1b3912ff4c53b28e85e64e7dfd97838a139c0e251b422f161beb9f8bb0bbd85e

Sharing

Copy URL

Twitter E-mail

General

Target

1b3912ff4c53b28e85e64e7dfd97838a139c0e251b422f161beb9f8bb0bbd85e
Size

274KB
MD5

71160534ba5796665a183dec43528530
SHA1

cf82c7906ec3ffe6c69fc762200a1484d3e2b611
SHA256

1b3912ff4c53b28e85e64e7dfd97838a139c0e251b422f161beb9f8bb0bbd85e
SHA512

d714dfa9e67b48e0919bbae3b562d5a137a34ef77240a5f9e10200026e1f73df9e3297da902af09857dfe805cb0dd56efac1e4f01e4fd970fd45cc06771140f2
SSDEEP

6144:eqEsnxk+vKwDq9GUf6+sm/ltOF4JlbDtQQoLQyR2BUru/sz:QsxnvrslFbrbBQ/8ygUruUz

Score

N/A

Malware Config

Signatures

Files

1b3912ff4c53b28e85e64e7dfd97838a139c0e251b422f161beb9f8bb0bbd85e
.exe windows x86

c16c77f47d6ce7a7e9227285c2b9c340

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
GetProcAddress
FlushInstructionCache
FindResourceW
LeaveCriticalSection
GetModuleFileNameW
lstrlenA
GetProcessHeap
GetCurrentProcess
FreeLibrary
DeleteCriticalSection
InterlockedIncrement
lstrcmpiW
InterlockedDecrement
lstrcatW
lstrcpyW
lstrlenW
GetEnvironmentStringsA
HeapDestroy
LoadResource
VirtualFree
LoadLibraryA
MultiByteToWideChar
SetLastError
GetSystemInfo
SetUnhandledExceptionFilter
GetCurrentProcessId
lstrcpynW
GetTickCount
GetSystemTimeAsFileTime
SizeofResource
FormatMessageW
LocalFree
GetLastError
HeapFree
QueryPerformanceCounter
EnterCriticalSection
GetUserDefaultLCID
HeapAlloc

untfs

FormatEx
Chkdsk
Extend
ChkdskEx
Recover
Format

rpcrt4

NdrCStdStubBuffer_Release
NdrDllGetClassObject
CStdStubBuffer_AddRef
IUnknown_AddRef_Proxy
NdrOleFree
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrOleAllocate
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrDllRegisterProxy
NdrDllCanUnloadNow
IUnknown_Release_Proxy

user32

SetDlgItemTextW
MapWindowPoints
CharNextW
LoadImageW
CreateDialogParamW
SetWindowTextW
SetFocus
EndDialog
SendMessageW
SystemParametersInfoW
SetWindowPos
ShowWindow
GetDlgItem
GetDialogBaseUnits
DialogBoxParamW
GetWindow
EnableWindow
CopyRect
SendDlgItemMessageW
DestroyWindow
GetWindowRect
GetSystemMetrics
GetDlgItemTextW
GetWindowLongW
MessageBoxW
LoadStringW
GetClientRect
GetParent
DrawTextW
SetWindowLongW

advapi32

RegSetValueExW
RegisterTraceGuidsW
RegDeleteValueW
UnregisterTraceGuids
GetTraceLoggerHandle
RegDeleteKeyW
TraceMessage
GetTraceEnableLevel
RegEnumKeyExW
RegQueryInfoKeyW
GetTraceEnableFlags
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

netshell

HrGetIconFromMediaType

msvcrt

wcscat
??3@YAXPAX@Z
_adjust_fdiv
malloc
??2@YAPAXI@Z
wcslen
swprintf
wcsncpy
_except_handler3
__CxxFrameHandler
?terminate@@YAXXZ
realloc
_initterm
??1type_info@@UAE@XZ
free
wcscmp

ole32

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc

shell32

ShellExecuteW
SHGetFolderPathW

gdi32

SetBkMode

Sections

text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 650B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c16c77f47d6ce7a7e9227285c2b9c340

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

untfs

rpcrt4

user32

advapi32

netshell

msvcrt

ole32

shell32

gdi32

Sections

text Size: 86KB - Virtual size: 86KB

.rdata Size: 184KB - Virtual size: 184KB

.rsrc Size: 1024B - Virtual size: 650B

text
Size: 86KB - Virtual size: 86KB

.rdata
Size: 184KB - Virtual size: 184KB

.rsrc
Size: 1024B - Virtual size: 650B