209883efc87dd540885bdddeaacd1e43081312c41c9660fb919a54909e6d5afc

Sharing

Copy URL

Twitter E-mail

General

Target

209883efc87dd540885bdddeaacd1e43081312c41c9660fb919a54909e6d5afc
Size

160KB
MD5

1064c5400440bef812723c61a15346ce
SHA1

efd4e61d02bd552b4e28b1a9ca35d9a5dd73cf33
SHA256

209883efc87dd540885bdddeaacd1e43081312c41c9660fb919a54909e6d5afc
SHA512

39003bd88f01ba0049129e70d1b8aa52e12593fea3cbda76caba276b935468fd0e0e4c6e79267c244780c3da91004c6fa5f99fdc41cf18124d4f2e70e4590fe9
SSDEEP

1536:GIkZSaSMbjWECui6igebSbaMf0XGxxHNaGI7je7CjVZd9yB2Giw5jmbGqfKuRp99:GIQxlCg5/MXca7jCCjVL9uWGqfKCL9

Score

N/A

Malware Config

Signatures

Files

209883efc87dd540885bdddeaacd1e43081312c41c9660fb919a54909e6d5afc
.dll windows x86

216bd969a4fbc35db82b9d8860443b08

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getsockname
ntohs
inet_ntoa
shutdown
closesocket
WSAGetLastError
getpeername
WSCEnumProtocols

imagehlp

ImageDirectoryEntryToData

mfc42

ord1997
ord823
ord800
ord537
ord4277
ord5683
ord535
ord6877
ord2764
ord860
ord924
ord540
ord4202
ord665
ord2818
ord1979
ord3318
ord5186
ord354
ord6385
ord941
ord858
ord6392
ord923
ord939
ord533
ord5194
ord6407
ord541
ord798
ord5856
ord5861
ord801
ord825

msvcrt

memcmp
__CxxFrameHandler
memset
_except_handler3
malloc
_strlwr
_adjust_fdiv
_initterm
_onexit
__dllonexit
strcmp
rand
strcat
free
fopen
fclose
memcpy
wcstombs
strcpy
_local_unwind2
strlen
time
srand

kernel32

WaitForSingleObject
ResetEvent
SetLastError
TlsSetValue
GetWindowsDirectoryA
GetLongPathNameA
TlsGetValue
GetSystemDirectoryA
GetFileSize
ReadFile
WriteFile
OpenMutexA
GetLastError
GetQueuedCompletionStatus
WaitForSingleObjectEx
CreateIoCompletionPort
CreateSemaphoreA
GetSystemInfo
GetVersionExA
PostQueuedCompletionStatus
ReleaseSemaphore
ExpandEnvironmentStringsA
FreeLibrary
TlsAlloc
TlsFree
OpenFileMappingA
GetModuleFileNameA
lstrcmpA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
lstrcpyA
lstrlenA
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
lstrcmpiA
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
CreateThread
Sleep
LoadLibraryA
FreeLibraryAndExitThread
OpenFile

user32

SetWindowsHookExA
PostThreadMessageA
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
SetWindowLongA
DispatchMessageA
TranslateMessage
GetMessageA
DefWindowProcA
GetWindowLongA
DestroyWindow

gdi32

GetStockObject

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

Exports

Exports

Hp8x6
WSPStartup

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

216bd969a4fbc35db82b9d8860443b08

Headers

File Characteristics

Imports

ws2_32

imagehlp

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 72KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 72KB - Virtual size: 72KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB