4e167eba4aed905f38bd0f01a2c96c4ee066c2d499934cd7394b408293d73dcb

Sharing

Copy URL Twitter E-mail

General

Target

4e167eba4aed905f38bd0f01a2c96c4ee066c2d499934cd7394b408293d73dcb
Size

293KB
MD5

409da0cc8a9f4e1b493cd848e8052490
SHA1

030cabb6cca935794745856feeb74029d26648cd
SHA256

4e167eba4aed905f38bd0f01a2c96c4ee066c2d499934cd7394b408293d73dcb
SHA512

831e84845a9ebc8ebd41b0cd6540e25eb1ff094a651114e36a14e9197176469508b721f90acae892e3fe5fce163aee7df0674ffa201a92cf14fd12dd341e8ff4
SSDEEP

6144:iA8ZS95s3vYiX9lrAw4WhK3fZBXoTB4kOxjKyUxqOGAprzREhHD:i0iX9pAwphsTXoujUZGAZziN

Score

N/A

Malware Config

Signatures

Files

4e167eba4aed905f38bd0f01a2c96c4ee066c2d499934cd7394b408293d73dcb
.exe windows x86

1e3046d6586646bc4566cff6f549483f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptStringToBinaryW

kernel32

OpenThread
SuspendThread
ResumeThread
Thread32Next
VirtualQuery
IsBadWritePtr
WritePrivateProfileStringW
MultiByteToWideChar
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
GetLastError
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReleaseMutex
CreateFileW
DeleteFileW
FlushFileBuffers
WriteFile
SetFilePointer
WideCharToMultiByte
GetTempPathA
CreateDirectoryA
GetFileAttributesA
CreateDirectoryW
GetFileAttributesW
TlsGetValue
GetLocalTime
TlsSetValue
FindFirstChangeNotificationW
FindClose
FindNextFileW
FindFirstFileW
WritePrivateProfileStringA
GetPrivateProfileIntW
GetPrivateProfileStringA
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
GetPrivateProfileStringW
MoveFileW
CopyFileW
FindCloseChangeNotification
InterlockedExchangeAdd
InitializeCriticalSection
ExitProcess
MapViewOfFile
CreateFileMappingW
CreateMutexW
GetCurrentProcess
TerminateProcess
TlsAlloc
LoadLibraryW
GetSystemInfo
UnmapViewOfFile
TlsFree
GetCurrentThread
FlushInstructionCache
SetLastError
InterlockedDecrement
GetThreadContext
SetThreadContext
VirtualProtect
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetEndOfFile
SetStdHandle
GetConsoleMode
GetConsoleCP
InterlockedExchange
RtlUnwind
GetTimeZoneInformation
LCMapStringW
QueryPerformanceCounter
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentDirectoryW
GetFileType
PeekNamedPipe
Thread32First
CreateToolhelp32Snapshot
CloseHandle
WaitForSingleObject
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCommandLineW
GetModuleFileNameW
GetVersionExW
HeapFree
GetProcessHeap
HeapAlloc
lstrcmpW
InterlockedIncrement
lstrlenA
OutputDebugStringW
DebugBreak
lstrlenW
GetTickCount
RaiseException
LeaveCriticalSection
GetFileInformationByHandle
GetFullPathNameW
Sleep
GetStdHandle
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
HeapReAlloc
HeapDestroy
HeapCreate
GetSystemTimeAsFileTime
GetStartupInfoW
HeapSetInformation
IsDebuggerPresent
UnhandledExceptionFilter
FindFirstFileExW
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
EncodePointer
DecodePointer
LocalFree
ReadFile
EnterCriticalSection
GetCurrentThreadId
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange

user32

SystemParametersInfoW
GetWindowRect
EqualRect
MoveWindow
GetClientRect
UnregisterClassA
SetWindowLongW
GetSystemMetrics
CreateDialogParamW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
MessageBoxW
CharLowerBuffW
LoadStringW
PostMessageW
GetParent
DestroyWindow
SetTimer
SetWindowPos
CharNextW
wvsprintfW
SendMessageW
IsDialogMessageW
ShowWindow
IsWindowVisible
PostQuitMessage
IsWindow

advapi32

RegEnumKeyExW
SetSecurityDescriptorDacl
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
CryptReleaseContext
CryptDestroyHash
CryptDestroyKey
CryptDecrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
SetSecurityDescriptorSacl
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
InitializeSecurityDescriptor

shell32

ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoTaskMemRealloc
CoInitialize
OleCreate
StgCreateDocfile
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
OleInitialize

oleaut32

SysFreeString
VariantClear
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocString
SysAllocStringLen
VarBstrCmp
VarUI4FromStr

shlwapi

PathIsDirectoryW
PathFindFileNameW
PathFileExistsW
PathGetArgsW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdiplus

GdiplusStartup
GdiplusShutdown

Exports

Exports

UpdateUserData_

Sections

.text
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1e3046d6586646bc4566cff6f549483f

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

gdiplus

Exports

Exports

Sections

.text Size: 153KB - Virtual size: 152KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 8KB - Virtual size: 46KB

.rsrc Size: 84KB - Virtual size: 88KB

.text
Size: 153KB - Virtual size: 152KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 8KB - Virtual size: 46KB

.rsrc
Size: 84KB - Virtual size: 88KB