b46de0ea37b18f56bee87553ea708accae5289c6d2270bdc29ad275e59232f65

Sharing

Copy URL Twitter E-mail

General

Target

b46de0ea37b18f56bee87553ea708accae5289c6d2270bdc29ad275e59232f65
Size

120KB
MD5

2bca31526609eef1d6fe947678e70b00
SHA1

bbf61cfd80f0ea4f69e49565c6443ac41e9c89e3
SHA256

b46de0ea37b18f56bee87553ea708accae5289c6d2270bdc29ad275e59232f65
SHA512

cfe82e3af6a436aa8a44fdf016b2c061a685636092ad18ed91ed50be46e5a7053d12730409a1c5abbac654b96021ea5bf968bc036908e87f8a63da5a0d5c9c23
SSDEEP

1536:T5pCmvwwQvoqNYX0r4JpYMicrX2f6eOa5wmmh84QO8zz2:TKmwwQvoqGfp7iAXg6eOclmh84QNzz2

Score

N/A

Malware Config

Signatures

Files

b46de0ea37b18f56bee87553ea708accae5289c6d2270bdc29ad275e59232f65
.exe windows x86

db1f603905e825791c2fb4324d1b417a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
CreateFileA
SetFilePointer
WriteFile
ReadFile
GetModuleFileNameA
SetLastError
GetCurrentProcess
WinExec
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
MultiByteToWideChar
TerminateThread
FindNextFileA
ExitProcess
MoveFileA
HeapFree
GetSystemInfo
GetVersionExA
ReleaseMutex
OpenEventA
SetErrorMode
GlobalMemoryStatusEx
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
lstrcatA
CreateProcessA
lstrlenA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetProcessHeap
HeapAlloc
GetCurrentProcessId
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
GetLocalTime
GetTickCount
Sleep
CancelIo
InterlockedExchange
SetEvent
lstrcpyA
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
GetWindowsDirectoryA

user32

OpenInputDesktop
CharNextA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
wsprintfA
SetThreadDesktop

shlwapi

SHDeleteKeyA

advapi32

SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
OpenEventLogA
RegCreateKeyExA
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCreateKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
GetUserNameA
LookupAccountSidA
GetTokenInformation
StartServiceA
InitializeSecurityDescriptor

shell32

SHGetFileInfoA

msvcrt

_strnicmp
__setusermatherr
_onexit
__dllonexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
??3@YAXPAX@Z
memcpy
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
strlen
strstr
memset
??2@YAPAXI@Z
memcmp
rand
strcpy
sprintf
strncpy
free
malloc
_except_handler3
strrchr
strcmp
rename
strcat
atoi
strncmp
strchr
_errno
wcscpy
strtok
strncat
atol
_beginthreadex
calloc
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
_strupr

ws2_32

htonl
inet_ntoa
getsockname
select
closesocket
WSASocketA
listen
recvfrom
__WSAFDIsSet
gethostname
send
sendto
inet_addr
accept
recv
ntohs
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
getpeername
bind

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

netapi32

NetLocalGroupAddMembers
NetUserAdd

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 4KB - Virtual size: 983B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db1f603905e825791c2fb4324d1b417a

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

advapi32

shell32

msvcrt

ws2_32

wininet

msvcp60

netapi32

wtsapi32

Sections

.text Size: 84KB - Virtual size: 80KB

PAGE Size: 4KB - Virtual size: 983B

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: 84KB - Virtual size: 80KB

PAGE
Size: 4KB - Virtual size: 983B

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 4KB