5d03517af36fd81fb9ec9a45c2681531ca1b2b7eab7d1eb64b90b0d3ce48fc7e

Sharing

Copy URL

Twitter E-mail

General

Target

5d03517af36fd81fb9ec9a45c2681531ca1b2b7eab7d1eb64b90b0d3ce48fc7e
Size

204KB
MD5

371d65d10b1da682b871abf31fed4c60
SHA1

027379de5aa10f9e6794620ecd5c9a60649d50f1
SHA256

5d03517af36fd81fb9ec9a45c2681531ca1b2b7eab7d1eb64b90b0d3ce48fc7e
SHA512

19c007097fe55f2471e232d723264894611d8f752bc99a4673d2ac50d0909afe67f1d3f0d5601f1ef027ee9343d601a7de3d2ac8e0b27360613547eac3a060cd
SSDEEP

6144:LwDV3qqDL1joW46Pfis9+bRxwEbggifBPX74jHLXCnRb:LwDVaqnho5esRxwq8RkjHenRb

Score

N/A

Malware Config

Signatures

Files

5d03517af36fd81fb9ec9a45c2681531ca1b2b7eab7d1eb64b90b0d3ce48fc7e
.exe windows x86

afa869a9d0292621df01ca4c7570142b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointerEx
GetLogicalDriveStringsW
HeapFree
CreateDirectoryW
GetProcessHeap
SetFileTime
VirtualQueryEx
OpenProcess
Thread32First
WideCharToMultiByte
LoadLibraryW
ReadProcessMemory
HeapDestroy
HeapCreate
lstrcpynW
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
VirtualProtectEx
WriteFile
FindClose
RemoveDirectoryW
QueryDosDeviceW
FindNextFileW
SystemTimeToFileTime
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
CreateRemoteThread
Process32FirstW
Process32NextW
MoveFileExW
GetUserDefaultUILanguage
lstrcmpiA
WTSGetActiveConsoleSessionId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetNativeSystemInfo
SetHandleInformation
CreatePipe
GetPrivateProfileStringW
GetLocalTime
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
TlsGetValue
GetModuleHandleA
GetFileAttributesW
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GlobalUnlock
GlobalLock
GetPrivateProfileIntW
FlushFileBuffers
VirtualProtect
CreateFileW
IsBadReadPtr
GetProcessId
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
InitializeCriticalSection
SetThreadContext
GetThreadContext
CreateThread
GetSystemTime
ExitThread
GetCurrentProcess
ExpandEnvironmentStringsW
WriteProcessMemory
LocalFree
GetCurrentProcessId
CloseHandle
DuplicateHandle
OpenEventW
WaitForMultipleObjects
FreeLibrary
CreateEventW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
SetEvent
GetComputerNameW
SetErrorMode
GetCommandLineW
GetFileAttributesExW
GetModuleFileNameW
GetModuleHandleW
ExitProcess
GetCurrentThreadId
SetLastError
GetTickCount
ReleaseMutex
WaitForSingleObject
lstrcmpiW
LoadLibraryA
GetProcAddress
VirtualAllocEx

user32

CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
ExitWindowsEx
MessageBoxA
GetKeyboardLayoutList
EndPaint
GetUpdateRgn
RegisterClassExA
GetWindowDC
DefDlgProcW
DefFrameProcA
CloseWindowStation
GetUpdateRect
GetDC
TranslateMessage
RegisterClassExW
GetClipboardData
GetDCEx
ReleaseDC
DefWindowProcA
DefMDIChildProcW
GetWindow
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
CallWindowProcW
DefWindowProcW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
CharLowerW
PrintWindow
CharLowerBuffA
MapVirtualKeyW
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharToOemW
CharUpperW
BeginPaint
SetWindowLongW
DefFrameProcW
RegisterClassA
GetMessageA
DispatchMessageW
GetKeyboardState
ToUnicode
FillRect
DrawEdge
IntersectRect
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
SendMessageTimeoutW
IsWindow
ReleaseCapture
SendMessageW
PostThreadMessageW
SwitchDesktop
EqualRect
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
GetSystemMetrics
DrawIcon
GetIconInfo
GetCursorPos
OpenInputDesktop

advapi32

CreateProcessAsUserA
CreateProcessAsUserW
IsWellKnownSid
GetLengthSid
InitiateSystemShutdownExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
RegOpenKeyExW
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegEnumKeyExW
EqualSid
RegCreateKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumValueW
ConvertSidToStringSidW
RegEnumKeyW

shlwapi

PathAddExtensionW
PathQuoteSpacesW
StrCmpNIW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathRenameExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveFileSpecW
PathIsURLW
PathRemoveBackslashW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

SelectObject
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap
GetDIBits
GetDeviceCaps
CreateDIBSection
DeleteObject

ws2_32

closesocket
WSASend
getaddrinfo
accept
getsockname
WSAEventSelect
listen
WSASetLastError
inet_addr
getpeername
recvfrom
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
gethostbyname
send
WSAGetLastError
socket
bind
recv
sendto
setsockopt
shutdown
select
freeaddrinfo

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore

wininet

InternetReadFileExA
InternetReadFile
HttpSendRequestW
HttpOpenRequestA
HttpEndRequestA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetSetStatusCallbackA
InternetQueryOptionA
InternetOpenA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpEndRequestW
HttpSendRequestA
InternetQueryDataAvailable
InternetSetFilePointer
HttpSendRequestExA
HttpQueryInfoA
HttpSendRequestExW
HttpOpenRequestW

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

afa869a9d0292621df01ca4c7570142b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 192KB - Virtual size: 192KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 192KB - Virtual size: 192KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 7KB