6a05664868750f7a19e92325d7775d8c76330158f3683b09b5fa40d14c04b7bc

Sharing

Copy URL Twitter E-mail

General

Target

6a05664868750f7a19e92325d7775d8c76330158f3683b09b5fa40d14c04b7bc
Size

121KB
MD5

454c2bf814701d973cf539aeaecefd60
SHA1

d92dd23fa8ccbda32ab7bc835c2af2de5db55f56
SHA256

6a05664868750f7a19e92325d7775d8c76330158f3683b09b5fa40d14c04b7bc
SHA512

c41214130ea5e3eddefe87b775ac01d113065193e9ec776bcecb73b27118bae1640ff6b67d8c521bdf46e6f5e215517c804157a0630a6aa12d4a66400625e970
SSDEEP

3072:NAM/8WgD3BbfXNm5gyZfbprPBrM7vIs8AgqtOG:iMwD3BbfXNcgyZTpTBrM7vkqv

Score

N/A

Malware Config

Signatures

Files

6a05664868750f7a19e92325d7775d8c76330158f3683b09b5fa40d14c04b7bc
.exe windows x86

0010c7fd4f80d3387dc19010a616a9d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
FreeLibraryAndExitThread
GetCurrentThread
GetComputerNameW
OpenProcess
GetExitCodeProcess
GetModuleFileNameW
GetSystemDirectoryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetCommandLineA
GetCurrentThreadId
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
lstrcpyA
lstrcpynA
lstrcatA
lstrcmpiA
IsDBCSLeadByte
lstrlenA
lstrlenW
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetVersionExA
CreateSemaphoreA
CreateThread
WaitForMultipleObjects
MultiByteToWideChar
WideCharToMultiByte
GetLastError
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
InterlockedDecrement
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
DeleteCriticalSection
SetThreadPriority
InitializeCriticalSection
CreateEventW
WaitForSingleObject
GetVersionExW
LocalAlloc
LoadLibraryW
LocalFree
InterlockedCompareExchange
GetStartupInfoA
WaitForSingleObjectEx
HeapSize
CreateEventA
Sleep
SetEvent

msvcrt

_strnicmp
__p__commode
strchr
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
wcsncpy
calloc
strncpy
strtoul
sprintf
_snwprintf
wcsrchr
iswalpha
_XcptFilter
_exit
_ultoa
__p__fmode
__set_app_type
__dllonexit
_onexit
_controlfp
towupper
wcscmp
_wtoi
wcsspn
wcsncmp
wcschr
__CxxFrameHandler
swscanf
_ultow
wcslen
iswdigit
iswcntrl
_cexit
iswascii
_adjust_fdiv
wcscspn
_c_exit
_purecall
realloc
_except_handler3
_stricmp
sscanf
malloc
free
_wcsnicmp
_wcsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
_vsnwprintf
_snprintf
_beginthreadex
_vsnprintf

advapi32

RegQueryValueExW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeAcl
InitializeSecurityDescriptor
GetLengthSid
MakeAbsoluteSD
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetTokenInformation
OpenProcessToken
GetAce
GetAclInformation
AddAce
AddAccessDeniedAce
RegEnumKeyExA
AllocateAndInitializeSid
FreeSid
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AddAccessAllowedAce
EqualSid
DeleteAce
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW

user32

DefWindowProcA
GetWindowLongA
PostMessageA
DestroyWindow
SetWindowLongA
CreateWindowExA
RegisterClassA
GetMessageA
DispatchMessageA
CharPrevA
PostThreadMessageA
CharNextA
PostQuitMessage

ole32

CoUninitialize
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoSuspendClassObjects
CoCreateInstance
CoInitialize
CoCreateGuid

oleaut32

VariantInit
VariantClear
SysStringLen
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocString
SysFreeString

wininet

InternetOpenW
InternetQueryOptionA
HttpOpenRequestW
InternetQueryDataAvailable
HttpSendRequestExW
HttpEndRequestA
HttpQueryInfoA
InternetErrorDlg
HttpQueryInfoW
InternetSetOptionA
InternetCrackUrlW
InternetConnectW
InternetCloseHandle
InternetReadFile

wsock32

bind
shutdown
closesocket
getsockopt
getpeername
getsockname
WSAAsyncSelect
inet_ntoa
WSACleanup
WSAStartup
ntohl
setsockopt
connect
send
sendto
recv
WSASetLastError
getservbyport
ntohs
gethostbyaddr
htons
getservbyname
htonl
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
socket

Sections

.text
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ivwqcmg
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0010c7fd4f80d3387dc19010a616a9d2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

user32

ole32

oleaut32

wininet

wsock32

Sections

.text Size: 91KB - Virtual size: 91KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 29KB - Virtual size: 30KB

ivwqcmg Size: - Virtual size: 4KB

.text
Size: 91KB - Virtual size: 91KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 29KB - Virtual size: 30KB

ivwqcmg
Size: - Virtual size: 4KB