1ca5139bdba30a35ecdea27319e20df6cc8318837eeae10b78cc36b33df38df6

Sharing

Copy URL Twitter E-mail

General

Target

1ca5139bdba30a35ecdea27319e20df6cc8318837eeae10b78cc36b33df38df6
Size

578KB
MD5

062047d00c998e0d2b4bca903c231420
SHA1

1fa5dbc8a9eddf9dce43c15cd3b7d626c117a528
SHA256

1ca5139bdba30a35ecdea27319e20df6cc8318837eeae10b78cc36b33df38df6
SHA512

f52b063ecbd7e0591ff3b8e4e5888f1b9a8daebdd3359a2d153801b74a0d0b6a15d7de0920b6d7d3eed889102a7b4d7d76f542f3bde07770efe24335c93812b1
SSDEEP

12288:5zOBoP2lgjZgrSmf63N7BMamDZ/YNMTZvg9/uebzm9TVv:5zOBVogrSmS9dyxYNmZo9WYm9TR

Score

N/A

Malware Config

Signatures

Files

1ca5139bdba30a35ecdea27319e20df6cc8318837eeae10b78cc36b33df38df6
.exe windows x86

163f924bbdd8a07c19c534eb12f3c21e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libcurl

curl_easy_setopt
curl_easy_perform
curl_easy_getinfo
curl_easy_cleanup
curl_easy_init

kernel32

MulDiv
GlobalLock
GlobalUnlock
CreateThread
GetFileAttributesW
CreateEventW
CreateJobObjectW
SetInformationJobObject
WideCharToMultiByte
GetModuleHandleW
IsBadWritePtr
MultiByteToWideChar
LoadResource
SizeofResource
FindResourceW
SetEvent
lstrcmpiW
LoadLibraryExW
GetTickCount
GetCommandLineW
LocalFree
CreateFileW
FlushFileBuffers
GetFileSizeEx
ReadFile
WriteFile
SetEndOfFile
DuplicateHandle
InterlockedCompareExchange
Sleep
CreateMutexW
WaitForSingleObject
ReleaseMutex
lstrcpyW
SearchPathW
CreateProcessW
SetUnhandledExceptionFilter
GetModuleHandleExW
CreateFileMappingW
GetFileSize
MapViewOfFile
UnmapViewOfFile
TerminateProcess
ExitProcess
WaitForMultipleObjects
GetVersionExW
lstrcmpW
InterlockedExchange
GetFileAttributesExW
GetModuleFileNameA
InterlockedDecrement
IsDebuggerPresent
AssignProcessToJobObject
ResumeThread
GetProcessTimes
QueryPerformanceCounter
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
IsBadStringPtrW
CreateFileA
SetFilePointer
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
HeapAlloc
UnhandledExceptionFilter
HeapFree
GetStartupInfoW
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
GetConsoleCP
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
GetModuleFileNameW
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetTimeZoneInformation
LoadLibraryA
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
GlobalAlloc
GetCurrentProcessId
GetLocalTime
CloseHandle
GetLastError
SetLastError
GlobalAddAtomW
FreeLibrary
GetProcAddress
LoadLibraryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
IsProcessorFeaturePresent
GetModuleHandleA

user32

SetParent
KillTimer
SetTimer
GetWindowRect
RemovePropW
SetPropW
GetPropW
CallWindowProcW
LoadCursorW
RegisterWindowMessageW
ReleaseCapture
CreateAcceleratorTableW
IsZoomed
SystemParametersInfoW
IsWindowVisible
SetLayeredWindowAttributes
UpdateLayeredWindow
MapWindowPoints
UpdateWindow
UnhookWindowsHookEx
GetDesktopWindow
PostQuitMessage
GetFocus
DestroyAcceleratorTable
GetSysColor
GetClassNameW
IsWindow
GetDlgItem
GetParent
IsChild
GetWindow
SetFocus
SetCapture
RedrawWindow
InvalidateRgn
GetLastInputInfo
DrawTextW
GetSystemMetrics
RegisterHotKey
UnregisterHotKey
GetMessageW
TranslateMessage
DispatchMessageW
MessageBoxW
SendMessageTimeoutW
ReplyMessage
IsIconic
AllowSetForegroundWindow
SetForegroundWindow
DisableProcessWindowsGhosting
FillRect
DestroyIcon
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SendMessageW
CharNextW
WaitForInputIdle
InvalidateRect
TrackMouseEvent
GetCursorPos
EndPaint
BeginPaint
SetCursor
GetWindowThreadProcessId
FindWindowExW
SetWindowPos
PostMessageW
ShowWindow
RegisterClassExW
LoadImageW
UnregisterClassW
SetWindowLongW
GetWindowLongW
CreateWindowExW
DestroyWindow
DefWindowProcW
UnregisterClassA
GetClassInfoExW

gdi32

SetTextAlign
SetBkMode
SetTextColor
SetGraphicsMode
GdiFlush
GdiAlphaBlend
GetObjectType
SetMapMode
EnumFontFamiliesExW
GetCurrentObject
CreateFontIndirectW
CreateDIBSection
GetObjectW
GetStockObject
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
DeleteObject
SetBkColor
GetDeviceCaps
SelectObject

advapi32

RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
CreateProcessAsUserW

shell32

ord680
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CreateStreamOnHGlobal
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleInitialize
OleUninitialize
CoTaskMemRealloc
CLSIDFromString

oleaut32

LoadRegTypeLi
SysFreeString
VarUI4FromStr
OleCreateFontIndirect
SysAllocStringLen
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysAllocString

shlwapi

StrToIntExW
StrNCatW
StrStrIW
StrToInt64ExW
StrCmpIW
wnsprintfW
PathFileExistsW
PathAppendW
wnsprintfA
StrCpyNW

winmm

timeGetTime

imm32

ImmAssociateContext

dbghelp

MakeSureDirectoryPathExists

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSACleanup
WSAStartup

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

163f924bbdd8a07c19c534eb12f3c21e

Headers

DLL Characteristics

File Characteristics

Imports

libcurl

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

winmm

imm32

dbghelp

version

ws2_32

userenv

Sections

.text Size: 374KB - Virtual size: 374KB

.rdata Size: 84KB - Virtual size: 83KB

.data Size: 14KB - Virtual size: 29KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 31KB - Virtual size: 30KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 374KB - Virtual size: 374KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 14KB - Virtual size: 29KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 31KB - Virtual size: 30KB

.rmnet
Size: 56KB - Virtual size: 60KB