581cce917806f6080d8b90e8741db00075b99e6437fd3ea08408e5bb8f5dc839

Sharing

Copy URL Twitter E-mail

General

Target

581cce917806f6080d8b90e8741db00075b99e6437fd3ea08408e5bb8f5dc839
Size

620KB
MD5

42d757258fc5d9b2170b6dd495770950
SHA1

d06cff7ee94c9dd6fe881ec2afc8cdad46c2858a
SHA256

581cce917806f6080d8b90e8741db00075b99e6437fd3ea08408e5bb8f5dc839
SHA512

f713d5b9711fe62b1c7a65944515dbbdfddc2125628fc88be5b76ceccd2f002b7738638050715232313b8f693b9e97b3215e3bf2e4380ce42722b36db4583f22
SSDEEP

12288:EHvj084H3dAneec1OmSJeBE1lEUOfF13mO6RxoWTCA4KSsPS:CvAH3we18PLzTCAtSoS

Score

N/A

Malware Config

Signatures

Files

581cce917806f6080d8b90e8741db00075b99e6437fd3ea08408e5bb8f5dc839
.exe windows x86

d65dd7a1c1f70c22ffa81047ba2dbfca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
WSACleanup
htonl
getservbyname
WSAStartup
socket
connect
closesocket
send
recv
WSASetLastError
getservbyport
ntohs
gethostbyaddr
htons

dnsapi

DnsQuery_W
DnsFree

wininet

InternetOpenW
HttpOpenRequestW
HttpSendRequestExW
HttpEndRequestW
InternetWriteFile
InternetCloseHandle
InternetConnectW
InternetReadFile

rpcrt4

RpcStringFreeA
UuidToStringA

gdi32

SetLayout
CreateDCW
GetDIBits
CreateFontW
TextOutW
CreateRectRgn
SelectClipRgn
BitBlt
SelectPalette
RealizePalette
SetStretchBltMode
DeleteObject
SelectObject
GetObjectW
SetBkMode
StretchBlt
DeleteDC
CreateFontIndirectW
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
CreatePen
Polygon
CreateSolidBrush
SetBkColor
CreateHalftonePalette
CreatePalette
GetDIBColorTable
SetDIBits
SetViewportOrgEx
SetTextColor

shell32

ExtractIconW
CommandLineToArgvW
SHGetFileInfoW
Shell_NotifyIconW
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

EnumProcessModules
GetProcessMemoryInfo

kernel32

UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
Sleep
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
CreateDirectoryW
FormatMessageW
GlobalFree
GetPrivateProfileStringW
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetTempPathW
GetTempFileNameW
SystemTimeToFileTime
WritePrivateProfileStringW
GetSystemDirectoryA
LoadLibraryA
OpenFileMappingW
SetEvent
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
lstrlenW
ResetEvent
InterlockedIncrement
CreateEventW
lstrcpyW
FindNextFileW
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
lstrlenA
DebugBreak
OutputDebugStringW
GetSystemTime
FileTimeToSystemTime
GetProcessTimes
GetProcAddress
LoadLibraryW
OpenProcess
SystemTimeToTzSpecificLocalTime
GetFileSizeEx
CreateFileW
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesW
RaiseException
GetLastError
FreeLibrary
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GetModuleHandleW
lstrcmpiW
MulDiv
CompareStringW
lstrcmpW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
CreateMutexW
GetCommandLineW
GetVersionExW
lstrcpynW
CreateProcessW
ReadFile
GetFileInformationByHandle
WriteFile
CreateThread
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetSystemInfo
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcessId

user32

DrawTextExA
CharUpperW
SetScrollInfo
GetScrollInfo
PostMessageW
DialogBoxParamW
LoadIconW
PostQuitMessage
CopyRect
AdjustWindowRectEx
IsDialogMessageW
EnableWindow
KillTimer
SetTimer
MoveWindow
GetMenu
GetIconInfo
DrawTextExW
DrawIcon
GetActiveWindow
GetSubMenu
TrackPopupMenu
LoadMenuW
GetWindow
MonitorFromWindow
MonitorFromPoint
GetMonitorInfoW
DestroyMenu
SetMenuItemInfoW
CheckMenuRadioItem
DeleteMenu
EndDialog
MessageBoxW
SetProcessDefaultLayout
LoadImageW
GetDesktopWindow
GetSysColorBrush
GetKeyState
CreateDialogParamW
GetClassNameW
LoadCursorW
EnumDisplayMonitors
GetFocus
OffsetRect
GetCapture
ReleaseCapture
ReleaseDC
AnimateWindow
EndPaint
BeginPaint
SetCursor
DrawFocusRect
FillRect
DrawTextW
PtInRect
CallWindowProcW
IsWindow
GetDlgCtrlID
GetParent
SetFocus
SetCapture
IsWindowEnabled
UpdateWindow
ScreenToClient
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateWindowExW
DestroyWindow
SetRectEmpty
MapWindowPoints
GetDlgItem
RedrawWindow
IsWindowVisible
ShowWindow
InvalidateRect
SendMessageW
GetWindowRect
SetWindowPos
GetWindowLongW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetWindowLongW
DestroyIcon
GetGuiResources
CharNextW
wvsprintfW
LoadStringW
GetCursorInfo
GetWindowThreadProcessId
EnumWindows
EnableMenuItem
OpenClipboard
CloseClipboard
IntersectRect
GetSystemMetrics
EmptyClipboard
GetDC
SetClipboardData
CharLowerW
GetSysColor
UnregisterClassA
GetCursorPos

advapi32

RegQueryValueExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumValueW
RegQueryInfoKeyW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateGuid
CoTaskMemAlloc

oleaut32

SysFreeString
VarI4FromStr
VarDateFromStr
VarUI4FromStr
VarDecFromStr
VarDecCmp
VarR8FromStr

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_ReplaceIcon
_TrackMouseEvent

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr90

strncpy
tmpfile
getenv
sscanf
exit
__iob_func
sprintf
fflush
isalpha
tolower
isspace
strncmp
atof
fseek
ftell
ferror
fopen_s
_vsnprintf_s
sscanf_s
fputc
swprintf_s
strftime
_wdupenv_s
_time64
_gmtime64_s
wcscspn
strcat_s
strtoul
strncpy_s
calloc
strcpy_s
strchr
__CxxLongjmpUnwind
fprintf
atoi
wcsncmp
_wtol
_setjmp3
abort
fwrite
fwprintf
_decode_pointer
sprintf_s
_wstat64i32
feof
fread
wcscpy_s
wcschr
wcsncpy_s
memcpy_s
malloc
wcsstr
_recalloc
_wcsicmp
free
_purecall
_wtoi
iswspace
iswdigit
wcsrchr
memmove
memmove_s
_wfopen_s
fclose
memset
isalnum
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??_V@YAXPAX@Z
memcpy
_CxxThrowException
??3@YAXPAX@Z
_wfopen
_fseeki64
_ftelli64
srand
rand
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
strtod
longjmp
rewind
_gmtime64
fopen
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_lock
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_onexit
_CIpow

Sections

.text
Size: 448KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d65dd7a1c1f70c22ffa81047ba2dbfca

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

dnsapi

wininet

rpcrt4

gdi32

shell32

comdlg32

version

psapi

kernel32

user32

advapi32

ole32

oleaut32

comctl32

msvcp90

msvcr90

Sections

.text Size: 448KB - Virtual size: 447KB

.rdata Size: 100KB - Virtual size: 99KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 66KB - Virtual size: 66KB

.text
Size: 448KB - Virtual size: 447KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 66KB - Virtual size: 66KB