_s
strnlen
_mbtowc_l
wctomb_s
_iob
_strtoi64
?terminate@@YAXXZ
_strtoui64
__wgetmainargs
_msize
_XcptFilter
__set_app_type
_wcmdln
_lock
_unlock
?_set_new_mode@@YAHH@Z
___lc_handle_func
_isatty
fflush
_fileno
_CIlog10
_clearfp
_wfopen
_errno
wcscat
atan2
isalnum
isxdigit
_memicmp
labs
fabs
wcscpy
strcspn
rand
_gmtime64
wcscpy_s
tolower
_beginthreadex
strtod
_wcsicmp
towlower
strcpy
floor
abs
srand
ceil
wcsnlen
clock
realloc
strcmp
calloc
_rotl64
fclose
malloc
free
strlen
memcpy
_except_handler4_common
_amsg_exit
_CxxThrowException
wcsrchr
strrchr
memchr
wcsstr
__CxxFrameHandler3
memmove
memcmp
memset
strchr

Sections

.text
Size: 638KB - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 334KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f9afea8a6c515e9b7305b4154c2363bf

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

dwmapi

winmm

imm32

shlwapi

version

ws2_32

wininet

msvcrt

Sections

.text Size: 638KB - Virtual size: 638KB

.rdata Size: 334KB - Virtual size: 333KB

.data Size: 4KB - Virtual size: 17KB

.rsrc Size: 196KB - Virtual size: 196KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 638KB - Virtual size: 638KB

.rdata
Size: 334KB - Virtual size: 333KB

.data
Size: 4KB - Virtual size: 17KB

.rsrc
Size: 196KB - Virtual size: 196KB

.reloc
Size: 31KB - Virtual size: 30KB