d45954e980b46ab1d0f920f9c6fd40da164d651a638beb5e10541fa35124548e

Sharing

Copy URL Twitter E-mail

General

Target

d45954e980b46ab1d0f920f9c6fd40da164d651a638beb5e10541fa35124548e
Size

323KB
MD5

6c23c1c41e9f69fd9dd0e21263458ced
SHA1

7c0786bed651f91239382eb74eae92cc06f0573a
SHA256

d45954e980b46ab1d0f920f9c6fd40da164d651a638beb5e10541fa35124548e
SHA512

f2a4def13787045732c1ffa6e43da2ce13b18e3bcb8ef6eb09691a1c8103fbac9ad49c102fca3ea51baed9e9701a95ddd155ffc22bd238868d9974bb5fc191d0
SSDEEP

6144:HOr6+HbdRH/3FYYLZZoANLYOZEOHHrpm1XUZLxEZEOHHrpm1XUZLxaLb8iyn+:HOe+ZRH/VYin2StLpm1EwtLpm1EuLbr

Score

N/A

Malware Config

Signatures

Files

d45954e980b46ab1d0f920f9c6fd40da164d651a638beb5e10541fa35124548e
.exe windows x86

973397171891283c9e4508d41746419d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCloseKey

kernel32

GetNativeSystemInfo
GetPhysicallyInstalledSystemMemory
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
SetFilePointer
CreateFileW
ReadFile
GetLastError
CreateDirectoryExW
GetSystemWow64DirectoryW
SetCurrentDirectoryW
GetComputerNameW
FreeLibrary
EnterCriticalSection
LoadLibraryW
GetFileSize
CreateEventW
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentDirectoryW
GetCommandLineW
RegisterApplicationRestart
HeapSetInformation
MultiByteToWideChar
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateThread
ResetEvent
DeleteCriticalSection
SetEvent
TerminateThread
CloseHandle
GetTempPathW
GetTickCount
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
LocalAlloc
InitializeCriticalSection
WaitForSingleObject
GetVersionExW
DnsHostnameToComputerNameW
LocalFree
lstrlenW
LeaveCriticalSection
FormatMessageW
UnhandledExceptionFilter

gdi32

CreateSolidBrush
GetObjectW
CreateFontIndirectW
TextOutW
EndPage
EndDoc
StartPage
StartDocW
GetTextExtentPoint32W
GetDeviceCaps
CreateFontW
SetTextColor

user32

SetClassLongW
SetRect
BeginPaint
GetSysColor
FillRect
EndPaint
SetFocus
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetSubMenu
SetMenuItemInfoW
GetFocus
UpdateWindow
ScreenToClient
CopyRect
GetDCEx
DrawFocusRect
ReleaseDC
PtInRect
SetCursor
ReleaseCapture
LoadIconW
SetCapture
GetClientRect
IsWindowEnabled
RedrawWindow
SetTimer
EndDialog
GetWindowTextW
GetDlgItem
SendMessageW
EnableWindow
SetWindowTextW
CheckRadioButton
SetDlgItemTextW
IsDlgButtonChecked
LoadStringW
KillTimer
DialogBoxParamW
PostMessageW
MessageBoxW
SetWindowPlacement
SystemParametersInfoW
CheckDlgButton
InflateRect
OffsetRect
MoveWindow
LoadAcceleratorsW
SetMenu
GetClipboardData
LoadMenuW
IsWindowVisible
IsClipboardFormatAvailable
PostQuitMessage
DestroyAcceleratorTable
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
CreateDialogParamW
LoadCursorW
ShowWindow
GetWindowRect
InvalidateRect

mfc42u

ord6565
ord826
ord269
ord1173
ord1240
ord1571
ord600
ord6867
ord2559
ord5790
ord6168
ord5871
ord5785
ord640
ord6921
ord6919
ord5781
ord2755
ord5597
ord6563
ord2757
ord5618
ord802
ord542
ord394
ord698
ord4182
ord5588
ord911
ord396
ord860
ord323
ord1633
ord6466
ord2442
ord825
ord861
ord858
ord5568
ord2910
ord800
ord540
ord2606
ord538
ord4124
ord913
ord1165
ord535
ord4155
ord823
ord922
ord5706
ord2756
ord1594
ord2810
ord940
ord4184
ord6278
ord941
ord398
ord700
ord2809
ord501
ord909
ord773
ord696
ord5586
ord3430
ord5596
ord1083
ord4180
ord5617
ord998
ord2819
ord6928
ord1184
ord834
ord6218
ord6279
ord2768
ord5852
ord4197
ord925
ord927
ord2805
ord4199
ord3432
ord3658
ord349
ord3608
ord3121
ord5647
ord2385
ord1560
ord537
ord1172
ord3621
ord2406
ord268
ord3614
ord1634
ord352
ord942
ord2813
ord3806
ord2776

msvcrt

_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_controlfp
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_vsnwprintf
__CxxFrameHandler3
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_wcsicoll
_wtoi
_wcsicmp
memcpy
_purecall
malloc
swprintf_s
wcstol
_callnewh
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
wcsncpy_s
_wtol
_ftol2_sse
wcstod
_wcsupr
free
_CxxThrowException
_ftol2
wcstoul
iswalpha
memset

atl

ord30

ntdll

WinSqmAddToStream

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantChangeType
VariantInit
SysStringLen
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SysAllocStringLen

ole32

CoCreateGuid
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitialize

shlwapi

StrFormatByteSizeEx

setupapi

SetupIterateCabinetW

comdlg32

GetOpenFileNameW
PrintDlgExW
GetSaveFileNameW

shell32

CommandLineToArgvW

comctl32

InitCommonControlsEx

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

piqorfw
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

973397171891283c9e4508d41746419d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

mfc42u

msvcrt

atl

ntdll

oleaut32

ole32

shlwapi

setupapi

comdlg32

shell32

comctl32

Sections

.text Size: 137KB - Virtual size: 136KB

.data Size: 1KB - Virtual size: 20KB

.rsrc Size: 147KB - Virtual size: 146KB

.reloc Size: 36KB - Virtual size: 37KB

piqorfw Size: - Virtual size: 4KB

.text
Size: 137KB - Virtual size: 136KB

.data
Size: 1KB - Virtual size: 20KB

.rsrc
Size: 147KB - Virtual size: 146KB

.reloc
Size: 36KB - Virtual size: 37KB

piqorfw
Size: - Virtual size: 4KB