a4c62d1421a161c89c889ddd44f4c5114dd97d744032d4e4a19b8387bc671f60

Sharing

Copy URL Twitter E-mail

General

Target

a4c62d1421a161c89c889ddd44f4c5114dd97d744032d4e4a19b8387bc671f60
Size

6.5MB
MD5

6a22a946d9b9bd3522b1230ff1066fa5
SHA1

461ab8edc12128e5f6e5e714e82c65e734ac31ba
SHA256

a4c62d1421a161c89c889ddd44f4c5114dd97d744032d4e4a19b8387bc671f60
SHA512

0269492cc79c10c0818907d14a95fbf9a51050f6ac29bc880b0c0f3b37c1b9ec01cc9b7731bbe856a58f6ad2d5d3990e7002874910f90e357c989cf3f33de88f
SSDEEP

196608:3NWPN5zkpQw/XgRYw/XgRnuL7Pktis9nN0LSP+Z/eYHylaklwVyFXWVjukYxyLyu:9WPN5zkpz6Yos9nNSSP+gYylaSwVyFXG

Score

N/A

Malware Config

Signatures

Files

a4c62d1421a161c89c889ddd44f4c5114dd97d744032d4e4a19b8387bc671f60
.exe windows x86

8e04b8da76bba66377f9aef1577970a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcesses
GetModuleBaseNameW

kernel32

GlobalLock
SetLastError
GetModuleHandleW
EnterCriticalSection
GetCurrentThreadId
RaiseException
DeleteCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
GetLastError
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
CreateMutexW
CloseHandle
WaitForSingleObject
ReleaseMutex
Sleep
GetLocaleInfoW
EnumSystemLocalesW
SetThreadUILanguage
lstrcpynW
GetUserDefaultLangID
SetThreadLocale
GetLongPathNameW
OpenProcess
CopyFileW
lstrlenA
DebugBreak
OutputDebugStringW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
ExpandEnvironmentStringsA
LoadLibraryA
GlobalUnlock
GlobalGetAtomNameW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
InterlockedExchange
LoadLibraryW
GetProcAddress
GlobalAddAtomW
GlobalDeleteAtom
lstrcpyW
MultiByteToWideChar
GetModuleFileNameW
lstrlenW
GetFileAttributesW
GetUserDefaultUILanguage

user32

IsDialogMessageW
GetActiveWindow
GetMessageW
UnregisterClassA
DispatchMessageW
DestroyWindow
MessageBeep
CreateWindowExW
GetWindowLongW
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
EnableWindow
GetWindowTextW
GetSystemMetrics
LoadImageW
GetDlgItem
SetWindowTextW
EndDialog
wvsprintfW
DdeCreateStringHandleW
DdeConnect
DdeFreeStringHandle
DdeClientTransaction
DdeDisconnect
DdeInitializeW
LoadCursorW
SetCursor
DdeUninitialize
ShowWindow
MessageBoxW
PeekMessageW
TranslateMessage
WinHelpW
RegisterWindowMessageW
SetWindowLongW
LoadStringW
CharNextW
DialogBoxParamW
UnpackDDElParam
ReuseDDElParam
PostMessageW
SendMessageW
PostQuitMessage
DefWindowProcW
RegisterClassW

gdi32

GetStockObject

advapi32

RegOpenKeyExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW

shell32

SHChangeNotify
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
ord165
ShellExecuteExW
SHGetSpecialFolderPathW
SHBrowseForFolderW

ole32

CoUninitialize
CoInitialize
OleRun
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity

oleaut32

VariantInit
VariantClear
VariantChangeType
VarUI4FromStr
SysStringLen
VarBstrCat
SysAllocStringLen
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysFreeString

shlwapi

PathIsDirectoryEmptyW
PathIsDirectoryW
PathAppendW
PathFileExistsW
PathFindFileNameW
PathRenameExtensionW
PathFindExtensionW
PathRemoveFileSpecW
PathCombineW

comctl32

InitCommonControlsEx

msvcp90

?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

msvcr90

wcschr
_wcsnicmp
iswdigit
_wchmod
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
free
wcsrchr
_vswprintf_c_l
_wsetlocale
wcscpy_s
wcscat_s
_wtoi
swscanf_s
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
_exit
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
_beginthreadex
malloc
_recalloc
memset
wcsstr
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
wcsncpy_s
??_V@YAXPAX@Z
memmove
iswspace
memcpy
??2@YAPAXI@Z
_wcsicmp
__argc
__wargv
memcpy_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
??3@YAXPAX@Z
__CxxFrameHandler3
_CxxThrowException
_wsplitpath
_adjust_fdiv
_cexit

Exports

Exports

?ESRI_HtmlHelp@ESRILocale@@YGPAUHWND__@@PAU2@PB_WIK@Z
?ESRI_WinHelp@ESRILocale@@YGHPAUHWND__@@PB_WIK@Z
?GetCountryID@ESRILocale@@YAGXZ
?GetCountryIDString@ESRILocale@@YAPB_WXZ
?GetLangID@ESRILocale@@YAGXZ
?GetLangIDString@ESRILocale@@YAPB_WXZ
?GetLeftToRightMark@ESRILocale@@YA?B_WXZ
?GetLocale@ESRILocale@@YAGXZ
?GetLocaleHelpFile@ESRILocale@@YAPB_WPB_WAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?GetUICountryID@ESRILocale@@YAGXZ
?GetUICountryIDString@ESRILocale@@YAPB_WXZ
?GetUILangID@ESRILocale@@YAGXZ
?GetUILangIDString@ESRILocale@@YAPB_WXZ
?GetUILocale@ESRILocale@@YAGXZ
?IsRightToLeft@ESRILocale@@YA_NXZ
?IsRightToLeftLanguage@ESRILocale@@YA_NXZ
?IsRightToLeftUI@ESRILocale@@YA_NXZ
?IsTableRightToLeft@ESRILocale@@YA_NXZ
?LoadLocalizedRes@ESRILocale@@YAPAUHINSTANCE__@@PAU2@@Z
?LoadLocalizedResFromFile@ESRILocale@@YAPAUHINSTANCE__@@PB_W@Z
?SetLocale@ESRILocale@@YAXH@Z
?SetThreadLocale@ESRILocale@@YAXXZ
?SetThreadUILocale@ESRILocale@@YAXXZ
?SetupEXEOverRide@ESRILocale@@YA_NG@Z

Sections

.text
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rrdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8e04b8da76bba66377f9aef1577970a6

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msvcp90

msvcr90

Exports

Exports

Sections

.text Size: 99KB - Virtual size: 98KB

.rdata Size: 22KB - Virtual size: 22KB

.data Size: 1024B - Virtual size: 4KB

.rsrc Size: 6.2MB - Virtual size: 6.2MB

.reloc Size: 23KB - Virtual size: 22KB

.rrdata Size: 76KB - Virtual size: 76KB

.text
Size: 99KB - Virtual size: 98KB

.rdata
Size: 22KB - Virtual size: 22KB

.data
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 6.2MB - Virtual size: 6.2MB

.reloc
Size: 23KB - Virtual size: 22KB

.rrdata
Size: 76KB - Virtual size: 76KB