ae9962e331f33b3352a08aace6b7414c174074d4eebf6cdf7112aa144e803c19

Sharing

Copy URL Twitter E-mail

General

Target

ae9962e331f33b3352a08aace6b7414c174074d4eebf6cdf7112aa144e803c19
Size

828KB
MD5

13b3c57904c3e5bd1fee282e9816b1e0
SHA1

a74c306bb69bb2a8c6a566febd8b05d2b1a073d7
SHA256

ae9962e331f33b3352a08aace6b7414c174074d4eebf6cdf7112aa144e803c19
SHA512

669a78cd1340d4fea6680fa1af3c87b7c3f172f94ac36408ceea0eb61283c8f985e37edd3fb11f63a2a32d3faad5c252992a5018f40b2acbfdfcfe1743193238
SSDEEP

12288:pnJcI2fLcSsZaFcWpicrYpYVQk8xi1byboCM:d+dYVZE0crYpYVQjiVGof

Score

N/A

Malware Config

Signatures

Files

ae9962e331f33b3352a08aace6b7414c174074d4eebf6cdf7112aa144e803c19
.exe windows x86

da4720762ebc28cb497ab27780a8e399

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetEvent
EnterCriticalSection
LeaveCriticalSection
ResetEvent
DeleteCriticalSection
CreateEventW
WaitForSingleObject
InitializeCriticalSection
LoadLibraryExW
FreeLibrary
LoadLibraryW
GetProcAddress
CreateMutexW
ReleaseMutex
MoveFileExW
GetModuleFileNameA
FindFirstFileA
FindClose
CreateFileA
ReadFile
GetWindowsDirectoryW
CopyFileW
DeleteFileW
GetTempPathW
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
CreateFileW
MoveFileW
GetModuleFileNameW
GetCommandLineW
lstrcpynW
CompareStringW
GetExitCodeThread
QueryDosDeviceW
GetVersion
GetDriveTypeW
SetErrorMode
GetLocaleInfoW
GetUserDefaultLangID
DeviceIoControl
LoadLibraryA
GetProcessHeap
HeapAlloc
HeapFree
GetProfileStringW
WriteProfileStringW
GlobalAlloc
GlobalLock
GlobalUnlock
CreateThread
lstrlenA
DeleteFileA
InterlockedDecrement
InterlockedIncrement
ExpandEnvironmentStringsW
GetLongPathNameW
OpenEventW
WritePrivateProfileStringW
GetLocalTime
lstrlenW
LocalAlloc
LocalFree
Sleep
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
GetSystemDefaultLangID
GlobalFree
WideCharToMultiByte
FindFirstFileW
FindNextFileW
GetShortPathNameW
GetWindowsDirectoryA
GetModuleHandleA
CreateProcessW
WaitForMultipleObjects
GetExitCodeProcess
GetDiskFreeSpaceExW
SetFileAttributesW
GetFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetModuleHandleW
GetVersionExA
GetVersionExW
GetFileAttributesW
GetFileAttributesA
SetCurrentDirectoryW
GetUserDefaultLCID
GetUserGeoID
GetTempPathA
CreateDirectoryW
RemoveDirectoryW
GetPrivateProfileStringW
SetLastError
GetFileSize
WriteFile
MultiByteToWideChar
GetStartupInfoA
CloseHandle
GetLastError

msvcrt

wcsrchr
wcsstr
wcschr
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsicmp
wcslen
swscanf
_wcslwr
_beginthreadex
_wtol
_wcsnicmp
_vsnprintf
_endthread
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
wcsncpy
_snwprintf
iswspace
wcsncmp
wcspbrk
iswdigit
towupper
iswalpha
strpbrk
_strlwr
_stricmp
iswalnum
_wcsupr
ceil
wcstol
calloc
strchr
memmove
wcscmp
malloc
free
_itow
wcstok
_vsnwprintf
strrchr
strstr
_purecall
_wtoi
time

advapi32

RegCreateKeyExW
LookupPrivilegeValueW
InitiateSystemShutdownExW
CloseServiceHandle
QueryServiceStatus
EnumDependentServicesW
ControlService
OpenServiceW
OpenSCManagerW
StartServiceW
CreateServiceW
DeleteService
QueryServiceConfigW
RegOpenKeyExA
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
AdjustTokenPrivileges
RegQueryValueExW
RegCloseKey
RegQueryValueExA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation

gdi32

SelectObject
SetMapMode
CreateCompatibleDC
GetStockObject
GetDeviceCaps
CreateSolidBrush
SetTextColor
GetObjectW
SetBkColor
DeleteObject
CreateFontIndirectW
PatBlt
CreatePen
GetTextMetricsW
CreateFontA
GetTextFaceA
ExtTextOutW
SetBkMode
DeleteDC

user32

PeekMessageW
PostThreadMessageW
SetCursor
CallWindowProcW
DrawTextW
LoadCursorW
DestroyCursor
GetScrollInfo
SetScrollInfo
ScrollWindow
GetActiveWindow
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
LoadIconW
UpdateWindow
IsWindow
BeginPaint
CreateDialogParamW
LoadImageW
GetWindowLongW
SetWindowLongW
EndPaint
PostQuitMessage
InvalidateRect
GetSystemMetrics
SendDlgItemMessageW
DestroyWindow
CreateWindowExW
SetWindowTextA
FindWindowExW
GetSystemMenu
EnableMenuItem
MessageBoxW
ScreenToClient
SetWindowPos
PostMessageW
EnableWindow
LoadStringW
SetWindowTextW
ShowWindow
GetDlgItem
GetDC
DrawFocusRect
ReleaseDC
DefWindowProcW
GetWindowRect
GetParent
MapWindowPoints
MoveWindow
SetFocus
SendMessageW
FindWindowW
GetDesktopWindow
RegisterClassW
MsgWaitForMultipleObjects
UnregisterClassW
CharNextA
IsCharAlphaW
SetTimer
KillTimer
GetClientRect
LoadStringA

ole32

CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromString
OleInitialize
OleUninitialize

comctl32

InitCommonControlsEx

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderLocation
ShellExecuteW
SHChangeNotify
ShellExecuteExW
CommandLineToArgvW

wininet

InternetCrackUrlW

setupapi

SetupCloseInfFile
SetupFindNextLine
SetupGetStringFieldW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetLineTextW
SetupGetBinaryField
SetupInstallFromInfSectionW
SetupIterateCabinetA

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain

wsock32

getsockopt
socket
select
WSAGetLastError
connect
htons
inet_ntoa
ioctlsocket
__WSAFDIsSet
WSAStartup
WSACleanup
WSAAsyncGetHostByName
WSACancelAsyncRequest
closesocket

urlmon

ObtainUserAgentString
UrlMkSetSessionOption

shlwapi

PathAddBackslashW
PathAddBackslashA
PathFindExtensionW
PathFindFileNameW
SHDeleteKeyW
PathGetCharTypeA
PathGetCharTypeW

crypt32

CertVerifyCertificateChainPolicy

oleaut32

SysAllocString
SysStringLen
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
VariantInit
VariantClear

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

mpr

WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW

Sections

.text
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sqlhojg
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

da4720762ebc28cb497ab27780a8e399

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

gdi32

user32

ole32

comctl32

shell32

wininet

setupapi

wintrust

wsock32

urlmon

shlwapi

crypt32

oleaut32

version

mpr

Sections

.text Size: 300KB - Virtual size: 300KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 512KB - Virtual size: 512KB

sqlhojg Size: - Virtual size: 4KB

.text
Size: 300KB - Virtual size: 300KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 512KB - Virtual size: 512KB

sqlhojg
Size: - Virtual size: 4KB