51f4113516ad78c1c0c212398f545fd0dbf6c5d5f34a4da1965148cf5866005f

Sharing

Copy URL Twitter E-mail

General

Target

51f4113516ad78c1c0c212398f545fd0dbf6c5d5f34a4da1965148cf5866005f
Size

161KB
MD5

4c1840d1852d00bc21ca1ed23f512fa0
SHA1

b4d8409953d2aab1d511240a37ca8c7bcecf7d8d
SHA256

51f4113516ad78c1c0c212398f545fd0dbf6c5d5f34a4da1965148cf5866005f
SHA512

3ccf245b22714bb174c3f27ee4ed3bbbe4cc0c815fa2193f0b5723a57a57466573ac2c05262de84972fd488f4f09b0a6c3bbaa4b2f477fe78f3c597ead80f98a
SSDEEP

3072:O1UqeDPECbBYTN6jZ4fReG6NkHqQTtwRc6GCCT/oQXbTlOf/mdQgUfaL:OuqeDPEoBYGkV6NkHq4wpGsYbTi/8Qgd

Score

N/A

Malware Config

Signatures

Files

51f4113516ad78c1c0c212398f545fd0dbf6c5d5f34a4da1965148cf5866005f
.exe windows x86

26ad5e61373998943ddbc30739153e5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GlobalUnlock
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
CreateDirectoryW
GetProcessHeap
SetFileTime
VirtualQueryEx
WriteFile
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
GetFileAttributesW
Thread32Next
ReadFile
GetTimeZoneInformation
CreateFileW
DuplicateHandle
FlushFileBuffers
GlobalLock
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
FindClose
RemoveDirectoryW
FindNextFileW
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
lstrcmpiA
WTSGetActiveConsoleSessionId
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetThreadContext
SetThreadContext
GetDriveTypeW
GetLogicalDrives
MoveFileExW
GetUserDefaultUILanguage
CreateToolhelp32Snapshot
Process32NextW
GetNativeSystemInfo
ResetEvent
TerminateProcess
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
CreateMutexW
GetCurrentThreadId
CreateFileMappingW
GetProcessId
GetCurrentProcessId
OpenEventW
GetFileAttributesExW
VirtualProtect
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetVersionExW
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
SetErrorMode
GetCommandLineW
GetTempPathW
WriteProcessMemory
Process32FirstW
VirtualAllocEx
VirtualFreeEx
OpenProcess
CreateRemoteThread
IsBadReadPtr
CreateProcessW
UnmapViewOfFile
MapViewOfFile
ExitProcess
CreateThread
GetSystemTime
CloseHandle
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetThreadPriority
Sleep
GetCurrentThread
WaitForSingleObject
ExpandEnvironmentStringsW
LocalFree
GetPrivateProfileIntW
LoadLibraryW
GetPrivateProfileStringW
lstrcmpiW
LoadLibraryA
GetProcAddress
MultiByteToWideChar
FreeLibrary

user32

BeginPaint
GetUpdateRect
IntersectRect
GetDCEx
EqualRect
PrintWindow
IsRectEmpty
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
GetDC
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
PeekMessageW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
GetSystemMetrics
CharLowerBuffA
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetWindowLongW
CharUpperW
SetWindowLongW
GetWindowInfo
SendMessageTimeoutW
CharLowerA
RegisterClassExW
GetWindow
DispatchMessageW
CharLowerW
TranslateMessage
GetCursorPos
GetIconInfo
DrawEdge
GetClipboardData
ToUnicode
EndPaint
HiliteMenuItem
RegisterClassW
SendMessageW
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
RegisterClassA
GetShellWindow
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
DefMDIChildProcW
DrawIcon
GetWindowThreadProcessId
FindWindowA
PostMessageW
MapVirtualKeyW
ExitWindowsEx
OpenWindowStationW
GetUserObjectInformationW
SetThreadDesktop
GetKeyboardState

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
GetLengthSid
IsWellKnownSid
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
EqualSid
InitiateSystemShutdownExW

shlwapi

StrStrIW
PathRemoveFileSpecW
PathIsURLW
StrCmpNIW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
PathRenameExtensionW
PathQuoteSpacesW
StrStrIA

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

SetViewportOrgEx
GdiFlush
CreateDIBSection
SetRectRgn
SaveDC
RestoreDC
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
GetDIBits
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

recv
sendto
getsockname
select
getaddrinfo
recvfrom
accept
listen
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
freeaddrinfo
getpeername
WSASend
closesocket
send
WSASetLastError

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetSetOptionA
InternetReadFile
InternetQueryOptionW
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26ad5e61373998943ddbc30739153e5c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 150KB - Virtual size: 149KB

.data Size: 1KB - Virtual size: 9KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 150KB - Virtual size: 149KB

.data
Size: 1KB - Virtual size: 9KB

.reloc
Size: 6KB - Virtual size: 6KB