3be1acab74d70790ee9178d7291f6ca7af19c4108737d0bc77fb9b1633fc523d

Sharing

Copy URL

Twitter E-mail

General

Target

3be1acab74d70790ee9178d7291f6ca7af19c4108737d0bc77fb9b1633fc523d
Size

194KB
MD5

54aaa2ed9545fa465389131b0eac791e
SHA1

2b9a0d54125b7744a2b890497ff14443d38e5360
SHA256

3be1acab74d70790ee9178d7291f6ca7af19c4108737d0bc77fb9b1633fc523d
SHA512

093d76210ee6e01e37980a07e9a14c5ef05286d55016cad23c0d31ee9f39569b8452b06e0bb0cfb28d4afecf3295c4dd1d87bc8bcb3d075268955833a50d7cec
SSDEEP

3072:8zZkFJElOuXRBLTnAGYciL9gkyfutJO1xFiOpIdid/26+QseLukZRHJxjqa4u:8zZTOuhBPAGiCUJOxFie9+FeLLRHfP4u

Score

N/A

Malware Config

Signatures

Files

3be1acab74d70790ee9178d7291f6ca7af19c4108737d0bc77fb9b1633fc523d
.dll windows x86

738892ed1f96fa712c8d4d13d4a49825

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

CreateProcessW
GetCurrentProcess
SetFileAttributesW
SetLastError
GetSystemInfo
RemoveDirectoryW
lstrcmpW
MoveFileW
MoveFileExW
MultiByteToWideChar
UnmapViewOfFile
GetShortPathNameW
GetModuleFileNameW
GetSystemDirectoryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryW
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcatW
lstrlenW
lstrcpyW
GetVersionExW
Sleep
WaitForSingleObject
GetExitCodeProcess
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
GetPrivateProfileStructW
GetPrivateProfileStringW
WritePrivateProfileStructW
WritePrivateProfileStringW
CreateFileW
DeleteFileW
GetCurrentThread
CloseHandle
GetFileAttributesW
OutputDebugStringW
CreateDirectoryW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
lstrcpynW

msvcrt

wcscpy
_adjust_fdiv
_initterm
memmove
wcsrchr
strtol
_except_handler3
swprintf
wcstoul
wcsncmp
_wcsnicmp
realloc
_snwprintf
wcschr
wcslen
iswctype
_wcsicmp
wcscmp
malloc
wcstol
free

ntdll

RtlNtStatusToDosError
RtlFreeUnicodeString
RtlNtPathNameToDosPathName
RtlInitUnicodeString
RtlpEnsureBufferSize

setupapi

SetupQueueDeleteW
pSetupSetQueueFlags
SetupSetDirectoryIdW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupPromptForDiskW
SetupGetStringFieldW
SetupGetIntField
SetupFindNextLine
SetupFindFirstLineW
SetupCloseInfFile
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupFindNextMatchLineW
SetupGetFieldCount
SetupDiGetActualSectionToInstallW
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupPromptReboot
SetupDefaultQueueCallbackW
SetupQueryInfFileInformationW
SetupGetInfInformationW
SetupGetFileCompressionInfoW
SetupQueueCopyW
SetupQueueRenameW
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupCommitFileQueueW
SetupScanFileQueueW
SetupInstallFilesFromInfSectionW
SetupInitDefaultQueueCallbackEx
SetupOpenFileQueue
SetupOpenAppendInfFileW
SetupGetLineCountW
pSetupGetQueueFlags

advapi32

RegDeleteValueW
OpenThreadToken
AccessCheck
FreeSid
RevertToSelf
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
ImpersonateSelf
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW

user32

wvsprintfW
CharNextW
GetUserObjectInformationW
GetProcessWindowStation
CharPrevW
ExitWindowsEx

ole32

CoTaskMemFree
StringFromGUID2
IIDFromString
StringFromIID

Exports

Exports

DoInstall
DoInstallA
DoInstallW
DoUninstall
DoUninstallA
DoUninstallW
DriverInstallComponents
InstallComponentA
InstallComponentW
InstallInfSectionA
InstallInfSectionW
IsInteractiveWindowStation
IsUserAdmin
ProxyRemoteInstall
ProxyRemoteInstallA
ProxyRemoteInstallW
UninstallComponent

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 147KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

738892ed1f96fa712c8d4d13d4a49825

Headers

File Characteristics

Imports

kernel32

msvcrt

ntdll

setupapi

advapi32

user32

ole32

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.data Size: 512B - Virtual size: 460B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text Size: 147KB - Virtual size: 148KB

.text
Size: 41KB - Virtual size: 40KB

.data
Size: 512B - Virtual size: 460B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 147KB - Virtual size: 148KB