986acc187d540f8524b02b50ac7a28db247f03c13f10d6f157256f8c7e0357cf

Sharing

Copy URL Twitter E-mail

General

Target

986acc187d540f8524b02b50ac7a28db247f03c13f10d6f157256f8c7e0357cf
Size

84KB
MD5

6e86acea4cfddd6ef0620576afbb9f60
SHA1

679906075c974f1202002e94e189469980781500
SHA256

986acc187d540f8524b02b50ac7a28db247f03c13f10d6f157256f8c7e0357cf
SHA512

01c83546849f34c706c59af8ff2ee3cd4a503777637f261a36aff82cf9d8a73e4db15fcc2111878a6bdb2c29b4ae87c25fd9262f304a9d6f0264c78d33f6f275
SSDEEP

1536:1Wn1xJQfR3K3XGCGMaAaY38PvHpjikIJUa764QKWwcICS4Ar/ZW2h5:1Wn1HwNK3PGMaAJRk4UyrQye2h5

Score

N/A

Malware Config

Signatures

Files

986acc187d540f8524b02b50ac7a28db247f03c13f10d6f157256f8c7e0357cf
.exe windows x86

bb5dc4a505a6514c48539e0aa3720353

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
strtoul
strncpy
_CIpow
strchr
calloc
free
sprintf
wcstok
atol
strtok
atoi
_wtoi
mbstowcs
_itow
ceil
_wcsupr
_wcslwr
exit
toupper
srand
rand
swprintf

kernel32

lstrlenA
PeekNamedPipe
CreateProcessW
WriteFile
TerminateThread
Sleep
GetExitCodeProcess
TerminateProcess
ReadFile
GetStartupInfoW
DisconnectNamedPipe
CreatePipe
CloseHandle
GetThreadContext
GetFileSize
CreateMutexW
SetThreadContext
WaitForSingleObject
GetModuleHandleW
OpenProcess
GetModuleFileNameW
CreateFileW
GetTempPathW
GetLastError
GetProcAddress
VirtualAllocEx
ReleaseMutex
WriteProcessMemory
ResumeThread
lstrcmpW
lstrcmpA
FindFirstFileW
SetFilePointer
GetDriveTypeW
GetEnvironmentVariableW
GetLogicalDriveStringsW
CreateDirectoryW
lstrlenW
GetFileSizeEx
MoveFileW
FindClose
FindNextFileW
GetDiskFreeSpaceExW
DeleteFileW
ExitProcess
SetPriorityClass
MoveFileExW
GetCurrentProcess
GetCurrentThread
SetProcessPriorityBoost
CopyFileW
SetThreadPriority
GetShortPathNameW
GetDateFormatW
GetTimeFormatW
GetLocalTime
GetCurrentThreadId
CreateThread
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetErrorMode
SetUnhandledExceptionFilter
SetEvent
GlobalAlloc
ResetEvent
CreateEventW
FreeLibrary
LoadLibraryW
GetVersion
GetSystemDirectoryA
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetStdHandle
CreateEventA
GetVolumeInformationW
lstrcpyW
GetSystemTime
lstrcatW
GetLocaleInfoW
GetSystemDirectoryW
GetTickCount
GetComputerNameW
SetFilePointerEx

user32

ExitWindowsEx
GetLastInputInfo
EnumDesktopWindows
PostMessageW
GetClientRect
ShowWindow
IsWindow
SendMessageW
GetWindowThreadProcessId
mouse_event
GetMessageW
GetKeyState
SetCursorPos
TranslateMessage
GetAsyncKeyState
GetKeyNameTextW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
GetDesktopWindow
MapVirtualKeyW
GetWindowDC
GetWindowRect
wvsprintfA
GetSystemMetrics
GetWindowTextW
GetForegroundWindow
PeekMessageW
CharNextW
DispatchMessageW
GetKeyboardState
wsprintfW
GetDCEx
IsWindowVisible
keybd_event
VkKeyScanW
SendInput
CallNextHookEx
SetKeyboardState

gdi32

SetBitmapBits
CreateCompatibleBitmap
DeleteDC
CreateDIBSection
StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
SetStretchBltMode

advapi32

ControlService
StartServiceW
ChangeServiceConfigW
RegEnumKeyExW
RegQueryInfoKeyW
EnumServicesStatusExW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
GetUserNameW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
CloseServiceHandle
DeleteService
QueryServiceConfig2W

shell32

ord680
ShellExecuteExW
SHChangeNotify
SHFileOperationW
ShellExecuteW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantInit

wininet

DeleteUrlCacheEntryW

urlmon

URLDownloadToFileW

setupapi

SetupDiRemoveDevice
SetupDiSetClassInstallParamsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiChangeState
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW

gdiplus

GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusShutdown

ws2_32

send
gethostbyname
gethostbyaddr
closesocket
WSASetLastError
getservbyname
socket
recv
WSACleanup
getservbyport
setsockopt
ntohs
htons
WSAGetLastError
htonl
inet_addr
WSAStartup
inet_ntoa
connect
gethostname
WSAIoctl

winmm

waveInClose
waveInPrepareHeader
waveInOpen
waveInAddBuffer
waveInUnprepareHeader
waveInStart

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bb5dc4a505a6514c48539e0aa3720353

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

urlmon

setupapi

gdiplus

ws2_32

winmm

Sections

.text Size: 58KB - Virtual size: 58KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 3KB - Virtual size: 203KB

.text
Size: 58KB - Virtual size: 58KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 3KB - Virtual size: 203KB