a6b798b2f5d6b3a0af54bd2ef619d24d846c9d271b85456e3607cd1939fa8a61

Sharing

Copy URL

Twitter E-mail

General

Target

a6b798b2f5d6b3a0af54bd2ef619d24d846c9d271b85456e3607cd1939fa8a61
Size

281KB
MD5

6ae393b4afe45b218a3ee775a930186e
SHA1

f015d9c2eee0b8bc144bfdf7ae84f0a5e6c00f28
SHA256

a6b798b2f5d6b3a0af54bd2ef619d24d846c9d271b85456e3607cd1939fa8a61
SHA512

f75d23fbb33eed560639e30e69cb97dd484596abd46a40e503489a37bbd58071a6ba4f23eda379c8740537ed47e2478963e042e9e58005d98339a1e2befb429d
SSDEEP

6144:KiNmC01IgNMpM9hz9Xl3OhxKfnZclr8JoHZUbeouTnVHds6Q:K801I4jSMPKZ5U8RG6Q

Score

N/A

Malware Config

Signatures

Files

a6b798b2f5d6b3a0af54bd2ef619d24d846c9d271b85456e3607cd1939fa8a61
.dll windows x86

221ff7a8030e57475d1a13ecf9af99aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

CloseSpoolFileHandle
CommitSpoolData
ConvertAnsiDevModeToUnicodeDevmode
ConvertUnicodeDevModeToAnsiDevmode
DEVICEMODE
DevQueryPrintEx
DocumentEvent
EndDocPrinter
EndPagePrinter
FindClosePrinterChangeNotification
PrinterProperties
QuerySpoolMode
ScheduleJob
SplDriverUnloadComplete
SpoolerPrinterEvent
AdvancedSetupDialog

shlwapi

SHGetThreadRef
ColorHLSToRGB
PathRelativePathToA
PathRelativePathToW
SHAutoComplete
SHCopyKeyW
ord16
SHGetInverseCMAP
SHIsLowMemoryMachine
SHRegisterValidateTemplate
SHSetThreadRef
SHSkipJunction
StrCpyNW
StrRetToBufA

advapi32

ConvertSidToStringSidW
TraceEvent
SystemFunction006
SetTokenInformation
SetThreadToken
SetSecurityDescriptorDacl
SetFileSecurityW
SetEntriesInAclW
RevertToSelf
RegisterTraceGuidsW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegGetKeySecurity
RegDisablePredefinedCache
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
GetTraceEnableLevel
GetTraceEnableFlags
GetTokenInformation
GetSecurityInfo
GetLengthSid
EqualSid
DuplicateTokenEx
DuplicateToken
CreateWellKnownSid
CreateRestrictedToken
CreateProcessAsUserW
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW

user32

GetWindowLongW
AdjustWindowRectEx
BeginPaint
CallNextHookEx
CallWindowProcW
CharUpperW
CheckMenuItem
ClientToScreen
CloseDesktop
CloseWindowStation
keybd_event
WinHelpW
WaitMessage
WaitForInputIdle
ValidateRect
UpdateWindow
UnregisterClassW
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
ToAsciiEx
TabbedTextOutW
SystemParametersInfoA
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowLongW
SetPropW
SetProcessWindowStation
SetLayeredWindowAttributes
SetForegroundWindow
SetFocus
SetDebugErrorLevel
SetCursor
SetActiveWindow
SendMessageW
SendDlgItemMessageW
SendDlgItemMessageA
ScreenToClient
RemovePropW
ReleaseDC
RegisterWindowMessageW
RegisterShellHookWindow
PtInRect
PostThreadMessageW
PostQuitMessage
PeekMessageW
PeekMessageA
PackDDElParam
OpenInputDesktop
ModifyMenuW
MessageBoxW
MapWindowPoints
MapDialogRect
LockSetForegroundWindow
LoadStringW
LoadCursorW
LoadBitmapW
IsWindowVisible
IsWindow
IsRectEmpty
IsIconic
IsClipboardFormatAvailable
InternalGetWindowText
InSendMessage
ImpersonateDdeClientWindow
GrayStringW
GetWindowTextW
GetWindowTextLengthW
GetWindowPlacement
GetWindowContextHelpId
GetUserObjectInformationW
GetThreadDesktop
GetSystemMetrics
GetSysColorBrush
GetSysColor
GetSubMenu
GetQueueStatus
GetPropW
GetProcessWindowStation
GetParent
GetNextDlgTabItem
GetNextDlgGroupItem
GetMessageW
GetMessageTime
GetMessagePos
GetMenuState
GetMenuItemID
GetMenuCheckMarkDimensions
GetMenu
GetLastActivePopup
GetInputState
GetForegroundWindow
GetFocus
GetDlgCtrlID
GetCursorPos
GetCursorInfo
GetClipboardSequenceNumber
GetClientRect
GetClassNameW
GetClassLongW
GetClassInfoW
GetCaretBlinkTime
GetCapture
GetAsyncKeyState
GetActiveWindow
FlashWindow
FillRect
ExitWindowsEx
EndPaint
EndDialog
EnableScrollBar
EnableMenuItem
DrawTextW
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DefWindowProcW
DdeUnaccessData
DdeClientTransaction
DdeAbandonTransaction
CreateWindowStationW
CreateWindowExW
CreateDialogIndirectParamW
CreateDesktopW
CreateCursor
CopyRect
CopyImage

odbc32

ord68
ord61
ord37
ord59
LockHandle
ord26

winmm

waveInGetPosition
waveInReset
timeGetTime
waveOutSetVolume
mmioFlush
mixerSetControlDetails
mixerGetNumDevs
midiOutShortMsg
midiOutPrepareHeader
midiInGetNumDevs
midiInClose
joyGetNumDevs
waveOutPause
GetDriverModuleHandle

version

GetFileVersionInfoW
VerFindFileW
VerInstallFileA
VerInstallFileW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerFindFileA

msvcrt

_mbsnset
_mbsnicoll
_mbsspnp
_mbsstr
_mbstok
_mbsupr
_memccpy
_memicmp
_mkdir
_mktemp
_mktime64
_nextafter
_open
_osplatform
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_purecall
_putch
_putw
_safe_fdiv
_safe_fdivr
_safe_fprem1
_scalb
_seh_longjmp_unwind
_set_error_mode
_seterrormode
_setjmp
_setjmp3
_setmaxstdio
_setmode
_sleep
_snprintf
_sopen
_spawnl
_spawnle
_spawnlpe
_spawnvp
_stat
_stat64
_strcmpi
_strdate
_strerror
_strlwr
_strnset
_strset
_strtime
_strupr
_sys_errlist
_tell
_telli64
_tempnam
_time64
_timezone
_tolower
_toupper
_tzname
_ui64toa
_ui64tow
_ultoa
_ultow
_ungetch
_unlink
_unlock
_utime
_vsnwprintf
_wasctime
_wchdir
_wchmod
_wcmdln
_wcsicmp
_wcsnicoll
_wcsnset
_wctime64
_wexecle
_wexecv
_wexecvp
_wexecvpe
_wfdopen
_wfindfirst
_wfindnext
_wfindnext64
_wfindnexti64
_wfopen
_winmajor
_winminor
_wmakepath
_wmkdir
_wperror
_wpopen
_wrename
_wrmdir
_wsetlocale
_wsopen
_wspawnlp
_wspawnv
_wspawnve
_wsplitpath
_wstat
_wstat64
_wsystem
_wtoi64
_wutime
_y1
abort
acos
asin
atan2
atexit
atoi
atol
bsearch
calloc
ceil
clearerr
clock
cosh
ctime
exit
fclose
feof
fgetpos
fgets
floor
fmod
fopen
fputc
fputs
fputws
frexp
fscanf
fseek
ftell
fwprintf
fwrite
fwscanf
getc
getchar
getenv
gets
getwchar
isalpha
iscntrl
isdigit
isgraph
islower
isprint
isspace
iswalnum
iswalpha
iswascii
iswctype
iswgraph
iswlower
iswupper
iswxdigit
labs
ldexp
ldiv
localeconv
localtime
log
longjmp
mbstowcs
mbtowc
memcmp
memcpy
modf
perror
putc
putchar
puts
rand
realloc
rewind
setbuf
setlocale
signal
sin
sprintf
sqrt
srand
sscanf
strchr
strcmp
strcpy
strcspn
strerror
strftime
strncpy
strpbrk
strstr
strtod
strtok
strtol
strtoul
strxfrm
swprintf
tan
tanh
tmpfile
tmpnam
tolower
towlower
towupper
ungetc
vfprintf
vprintf
vsprintf
vswprintf
vwprintf
wcscat
wcschr
wcscmp
wcscoll
wcsftime
wcslen
wcsncmp
wcsncpy
wcsrchr
wcstod
wcstol
wcstombs
wcsxfrm
wctomb
wscanf
_mbsnicmp
_mbsnccnt
_mbsncat
_mbsnbicoll
_mbsnbcoll
_mbsnbcnt
_mbsnbcmp
_mbsicoll
_mbsicmp
_mbsdup
_mbsdec
_mbscspn
_mbscpy
_mbscmp
_mbscat
_mbctombb
_mbctolower
_mbctokata
_mbctohira
_mbclen
_mbcjmstojis
_mbcjistojms
_mbccpy
_mbbtype
_mbbtombc
_ltow
_lseeki64
_lsearch
_lrotr
_lrotl
_longjmpex
_logb
_locking
_lock
_localtime64
_loaddll
_lfind
_jn
_itoa
_isnan
_ismbstrail
_ismbslead
_ismbcupper
_ismbcsymbol
_ismbcspace
_ismbclower
_ismbcl1
_ismbcl0
_ismbckata
_ismbcgraph
_ismbcdigit
_ismbcalpha
_ismbcalnum
_ismbbtrail
_ismbbpunct
_ismbbprint
_ismbblead
_ismbbkprint
_ismbbkana
_ismbbkalnum
_ismbbgraph
_ismbbalpha
_ismbbalnum
_isctype
_inpd
_initterm
_i64tow
_hypot
_heapwalk
_heapmin
_heapchk
_heapadd
_gmtime64
_global_unwind2
_getws
_getw
_getpid
_getdrives
_getdrive
_getdcwd
_getcwd
_getche
_getch
_get_sbh_threshold
_get_osfhandle
_gcvt
_futime
_fullpath
_ftime64
_fstat64
_fsopen
_fpclass
_flushall
_flsbuf
_finite
_findnext64
_findfirst64
_findfirst
_findclose
_fileno
_filelengthi64
_filelength
_fileinfo
_filbuf
_fcvt
_fcloseall
_execvp
_execve
_execlp
_except_handler3
_except_handler2
_errno
_eof
_environ
_endthreadex
_endthread
_ecvt
_dup2
_daylight
_ctype
_ctime64
_creat
_cputs
_copysign
_controlfp
_close
_clearfp
_chmod
_chkesp
_chgsign
_chdrive
_chdir
_cexit
_callnewh
_cabs
_c_exit
_beginthreadex
_beep
_atoi64
_atodbl
_amsg_exit
_adjust_fdiv
_adj_fptan
_adj_fprem1
_adj_fpatan
_adj_fdivr_m64
_adj_fdivr_m32i
_adj_fdiv_m64
_adj_fdiv_m32i
_acmdln
_access
_abnormal_termination
__wgetmainargs
__wargv
__toascii
__threadhandle
__setlc_active
__pxcptinfoptrs
__pioinfo
__p__winminor
__p__winmajor
__p__wenviron
__p__wcmdln
__p__timezone
__p__pwctype
__p__pgmptr
__p__pctype
__p__osver
__p__fileinfo
__p__environ
__p__dstbias
__p__amblksiz
__p__acmdln
__p___mb_cur_max
__p___argc
__lc_handle
__lc_collate_cp
__lc_codepage
__iscsymf
__isascii
__RTtypeid
__RTDynamicCast
__CxxFrameHandler
_XcptFilter
_Getmonths
_EH_prolog
_CxxThrowException
_CItan
_CIsinh
_CIsin
_CIpow
_CIlog10
_CIlog
_CIfmod
_CIexp
_CIatan
_CIacos
_mbspbrk

opengl32

glTexCoord4dv
glTexImage2D
glTexCoord3s
glAccum
glNormal3fv
glNormal3f
glNormal3b
glLoadName
glLightModelf
glGetFloatv
glEvalCoord1d
glDepthFunc
glCullFace
glColor3bv
glClearAccum
glBlendFunc
glTranslatef
wglGetPixelFormat
glVertex4sv
glVertex4f

kernel32

GetCommandLineW
GetCommMask
GetCPInfo
GetACP
FreeLibrary
FormatMessageA
FlushFileBuffers
FindResourceW
ExpandEnvironmentStringsW
ExitThread
ExitProcess
EnterCriticalSection
DuplicateHandle
DeleteCriticalSection
DebugBreak
WriteFile
WriteProcessMemory
lstrlenW
CreateSemaphoreW
CreateRemoteThread
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateJobObjectW
CreateIoCompletionPort
CreateFileW
CreateFileMappingW
CreateFileA
CreateEventW
CloseHandle
CreateThread
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileType
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessTimes
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetVersionExW
GetWindowsDirectoryW
Heap32ListFirst
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IsDBCSLeadByte
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LockFile
LockResource
MapViewOfFile
MultiByteToWideChar
OpenEventW
OpenProcess
PeekNamedPipe
PostQueuedCompletionStatus
QueryDosDeviceW
QueryPerformanceCounter
RaiseException
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
RegisterWaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
RtlUnwind
SearchPathW
SetCommState
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
SetEvent
SetFilePointer
SetHandleCount
SetHandleInformation
SetInformationJobObject
SetLastError
SetMessageWaitingIndicator
SetNamedPipeHandleState
SetStdHandle
SetUnhandledExceptionFilter
SignalObjectAndWait
SizeofResource
SuspendThread
SystemTimeToFileTime
TerminateJobObject
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
UnhandledExceptionFilter
UnmapViewOfFile
UnregisterWaitEx
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteConsoleW
AssignProcessToJobObject

ws2_32

sendto
recvfrom
recv
ntohs
ntohl
inet_ntoa
htonl
gethostname
__WSAFDIsSet
WSCWriteProviderOrder
WSCInstallNameSpace
WSCEnumProtocols
WSASendDisconnect
WSAJoinLeaf
WSACloseEvent
WSACancelBlockingCall
WSAAsyncGetServByName

Sections

.text
Size: 201KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

221ff7a8030e57475d1a13ecf9af99aa

Headers

File Characteristics

Imports

winspool.drv

shlwapi

advapi32

user32

odbc32

winmm

version

msvcrt

opengl32

kernel32

ws2_32

Sections

.text Size: 201KB - Virtual size: 204KB

.rdata Size: 29KB - Virtual size: 31KB

.data Size: 22KB - Virtual size: 23KB

.idata Size: 19KB - Virtual size: 19KB

.rsrc Size: 9KB - Virtual size: 11KB

.text
Size: 201KB - Virtual size: 204KB

.rdata
Size: 29KB - Virtual size: 31KB

.data
Size: 22KB - Virtual size: 23KB

.idata
Size: 19KB - Virtual size: 19KB

.rsrc
Size: 9KB - Virtual size: 11KB