4ab3bdd85cec7f404a9687ad3a7a677f615812e667a163b4d544781a625a736e

Sharing

Copy URL

Twitter E-mail

General

Target

4ab3bdd85cec7f404a9687ad3a7a677f615812e667a163b4d544781a625a736e
Size

251KB
MD5

6ecd8907359e28c6486ea26e6b614e80
SHA1

4ba78789c9173ec00805c8bd81afcf328bfaa9eb
SHA256

4ab3bdd85cec7f404a9687ad3a7a677f615812e667a163b4d544781a625a736e
SHA512

e674b98d135eeb1193a32fbb206bd63036e03984a3e51ef19bddbb664209d63d2c1d93022c4f1352fd31edbdaa9f9ef026b39ed08dc26e6090cd7b6322b92c38
SSDEEP

6144:pY9eF7vHJNXoJk1LGHHdHaNJLBRITgZl5AHWj3BchNERF:K94jHj+k1LWQNOgZ/jGgL

Score

N/A

Malware Config

Signatures

Files

4ab3bdd85cec7f404a9687ad3a7a677f615812e667a163b4d544781a625a736e
.exe windows x86

782baa30297a079fd87cd912bd6e16e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathStripPathW
PathRemoveFileSpecW
StrTrimW
PathUnquoteSpacesW
PathRemoveExtensionW
PathAppendW
PathFindFileNameW
PathFileExistsW
PathRemoveBlanksW
PathRenameExtensionW

iphlpapi

NotifyAddrChange

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

GetSidSubAuthorityCount
GetAce
RegOpenKeyExW
RegDeleteValueW
SetSecurityDescriptorDacl
CryptCreateHash
CryptHashData
StartServiceCtrlDispatcherW
OpenSCManagerW
RegisterServiceCtrlHandlerExW
OpenServiceW
RegEnumValueW
GetSidIdentifierAuthority
GetUserNameW
SetServiceStatus
GetSidSubAuthority
RegOpenKeyW
RegSetValueExW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
QueryServiceStatus
CryptReleaseContext
SetEntriesInAclW
AddAccessAllowedAce
DuplicateTokenEx
RegEnumKeyW
GetLengthSid
AllocateAndInitializeSid
GetNamedSecurityInfoW
OpenProcessToken
CloseServiceHandle
StartServiceW
QueryServiceStatusEx
RegQueryValueExW
AddAce
RegCloseKey
CryptDestroyHash
RegCreateKeyExW
ImpersonateLoggedOnUser
GetAclInformation
CryptGetHashParam
RevertToSelf
InitializeAcl
CryptAcquireContextW
FreeSid

ws2_32

inet_ntoa
getservbyport
WSACleanup
WSAGetLastError
inet_addr
WSASetLastError
getservbyname
WSACloseEvent
gethostbyaddr
gethostbyname
ntohs
htons
WSAResetEvent
WSAStartup
htonl
WSACreateEvent

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHCreateDirectoryExW

kernel32

GetCurrentThreadId
RaiseException
DebugBreak
EnterCriticalSection
LoadResource
CreateFileMappingW
GetQueuedCompletionStatus
OpenFileMappingW
ResetEvent
FindNextFileW
ExpandEnvironmentStringsW
CreateIoCompletionPort
GetLongPathNameW
OutputDebugStringA
HeapFree
SetUnhandledExceptionFilter
LocalFree
IsDebuggerPresent
GetDriveTypeW
LeaveCriticalSection
GetSystemTime
ReadFile
GetProcessHeap
CreateDirectoryW
GlobalLock
GetProcessVersion
VirtualQuery
GetFileAttributesExW
GetProcessTimes
ReadProcessMemory
CreateWaitableTimerW
PostQueuedCompletionStatus
CreateFileW
CreateToolhelp32Snapshot
SetLastError
DeleteCriticalSection
FreeLibrary
WaitForMultipleObjects
LocalAlloc
GlobalMemoryStatus
OpenMutexW
HeapDestroy
GetFileSizeEx
FindClose
GetFileSize
CopyFileW
GetVolumeNameForVolumeMountPointW
SetWaitableTimer
GetFileInformationByHandle
FileTimeToDosDateTime
DeviceIoControl
SizeofResource
HeapSize
ProcessIdToSessionId
DeleteFileW
GlobalAlloc
WaitForMultipleObjectsEx
lstrcmpiW
FindResourceExW
FindResourceW
LockResource
Module32FirstW
GetSystemTimeAsFileTime
GlobalUnlock
GlobalFree
FindFirstFileW
CreateEventW
WideCharToMultiByte
GetLocalTime
GetSystemDirectoryA
MapViewOfFile
CreateMutexW
GetShortPathNameW
SetFilePointer
SetEndOfFile
FileTimeToSystemTime
GetModuleHandleW
HeapReAlloc
GetOverlappedResult
CreateProcessW
SignalObjectAndWait
OpenEventW
HeapAlloc
GetSystemInfo
UnhandledExceptionFilter
UnmapViewOfFile
OpenProcess
ReleaseMutex
MoveFileW
GetSystemDirectoryW
CreateFileA
WriteFile
WaitForSingleObject
GetTempPathW
InitializeCriticalSectionAndSpinCount
CloseHandle
Module32NextW
SystemTimeToFileTime
VirtualAlloc

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW

mpr

WNetGetConnectionW

rasapi32

RasEnumConnectionsW
RasGetProjectionInfoW
RasGetEntryPropertiesW

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses

cabinet

ord13
ord10
ord11
ord14

oleaut32

VariantClear
VariantInit

user32

wsprintfW
GetSystemMetrics

odbccp32

SQLGetPrivateProfileString
SelectTransDlg
SQLCreateDataSourceEx
SQLInstallDriverEx
SQLCreateDataSourceW
SQLRemoveTranslatorW
SQLInstallTranslatorExW
SQLWritePrivateProfileString
SQLGetConfigMode
SQLRemoveTranslator

cryptdlg

DecodeRecipientID
DecodeAttrSequence

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.NANk
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Fayn
Size: 1024B - Virtual size: 677B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mo
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.oNJpL
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eXMtpA
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.XZjgvm
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 212KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FlgaTc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SmopNO
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.D
Size: 512B - Virtual size: 321B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

782baa30297a079fd87cd912bd6e16e1

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

iphlpapi

version

advapi32

ws2_32

shell32

kernel32

ole32

wtsapi32

mpr

rasapi32

psapi

cabinet

oleaut32

user32

odbccp32

cryptdlg

Sections

.text Size: 18KB - Virtual size: 18KB

.NANk Size: 1024B - Virtual size: 1KB

.Fayn Size: 1024B - Virtual size: 677B

.rdata Size: 6KB - Virtual size: 6KB

.mo Size: 2KB - Virtual size: 2KB

.oNJpL Size: 1KB - Virtual size: 1KB

.eXMtpA Size: 1024B - Virtual size: 1KB

.XZjgvm Size: 1024B - Virtual size: 1KB

.data Size: 212KB - Virtual size: 280KB

.FlgaTc Size: 2KB - Virtual size: 2KB

.SmopNO Size: 2KB - Virtual size: 2KB

.D Size: 512B - Virtual size: 321B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 18KB

.NANk
Size: 1024B - Virtual size: 1KB

.Fayn
Size: 1024B - Virtual size: 677B

.rdata
Size: 6KB - Virtual size: 6KB

.mo
Size: 2KB - Virtual size: 2KB

.oNJpL
Size: 1KB - Virtual size: 1KB

.eXMtpA
Size: 1024B - Virtual size: 1KB

.XZjgvm
Size: 1024B - Virtual size: 1KB

.data
Size: 212KB - Virtual size: 280KB

.FlgaTc
Size: 2KB - Virtual size: 2KB

.SmopNO
Size: 2KB - Virtual size: 2KB

.D
Size: 512B - Virtual size: 321B

.rsrc
Size: 1KB - Virtual size: 1KB