c18c0cc77883a7b17115aff92afa8db633ec57e2a16225fcf4e8b7f2163ce118

Sharing

Copy URL

Twitter E-mail

General

Target

c18c0cc77883a7b17115aff92afa8db633ec57e2a16225fcf4e8b7f2163ce118
Size

124KB
MD5

93cb269e0c8fd9d980c355f1fc6f6d27
SHA1

8d2fe0bed8d3790e1de0826fb5a2cada483308f1
SHA256

c18c0cc77883a7b17115aff92afa8db633ec57e2a16225fcf4e8b7f2163ce118
SHA512

efc921f8e1331a672876fdc89feb0364c84588b65389dcce4cefea7c29bf7b698107a23c26a2977ca462cb7825cfa5e3b4a913afb0d8a2079d5a49ac7b45ff3b
SSDEEP

3072:1pTIt9oZWvGEM0WU3++c1hx0VmVpgyGS++M1tPD23a/5:bTIvGEnNMv1pgA+51tPAK

Score

N/A

Malware Config

Signatures

Files

c18c0cc77883a7b17115aff92afa8db633ec57e2a16225fcf4e8b7f2163ce118
.dll windows x86

238cb5f2deaa053b751e1585a2284b01

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr71

_strcmpi
_strnicmp
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
calloc
_beginthreadex
strtok
wcstombs
atoi
strncat
strncpy
??0exception@@QAE@ABV0@@Z
strrchr
_except_handler3
free
??0exception@@QAE@XZ
??1exception@@UAE@XZ
realloc
malloc
strchr
_CxxThrowException
memmove
strstr
ceil
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z

kernel32

FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
DeleteFileA
GetFileSize
CreateFileA
WriteFile
SetFilePointer
MoveFileA
ReadFile
HeapFree
HeapAlloc
GetProcessHeap
LockResource
LoadResource
CancelIo
FindResourceA
SetLastError
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
OpenProcess
GetLocalTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
DisconnectNamedPipe
TerminateProcess
GetVolumeInformationA
WaitForMultipleObjects
GetStartupInfoA
CreatePipe
GetComputerNameA
GlobalMemoryStatus
GetLastError
GetModuleFileNameA
GetTempPathA
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableA
GetShortPathNameA
DisableThreadLibraryCalls
InitializeCriticalSection
ExitProcess
lstrcmpiA
CopyFileA
ReleaseMutex
GetCommandLineA
InterlockedExchange
FreeConsole
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
lstrcpyA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
GetDiskFreeSpaceExA
GetFileAttributesA
PeekNamedPipe
CreateDirectoryA
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
DeleteCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
CloseHandle
CreateEventA
GetSystemDirectoryA
MultiByteToWideChar
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
ResetEvent
GetSystemInfo
Sleep
SizeofResource
SetFileAttributesA

user32

TranslateMessage
GetMessageA
wsprintfA
CharNextA
GetWindowTextA
GetActiveWindow
GetKeyNameTextA
CallNextHookEx
UnhookWindowsHookEx
LoadCursorA
DestroyCursor
keybd_event
MapVirtualKeyA
SetCapture
DispatchMessageA
ReleaseDC
CreateWindowExA
CloseWindow
PostMessageA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
IsWindow
GetCursorPos
SetRect
GetDesktopWindow
GetDC
OpenDesktopA
GetCursorInfo
SystemParametersInfoA
SendMessageA
BlockInput
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint

gdi32

SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
CreateDIBSection
BitBlt
DeleteObject
DeleteDC

advapi32

AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyA
RegQueryValueExA
GetTokenInformation
LookupAccountSidA
RegisterServiceCtrlHandlerA
StartServiceA
OpenSCManagerA
CreateServiceA
GetFileSecurityA
GetSecurityDescriptorDacl
GetAclInformation
EqualSid
GetAce
SetFileSecurityA
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
RegCloseKey
RegQueryValueA
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
InitializeSecurityDescriptor

shell32

SHGetFileInfoA

winmm

waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
waveInAddBuffer
waveInStop
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveInReset
waveInUnprepareHeader
waveInClose
waveOutReset
waveInStart
waveOutUnprepareHeader
waveOutWrite
waveOutClose

ws2_32

recv
send
WSAIoctl
connect
htons
closesocket
gethostbyname
WSAStartup
socket
gethostname
getsockname
select

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

ICSeqCompressFrameStart
ICOpen
ICSeqCompressFrame
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSendMessage

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetSetOptionA
InternetCloseHandle

netapi32

NetUserGetLocalGroups
NetApiBufferFree

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Exports

Exports

IEHelpSetup
ServiceMain
WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOp
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.text
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

238cb5f2deaa053b751e1585a2284b01

Headers

File Characteristics

Imports

msvcr71

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

msvcp71

imm32

avicap32

msvfw32

wininet

netapi32

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 78KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 960B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 80KB - Virtual size: 78KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 960B

.reloc
Size: 8KB - Virtual size: 7KB