General
-
Target
5386b37a99553aab5c166fd0ebac5f151a3ab6dbaec8103f7200cc62e04b0bb2.bin
-
Size
541KB
-
MD5
a8693b7b15875b78f9a3fd9b472274ca
-
SHA1
0a3fb1285f9373c010631448048866621964860a
-
SHA256
5386b37a99553aab5c166fd0ebac5f151a3ab6dbaec8103f7200cc62e04b0bb2
-
SHA512
c13380f136b362c94f8efa595900e60759f8382473d1edcc75b2d7ba01dfff7de7ce4bb31807d5febbda2fd5291b7f18ebc41bb05f98b175f96909aa3849da6c
-
SSDEEP
12288:4rt3gax6SO1MqYudTwHijAJweN4O9afTXQKYD665x3/1:4rtrVUguwkAnyOkk9D665P
Malware Config
Extracted
vidar
24.3
237
http://yukondeltas.com/
-
profile_id
237
Files
-
5386b37a99553aab5c166fd0ebac5f151a3ab6dbaec8103f7200cc62e04b0bb2.bin.exe windows x86
89bced107628b72dfff4abd2f7c24875
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
CloseHandle
WriteFile
CreateFileA
MultiByteToWideChar
ReadFile
GetFileSize
GetVersionExA
LocalAlloc
GetFileSizeEx
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
FreeLibrary
GetPrivateProfileSectionNamesA
lstrcatA
GetFileAttributesW
InitializeCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
AreFileApisANSI
SetFilePointer
SetEndOfFile
FlushFileBuffers
UnlockFile
LockFile
LockFileEx
UnlockFileEx
GetFileAttributesA
GetFileAttributesExW
GetLastError
QueryPerformanceCounter
GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetDriveTypeA
GetTempPathA
GetTempPathW
FormatMessageA
FormatMessageW
GetFullPathNameA
GetFullPathNameW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
CreateFileW
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetComputerNameA
IsWow64Process
GetCurrentProcess
GlobalMemoryStatus
GetModuleHandleA
GetUserDefaultLocaleName
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
GetLocaleInfoA
GetFileInformationByHandle
SystemTimeToFileTime
GetLocalTime
CompareStringW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
GetStringTypeW
GetModuleFileNameA
CreateDirectoryA
SetCurrentDirectoryA
GetCurrentProcessId
Sleep
DeleteFileA
ExitProcess
LoadLibraryW
GetLogicalDriveStringsA
CreateDirectoryW
CopyFileW
LocalFree
lstrcpyW
lstrcatW
FindFirstFileW
lstrcmpW
DeleteFileW
FindNextFileW
FindClose
HeapFree
GetProcessHeap
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
HeapAlloc
WideCharToMultiByte
UnmapViewOfFile
GetACP
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
HeapCreate
GetModuleFileNameW
GetStdHandle
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
RtlUnwind
RaiseException
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
WriteConsoleW
user32
GetSystemMetrics
wsprintfA
CharToOemA
EnumDisplayDevicesW
GetDC
ReleaseDC
GetKeyboardLayoutList
GetDesktopWindow
gdi32
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateDCA
GetDeviceCaps
CreateCompatibleDC
advapi32
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
GetUserNameA
GetCurrentHwProfileA
RegOpenKeyExW
RegGetValueW
RegCloseKey
RegGetValueA
shell32
SHGetFolderPathA
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
shlwapi
PathMatchSpecW
crypt32
CryptStringToBinaryA
CryptUnprotectData
psapi
GetModuleFileNameExA
EnumProcessModules
GetModuleBaseNameA
wininet
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetSetFilePointer
InternetReadFile
HttpQueryInfoA
HttpAddRequestHeadersA
InternetSetOptionA
InternetOpenA
InternetOpenUrlA
gdiplus
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipAlloc
GdipGetImageEncodersSize
GdipFree
bcrypt
BCryptDecrypt
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptOpenAlgorithmProvider
Sections
.text Size: 452KB - Virtual size: 452KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE