683442954de824a230b8756716373aa937440554c902f3ba53a38579774a7457

Sharing

Copy URL Twitter E-mail

General

Target

683442954de824a230b8756716373aa937440554c902f3ba53a38579774a7457
Size

1.4MB
MD5

0675aefd893a889a187af5d8c13e8cb0
SHA1

db737b00c7c91f8250a64fd1e76a9dd47544b078
SHA256

683442954de824a230b8756716373aa937440554c902f3ba53a38579774a7457
SHA512

806aad9d33836dde3ec19acb84c0009c8bf2bcf9652b510418840a91487279a0c2691947e90042e8278f38a7064a7fab4f0682e09650b2dd7e657afe5a0a5d35
SSDEEP

24576:lTXTGOwR48AGFmbcvpd+uJAIiNckfYNzlu/bSN4gXSzTD7rV6GliKacgTowxoBYw:lTXTyR48FmbcLGIiKkXTHrV66RgEF

Score

N/A

Malware Config

Signatures

Files

683442954de824a230b8756716373aa937440554c902f3ba53a38579774a7457
.exe windows x86

e80c88198c9f345a7797f7e7b5aa7052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateProcessesW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

urlmon

URLDownloadToFileW

kernel32

RemoveDirectoryW
CopyFileW
GetExitCodeProcess
MoveFileExW
LocalFree
OutputDebugStringW
GetStdHandle
SetEndOfFile
FileTimeToSystemTime
WaitForMultipleObjects
GetCommandLineW
InterlockedDecrement
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
lstrlenW
LCMapStringA
GetConsoleMode
GetStartupInfoW
GetModuleHandleA
GetModuleFileNameA
lstrcmpW
HeapCreate
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
VirtualQuery
GetSystemInfo
VirtualProtect
ExitThread
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlushFileBuffers
FileTimeToLocalFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
LocalAlloc
InitializeCriticalSectionAndSpinCount
UnlockFileEx
LockFileEx
GetACP
SetFilePointerEx
GetEnvironmentVariableW
SetEnvironmentVariableW
TlsFree
TlsAlloc
OpenThread
TlsSetValue
TlsGetValue
GetFileType
lstrcmpA
CreateFileA
GetSystemTimeAsFileTime
FormatMessageW
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
SearchPathW
GetFileSizeEx
InterlockedExchange
WriteFile
CreateEventW
ResetEvent
SetEvent
WaitForSingleObject
GetFileSize
GetFileAttributesW
lstrcpynW
GetDriveTypeW
WaitNamedPipeW
LoadLibraryW
GetCurrentThreadId
OutputDebugStringA
GetModuleHandleW
GetProcAddress
GetSystemTime
GetLocalTime
CreateProcessW
ReleaseMutex
CreateThread
ResumeThread
CreateDirectoryW
lstrlenA
GetWindowsDirectoryW
GetPrivateProfileStringW
GetSystemWindowsDirectoryW
GetFullPathNameW
GetLongPathNameW
GetTickCount
GetFileAttributesExW
ExitProcess
CreateMutexW
Sleep
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetSystemDirectoryW
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
FindClose
ProcessIdToSessionId
GetTempPathW
GetTempFileNameW
DeleteFileW
SetFilePointer
LoadLibraryExW
ReadFile
GetConsoleCP
lstrcmpiW
FreeLibrary
GetVersionExW
GetModuleFileNameW
CreateFileW
DeviceIoControl
InterlockedIncrement
FlushInstructionCache
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
WideCharToMultiByte
GetCurrentProcessId
GetCurrentProcess
OpenProcess
SetLastError
GetLastError
CloseHandle
GetTimeZoneInformation

user32

GetWindowTextLengthW
GetClassInfoW
SetWindowLongW
ShowWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
DestroyWindow
GetFocus
DefWindowProcW
SetWindowRgn
EqualRect
DrawIcon
SetCapture
ReleaseCapture
SetForegroundWindow
ShowWindowAsync
FindWindowW
GetForegroundWindow
SetWindowPos
GetClientRect
GetDlgItem
EnableWindow
BeginPaint
EndPaint
ExitWindowsEx
UnregisterClassA
MessageBoxW
RegisterClassW
WaitForInputIdle
GetActiveWindow
GetWindowLongW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
DrawTextW
RegisterClassExW
GetClassInfoExW
CreateDialogParamW
ClientToScreen
SetActiveWindow
PostQuitMessage
IsDialogMessageW
SetRect
GetSysColor
ReleaseDC
GetDC
SetCursor
LoadCursorW
CopyRect
SetRectEmpty
PtInRect
SystemParametersInfoW
PrivateExtractIconsW
DestroyIcon
LoadStringW
LoadImageW
GetWindowTextW
CheckDlgButton
GetDlgItemTextW
SetDlgItemTextW
IsDlgButtonChecked
DialogBoxParamW
IsRectEmpty
MoveWindow
EndDialog
GetSystemMetrics
SetWindowTextW
BringWindowToTop
FindWindowExW
GetWindowThreadProcessId
OffsetRect
PostMessageW
DrawIconEx
KillTimer
SetTimer
CreateWindowExW
CallWindowProcW
GetCursorPos
GetMessageTime
IsWindow
ScrollWindow
SetFocus
IsWindowVisible
InvalidateRect
ScreenToClient
SendMessageW
InflateRect

gdi32

GetBkColor
CreateSolidBrush
RoundRect
CreatePen
Rectangle
GetObjectW
PatBlt
GetTextColor
BitBlt
CreateCompatibleBitmap
SetViewportOrgEx
CreateCompatibleDC
CreateFontIndirectW
SelectObject
DeleteObject
SetBkColor
ExtTextOutW
SetBkMode
GetStockObject
DeleteDC
GetTextMetricsW
GetTextExtentPointW
MoveToEx
LineTo
SetTextColor
CreateRoundRectRgn

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

CreateProcessAsUserW
AdjustTokenPrivileges
LookupPrivilegeValueW
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
RegQueryValueExA
InitializeSecurityDescriptor
FreeSid
RegSetValueExA
RegOpenKeyA
RegCreateKeyA
RegEnumValueW
RegOpenKeyW
RegCreateKeyW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation
LookupAccountSidW
RegEnumKeyW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
OpenProcessToken
SetSecurityDescriptorDacl

shell32

ord18
SHGetDesktopFolder
ExtractIconExW
SHChangeNotify
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteW
ord190
ord25
ExtractIconW
CommandLineToArgvW
ord155
SHGetFileInfoW
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc

ole32

CoTaskMemRealloc
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
IIDFromString
CreateStreamOnHGlobal
CoUninitialize
OleInitialize
CoCreateInstance
CoInitialize

oleaut32

VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysFreeString
SysStringLen
SysAllocString
GetErrorInfo
VariantInit

shlwapi

PathAppendW
StrChrW
SHSetValueW
StrCmpIW
SHDeleteValueW
SHDeleteValueA
SHGetValueA
PathFindFileNameW
PathFindExtensionW
StrCpyNW
StrStrIW
StrCmpNIW
PathAddBackslashW
PathRemoveFileSpecA
PathCombineA
SHGetValueW
PathRemoveFileSpecW
PathCombineW
PathIsRelativeW
StrRetToBufW
PathFileExistsW
PathIsDirectoryW

comctl32

ImageList_Destroy
ImageList_GetIcon
ImageList_Draw
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ws2_32

ntohl
WSAIoctl
WSASocketW
inet_addr
htonl

psapi

GetModuleFileNameExW
EnumProcesses

iphlpapi

GetAdaptersInfo
GetBestRoute
GetFriendlyIfIndex

wininet

InternetSetOptionA
InternetCrackUrlW
InternetConnectA
InternetOpenA
HttpOpenRequestA
InternetQueryOptionW
InternetReadFile
InternetOpenW
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetCloseHandle
InternetWriteFile
HttpAddRequestHeadersA
InternetSetStatusCallbackA
HttpSendRequestExA
HttpQueryInfoW

rasapi32

RasEnumConnectionsW
RasGetProjectionInfoW
RasGetEntryPropertiesW

gdiplus

GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipAlloc
GdipFree

setupapi

SetupIterateCabinetW

crypt32

CryptMsgOpenToDecode
CryptMsgUpdate
CertCloseStore
CryptMsgClose
CertGetNameStringW
CertGetCertificateContextProperty
CertOpenStore

wintrust

WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

netapi32

Netbios

winmm

timeGetTime

Sections

.text
Size: 748KB - Virtual size: 748KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

lC~
Size: 242KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e80c88198c9f345a7797f7e7b5aa7052

Headers

DLL Characteristics

File Characteristics

Imports

wtsapi32

userenv

urlmon

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

ws2_32

psapi

iphlpapi

wininet

rasapi32

gdiplus

setupapi

crypt32

wintrust

netapi32

winmm

Sections

.text Size: 748KB - Virtual size: 748KB

.rdata Size: 176KB - Virtual size: 175KB

.data Size: 23KB - Virtual size: 44KB

.rsrc Size: 158KB - Virtual size: 158KB

.reloc Size: 65KB - Virtual size: 64KB

lC~ Size: 242KB - Virtual size: 244KB

.text
Size: 748KB - Virtual size: 748KB

.rdata
Size: 176KB - Virtual size: 175KB

.data
Size: 23KB - Virtual size: 44KB

.rsrc
Size: 158KB - Virtual size: 158KB

.reloc
Size: 65KB - Virtual size: 64KB

lC~
Size: 242KB - Virtual size: 244KB