f659a3780fbaf0b1a990f7670f6425c9b7878cdb121e871169d4ece8a5ad1e91

Sharing

Copy URL Twitter E-mail

General

Target

f659a3780fbaf0b1a990f7670f6425c9b7878cdb121e871169d4ece8a5ad1e91
Size

274KB
MD5

47c6e0a1033ac07c1b66c569053e8e20
SHA1

9d2fce7fb466cf8c7b43354e19df0533071538cc
SHA256

f659a3780fbaf0b1a990f7670f6425c9b7878cdb121e871169d4ece8a5ad1e91
SHA512

2799a95f6f070a86f22cb311e3a4d4478179097e1ef8c06ad7abd3776991cc42cbd56b09a124b5720cf31f3c391113285395057e1e1ec34af49ff74a3abf0d2f
SSDEEP

6144:eqEsnxk+vKwDq9GUf6+sm/ltOF4JlbDtQQoLQyR2BUru/sJ:QsxnvrslFbrbBQ/8ygUruUJ

Score

N/A

Malware Config

Signatures

Files

f659a3780fbaf0b1a990f7670f6425c9b7878cdb121e871169d4ece8a5ad1e91
.exe windows x86

c16c77f47d6ce7a7e9227285c2b9c340

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
GetProcAddress
FlushInstructionCache
FindResourceW
LeaveCriticalSection
GetModuleFileNameW
lstrlenA
GetProcessHeap
GetCurrentProcess
FreeLibrary
DeleteCriticalSection
InterlockedIncrement
lstrcmpiW
InterlockedDecrement
lstrcatW
lstrcpyW
lstrlenW
GetEnvironmentStringsA
HeapDestroy
LoadResource
VirtualFree
LoadLibraryA
MultiByteToWideChar
SetLastError
GetSystemInfo
SetUnhandledExceptionFilter
GetCurrentProcessId
lstrcpynW
GetTickCount
GetSystemTimeAsFileTime
SizeofResource
FormatMessageW
LocalFree
GetLastError
HeapFree
QueryPerformanceCounter
EnterCriticalSection
GetUserDefaultLCID
HeapAlloc

untfs

FormatEx
Chkdsk
Extend
ChkdskEx
Recover
Format

rpcrt4

NdrCStdStubBuffer_Release
NdrDllGetClassObject
CStdStubBuffer_AddRef
IUnknown_AddRef_Proxy
NdrOleFree
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrOleAllocate
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrDllRegisterProxy
NdrDllCanUnloadNow
IUnknown_Release_Proxy

user32

SetDlgItemTextW
MapWindowPoints
CharNextW
LoadImageW
CreateDialogParamW
SetWindowTextW
SetFocus
EndDialog
SendMessageW
SystemParametersInfoW
SetWindowPos
ShowWindow
GetDlgItem
GetDialogBaseUnits
DialogBoxParamW
GetWindow
EnableWindow
CopyRect
SendDlgItemMessageW
DestroyWindow
GetWindowRect
GetSystemMetrics
GetDlgItemTextW
GetWindowLongW
MessageBoxW
LoadStringW
GetClientRect
GetParent
DrawTextW
SetWindowLongW

advapi32

RegSetValueExW
RegisterTraceGuidsW
RegDeleteValueW
UnregisterTraceGuids
GetTraceLoggerHandle
RegDeleteKeyW
TraceMessage
GetTraceEnableLevel
RegEnumKeyExW
RegQueryInfoKeyW
GetTraceEnableFlags
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

netshell

HrGetIconFromMediaType

msvcrt

wcscat
??3@YAXPAX@Z
_adjust_fdiv
malloc
??2@YAPAXI@Z
wcslen
swprintf
wcsncpy
_except_handler3
__CxxFrameHandler
?terminate@@YAXXZ
realloc
_initterm
??1type_info@@UAE@XZ
free
wcscmp

ole32

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc

shell32

ShellExecuteW
SHGetFolderPathW

gdi32

SetBkMode

Sections

text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 650B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c16c77f47d6ce7a7e9227285c2b9c340

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

untfs

rpcrt4

user32

advapi32

netshell

msvcrt

ole32

shell32

gdi32

Sections

text Size: 86KB - Virtual size: 86KB

.rdata Size: 184KB - Virtual size: 184KB

.rsrc Size: 1024B - Virtual size: 650B

text
Size: 86KB - Virtual size: 86KB

.rdata
Size: 184KB - Virtual size: 184KB

.rsrc
Size: 1024B - Virtual size: 650B