1d2294c2331731398b8fbfb1065df8fb39fc38e0fe0190b0d3aee22d874f25ca

Sharing

Copy URL

Twitter E-mail

General

Target

1d2294c2331731398b8fbfb1065df8fb39fc38e0fe0190b0d3aee22d874f25ca
Size

728KB
MD5

6a22849ea3468fb1624a6f966238f970
SHA1

ad86e333a173e964491a42c6b2a5be5e45627839
SHA256

1d2294c2331731398b8fbfb1065df8fb39fc38e0fe0190b0d3aee22d874f25ca
SHA512

520f1d802ccd7c9e32a03dba719ded6c1f9cf5afce0a264a81beeb4ee7b9684750e50824b390584701908c5daf141fd0d0287317b729d0622beec0ed8d394ce1
SSDEEP

12288:W109hugY26ZkJZbrLzSGPu6je+47HJuEyJEwHDsXfIOgX6:Yk3/RPuoIp9yJEpXfVM

Score

N/A

Malware Config

Signatures

Files

1d2294c2331731398b8fbfb1065df8fb39fc38e0fe0190b0d3aee22d874f25ca
.exe windows x86

c7d22c9a7f1dccd1dab98ddd7768793d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetGetConnectionW

kernel32

HeapFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapAlloc
VirtualQuery
TerminateProcess
LoadLibraryA
lstrlenA
MultiByteToWideChar
IsDebuggerPresent
GetProcessHeap
SetUnhandledExceptionFilter
GetModuleFileNameW
ExpandEnvironmentStringsW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetStringTypeExW
GetFullPathNameW
GetCurrentThreadId
VerSetConditionMask
VerifyVersionInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetComputerNameW
LocalFree
CloseHandle
SetLastError
GetCurrentThread
GetCurrentProcess
GetLastError
GetConsoleOutputCP
GetStdHandle
WriteConsoleW
GetCommandLineW
GetModuleHandleW
GetCurrentDirectoryW
DeleteFileW
GetProcAddress
LoadLibraryW
FreeLibrary
GetLogicalDriveStringsW
InterlockedExchange
Sleep
UnhandledExceptionFilter
WideCharToMultiByte
DebugBreak
RaiseException
InterlockedCompareExchange

user32

DispatchMessageW
OpenInputDesktop
CloseDesktop
wsprintfW
ReleaseDC
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
GetDC
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetFocus
SetForegroundWindow
MessageBoxW

gdi32

CreateFontW
GetDeviceCaps

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FileEncryptionStatusW
DecryptFileW
RegLoadKeyW
RegUnLoadKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
LookupAccountSidW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ConvertSidToStringSidW
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
RegOpenCurrentUser
GetUserNameW
LookupAccountNameW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

SHFileOperationW

ole32

OleUninitialize
OleInitialize

mfc80u

ord1476
ord764
ord577
ord5711
ord899
ord772
ord2444
ord2895
ord293
ord6002
ord774
ord266
ord265
ord870
ord896
ord277
ord1906
ord2260
ord4026
ord5485
ord3927
ord4027
ord2121
ord776
ord283
ord900
ord5524
ord287
ord2317
ord1472
ord1176
ord280
ord557
ord5558
ord860
ord3990
ord745
ord1197
ord1060
ord2310
ord722
ord530
ord2311
ord1079
ord897
ord281
ord1479
ord282
ord6700
ord6111
ord566
ord757
ord777
ord2460
ord5398
ord2468
ord1908
ord631
ord2271
ord386
ord2261
ord6133
ord4078
ord1248
ord1271
ord629
ord6009
ord3383
ord384
ord2745
ord2742
ord2279

msvcr80

atoi
malloc
memset
memcpy
_CxxThrowException
_CRT_RTC_INITW
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_getch
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
__CxxFrameHandler3
wcsncpy
calloc
free
exit
wcscpy

shlwapi

PathRemoveBackslashW
PathFileExistsW
PathAddBackslashW
PathIsDirectoryW
PathRenameExtensionW
PathRemoveFileSpecW

msvcp80

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z

oleaut32

SysFreeString

Sections

.text
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 608KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c7d22c9a7f1dccd1dab98ddd7768793d

Headers

File Characteristics

Imports

mpr

kernel32

user32

gdi32

advapi32

shell32

ole32

mfc80u

msvcr80

shlwapi

msvcp80

oleaut32

Sections

.text Size: 88KB - Virtual size: 84KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 608KB - Virtual size: 2.4MB

.text
Size: 88KB - Virtual size: 84KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 608KB - Virtual size: 2.4MB