4e0ee94dc344f2c7231cd097c6b4abe38ff7c956055c7f97fab6184599eddd8e

Sharing

Copy URL

Twitter E-mail

General

Target

4e0ee94dc344f2c7231cd097c6b4abe38ff7c956055c7f97fab6184599eddd8e
Size

164KB
MD5

675242257006b6d157c686db76b765d1
SHA1

eeb2014ee940b79dbfd1dc3d311d8aa978b4c427
SHA256

4e0ee94dc344f2c7231cd097c6b4abe38ff7c956055c7f97fab6184599eddd8e
SHA512

f5c2bcaa2332331324bc3ce9c2e586932cc8620acc62cacafc6fbf093ee0e7c5d04db10565d0f87bbb3c0294721a539a43fe0100fe6ae9402fa2b1a86f23b1a4
SSDEEP

3072:GXhjKWEE5I4N/nmYUoxUgBpPR6aaw4iLYvL4RESviQDgOe:sKWEEBNeYCcpPR6aH4DvLj3

Score

N/A

Malware Config

Signatures

Files

4e0ee94dc344f2c7231cd097c6b4abe38ff7c956055c7f97fab6184599eddd8e
.dll windows x86

6853582b7de3ecdea4bcde83042b4358

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileAttributesA
FindClose
FindNextFileA
FindFirstFileA
GetPrivateProfileStringA
SetLastError
FlushFileBuffers
MoveFileExA
CreateFileMappingA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
GetWindowsDirectoryA
CreateFileA
SetStdHandle
GetFileSize
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
GetCurrentThread
GetCurrentProcess
LocalAlloc
GetModuleHandleA
Thread32First
Thread32Next
CreateToolhelp32Snapshot
Process32First
GetLastError
Process32Next
OpenProcess
Sleep
TerminateProcess
LocalFree
GetVersionExA
lstrcatA
lstrcpyA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetStartupInfoA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
WriteFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WideCharToMultiByte
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetModuleFileNameA
GetVersion
GetCommandLineA
HeapFree
HeapAlloc
RtlUnwind
ReadFile

user32

DestroyWindow
wsprintfA
LoadStringA
ExitWindowsEx
GetClassNameA
GetWindowInfo
EnumWindows
GetWindowThreadProcessId
PostThreadMessageA
MessageBoxA

gdi32

DeleteDC
CreateDCA
ExtEscape

advapi32

SetSecurityDescriptorGroup
RegDeleteKeyA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegDeleteValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegEnumKeyExA

setupapi

SetupDiGetINFClassA
SetupDiGetDeviceInstanceIdA
SetupDiSetSelectedDevice
SetupDiRemoveDevice
SetupDiBuildDriverInfoList
SetupDiDestroyDriverInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiClassGuidsFromNameA
SetupDiGetClassDevsA
SetupDiGetDeviceInstallParamsA
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceInstallParamsA
SetupDiCallClassInstaller
SetupDiGetSelectedDriverA

newdev

UpdateDriverForPlugAndPlayDevicesA

Exports

Exports

CreateProcessInstallW64DispDrv
NvEstimateDeviceCount
NvGenerateValidDeviceList
NvGetProcessorArchitecture
NvInstallNT4DispDrv
NvInstallW2KDispDrv
NvInstallW2KDispDrv2
NvInstallW2KDispDrvX
NvInstallW64DispDrv
NvKillProcess
NvKillWindowClass
NvRegUpdateForNonAdminUser
NvSetRestartDisplayMode
NvUninstallCrush
NvUninstallCrushSilent
NvUninstallNT4
NvUninstallNT4Silent

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6853582b7de3ecdea4bcde83042b4358

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

setupapi

newdev

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 56KB - Virtual size: 59KB

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 56KB - Virtual size: 59KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 8KB - Virtual size: 5KB