9173587e3a28436bae2cab33ebe69d59fb11ce5c2cc1d6c5cfad066b84c0b5f3

Sharing

Copy URL Twitter E-mail

General

Target

9173587e3a28436bae2cab33ebe69d59fb11ce5c2cc1d6c5cfad066b84c0b5f3
Size

4.7MB
MD5

1b629f21ad84279551ea9d0e3d93c771
SHA1

e12a0014526315a5ee7daf1a89b98c714e3bac87
SHA256

9173587e3a28436bae2cab33ebe69d59fb11ce5c2cc1d6c5cfad066b84c0b5f3
SHA512

5ff3f551c1005bc7cccc0582da6a84029a93d748126a17e18f185201d47a7bbd74842d510a883671a889326f0fcebc9d24634cbbc09e1b169916d508e248c4cd
SSDEEP

98304:OYvBc3bNEZd87SAHLbS4VqtDS1SuFZkFFYuYb:pBcraZqSEqLaZkFFYl

Score

N/A

Malware Config

Signatures

Files

9173587e3a28436bae2cab33ebe69d59fb11ce5c2cc1d6c5cfad066b84c0b5f3
.exe windows x86

517bc28d1ef52e9f24642fc13b8798d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

htons
connect
closesocket
__WSAFDIsSet
WSAAddressToStringW
WSASendTo
WSAGetLastError
WSASetLastError
ntohs
ntohl
htonl
WSACleanup
getnameinfo
WSARecv
inet_addr
gethostname
accept
WSAIoctl
getsockopt
getsockname
getpeername
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
inet_ntop
WSAStringToAddressW
freeaddrinfo
getaddrinfo
WSASocketW
WSASend
WSARecvFrom
shutdown
listen
ioctlsocket
bind
sendto
recvfrom
gethostbyname
socket
setsockopt
select
recv
inet_ntoa
WSAStartup

wldap32

ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord301
ord133
ord145
ord147

kernel32

ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
ResetEvent
AreFileApisANSI
CopyFileW
CreateDirectoryExW
GetWindowsDirectoryW
DeviceIoControl
SetFileTime
DecodePointer
CloseHandle
RaiseException
GetLastError
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateThread
TlsAlloc
TlsFree
GetLocalTime
LocalFree
FormatMessageA
FormatMessageW
WideCharToMultiByte
CreateDirectoryA
TlsGetValue
GetModuleFileNameA
ReadFile
OutputDebugStringA
CreatePipe
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
GetCurrentProcess
CreateProcessA
OpenProcess
SetLocalTime
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalUnlock
GlobalLock
lstrlenA
GetStartupInfoA
K32EnumProcessModules
K32GetModuleFileNameExA
Sleep
GetCurrentProcessId
GetTickCount
SetLastError
GetCurrentThreadId
CreateFileA
GetFileSize
LoadResource
LockResource
GlobalFree
FindResourceA
VerSetConditionMask
SetCurrentDirectoryA
CreateIoCompletionPort
GetQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
SetEvent
ReleaseMutex
SleepEx
CreateMutexW
CreateEventW
SetWaitableTimer
WaitForMultipleObjects
QueueUserAPC
TerminateThread
TlsSetValue
VerifyVersionInfoA
GetNumaHighestNodeNumber
CreateMutexA
ExitProcess
MultiByteToWideChar
RtlUnwind
SetUnhandledExceptionFilter
FreeLibrary
LoadLibraryExA
SizeofResource
lstrcmpiA
IsDBCSLeadByte
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
GetFileAttributesA
GetFileAttributesExA
GetFileSizeEx
LockFile
RemoveDirectoryA
SetFilePointerEx
UnlockFile
WriteFile
GetTempPathA
GetSystemTimeAsFileTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
MoveFileA
ReplaceFileA
QueryPerformanceFrequency
GetSystemDirectoryW
GetModuleHandleW
LoadLibraryW
QueryPerformanceCounter
MoveFileExW
WaitForSingleObjectEx
CompareFileTime
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
VerifyVersionInfoW
GetSystemTime
SystemTimeToFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SwitchToFiber
DeleteFiber
CreateFiber
FindFirstFileW
FindNextFileW
GetModuleHandleExW
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
CompareStringW
GetCPInfo
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThread
SwitchToThread
DuplicateHandle
TryEnterCriticalSection
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetTimeZoneInformation
IsDBCSLeadByteEx
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualProtect
SetProcessAffinityMask
DeleteTimerQueueTimer
ReleaseSemaphore
InterlockedFlushSList
UnregisterWaitEx
QueryDepthSList
GetCurrentDirectoryA
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetEndOfFile
WaitForMultipleObjectsEx
SetConsoleCtrlHandler
ExitThread
ResumeThread
GetSystemInfo
VirtualQuery
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFileAttributesW
GetConsoleCP
HeapReAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
SetStdHandle
FindFirstFileExW
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
K32GetProcessMemoryInfo
RtlCaptureStackBackTrace
IsValidCodePage

user32

LoadIconA
MonitorFromPoint
GetMessageA
LoadImageA
GetCursorPos
IsDialogMessageA
DestroyIcon
TranslateMessage
TrackPopupMenu
GetSubMenu
DestroyMenu
DestroyWindow
CharNextA
GetProcessWindowStation
DispatchMessageA
LoadMenuA
GetSystemMetrics
GetActiveWindow
DialogBoxParamA
PostMessageA
GetMessagePos
SetWindowLongA
SetWindowTextA
CreateDialogParamA
MoveWindow
ShowWindow
CreateWindowExA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
EnableWindow
SetFocus
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetMonitorInfoA
MonitorFromWindow
GetWindow
GetParent
GetWindowLongA
MapWindowPoints
MessageBoxA
GetWindowRect
GetClientRect
GetDlgItemInt
SetDlgItemInt
GetDlgItem
EndDialog
SetWindowPos
UnregisterClassA
SendMessageA
GetUserObjectInformationW
PeekMessageA
SetMenu
DefWindowProcA
MessageBoxW

advapi32

RegisterEventSourceW
RegQueryInfoKeyW
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptDeriveKey
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
ReportEventW
CryptAcquireContextW
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptSignHashW
CryptEnumProvidersW
DeregisterEventSource

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

OleRun
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

CreateErrorInfo
GetErrorInfo
SetErrorInfo
VarUI4FromStr
VariantChangeType
VariantCopy
VariantInit
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysAllocString
VariantClear
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayGetElement
SysFreeString
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetDim
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData

comctl32

InitCommonControlsEx

mswsock

GetAcceptExSockaddrs
AcceptEx

iphlpapi

GetTcpTable2
SendARP
GetExtendedUdpTable

crypt32

CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertOpenStore
CertFindCertificateInStore

dbghelp

MiniDumpWriteDump

bcrypt

BCryptGenRandom

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 764KB - Virtual size: 763KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

517bc28d1ef52e9f24642fc13b8798d9

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

mswsock

iphlpapi

crypt32

dbghelp

bcrypt

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 764KB - Virtual size: 763KB

.data Size: 47KB - Virtual size: 69KB

.rsrc Size: 377KB - Virtual size: 377KB

.reloc Size: 157KB - Virtual size: 157KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 764KB - Virtual size: 763KB

.data
Size: 47KB - Virtual size: 69KB

.rsrc
Size: 377KB - Virtual size: 377KB

.reloc
Size: 157KB - Virtual size: 157KB