8f650518c99b3277090de84baacca1680ed6564faa66ad6d44c1c6d20c85c363

Sharing

Copy URL Twitter E-mail

General

Target

8f650518c99b3277090de84baacca1680ed6564faa66ad6d44c1c6d20c85c363
Size

104KB
MD5

09fb436e71c84db1780285a36dd65c40
SHA1

e4c22ab584b253b0bdca2acaf0bc0a8a063b4eda
SHA256

8f650518c99b3277090de84baacca1680ed6564faa66ad6d44c1c6d20c85c363
SHA512

a47f0abcef3f3e6f7a9d1f3e96abe21eb867b8a5ac90175fc3e3f93779ede9ab6f45c6461adea107f9372a76fd85bb16e1595e927dd9a87f891f44561e6465be
SSDEEP

1536:9k/NlJaB/nsHPiMr1aFYPEy1hAUpWlGthmYcIszfBzc4ZKoL5ZjHx77p:i/NlKsHqM5aiEIEYnsTBzc4ZrL5ZDR1

Score

N/A

Malware Config

Signatures

Files

8f650518c99b3277090de84baacca1680ed6564faa66ad6d44c1c6d20c85c363
.exe windows x86

dbf2aa5a37c1059f8c0c789ac274ef45

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

msvcrt

memmove
memcpy
??3@YAXPAX@Z
_adjust_fdiv
ceil
_ftol
strlen
strstr
__CxxFrameHandler
memset
??2@YAPAXI@Z
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_strcmpi
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
calloc
_beginthreadex
clock
realloc
strncat
strchr
exit
printf
time
srand
rand
atoi
strncpy
strcat
strcpy
strcmp
strrchr
_except_handler3
malloc
free
memcmp

kernel32

VirtualAlloc
GetProcAddress
LoadLibraryA
CloseHandle
SetEvent
InterlockedExchange
CancelIo
Sleep
DeleteFileA
GetLastError
EnterCriticalSection
GetFileAttributesA
lstrcpyA
lstrlenA
CreateProcessA
lstrcatA
GetLogicalDriveStringsA
FindClose
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
SetLastError
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
LeaveCriticalSection
OpenProcess
GetTickCount
TerminateThread
WinExec
OutputDebugStringA
GetModuleFileNameA
HeapFree
HeapAlloc
GetProcessHeap
GlobalFree
GlobalAlloc
GlobalSize
GetSystemDirectoryA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
ReleaseMutex
WaitForSingleObject
OpenEventA
SetErrorMode
SetFileAttributesA
CopyFileA
CreateMutexA
LocalSize
Process32Next
Process32First
lstrcmpiA
GetModuleHandleA
GetStartupInfoA
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
FreeLibrary
CreateDirectoryA

user32

IsWindow
CloseWindow
CreateWindowExA
PostMessageA
CharNextA
wsprintfA
LoadCursorA
DestroyCursor
BlockInput
SendMessageA
SystemParametersInfoA
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
GetClipboardData
GetSystemMetrics
SetRect
GetDesktopWindow
ReleaseDC
GetCursorPos
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
GetWindowTextA
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
GetCursorInfo
GetDC

gdi32

BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
CreateDIBSection
GetDIBits

advapi32

CreateServiceA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegEnumKeyExA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCreateKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
GetTokenInformation
LookupAccountSidA

shell32

SHGetSpecialFolderPathA

ws2_32

WSAGetLastError
inet_ntoa
htonl
gethostname
inet_addr
send
select
recv
getsockname
sendto
ntohs
closesocket
socket
gethostbyname
htons
connect
setsockopt
WSACleanup
WSAStartup

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

mfc42

ord6663
ord800
ord6877
ord939
ord537
ord6648
ord2764
ord4129
ord926
ord924
ord922
ord2818
ord535
ord858
ord4278
ord860
ord540

wininet

InternetOpenUrlA

msvfw32

ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICSendMessage
ICSeqCompressFrameStart
ICOpen
ICSeqCompressFrame

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dbf2aa5a37c1059f8c0c789ac274ef45

Headers

File Characteristics

Imports

shlwapi

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ws2_32

msvcp60

mfc42

wininet

msvfw32

wtsapi32

Sections

.text Size: 72KB - Virtual size: 68KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 72KB - Virtual size: 68KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 1KB