a2edebe13281b55a39f2d492c9f082bb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a2edebe13281b55a39f2d492c9f082bb.exe
Size

207KB
MD5

a2edebe13281b55a39f2d492c9f082bb
SHA1

e2da652c2f50b14b40c43ade2833870d7269ca01
SHA256

8aa42c477d96d5cf3a5d9ea88ebc6e82d8db7970f85fd03924447040e2758a96
SHA512

81515b9322a4386ac70c857f0dd0eef9a83f4b101cfaed781eefd55ac779d4ed7b6daa772b105918c3a67394f1260a30eb74b301e440628b4f8cde1cd7017a64
SSDEEP

6144:NNUHeDjao6tuUugQQK+VJet/7xe27sZIH7Kajj5XfRKBcy:0HQYb9lK+C/Au7KaHq

Score

N/A

Malware Config

Signatures

Files

a2edebe13281b55a39f2d492c9f082bb.exe
.exe windows x86

3840d23b451979fd0e44ea1e48be5e3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathQuoteSpacesW
PathCompactPathExW
PathIsFileSpecW
SHCreateThreadRef
PathSetDlgItemPathA
PathRelativePathToW
StrCmpLogicalW
StrCSpnIA
PathStripPathW
SHRegDeleteEmptyUSKeyA
UrlIsNoHistoryW
SHCreateStreamOnFileA
PathFileExistsW
PathQuoteSpacesA
SHOpenRegStreamW
DllGetVersion
SHGetValueA
PathIsURLW
StrCmpNIA
PathIsSameRootW
SHRegGetValueW
StrCmpICA
SHDeleteEmptyKeyA
UrlGetLocationW
PathCombineA
StrRStrIW
SHQueryValueExW
StrFormatByteSizeA
StrCatW
PathIsUNCServerW
UrlCreateFromPathA
PathMakePrettyW
StrChrNW
StrCpyNW
PathUnExpandEnvStringsW
StrTrimA
SHGetThreadRef
PathRenameExtensionA
SHEnumValueA
PathRemoveExtensionA
SHCreateStreamOnFileEx
StrRetToStrA
StrSpnA
StrStrIA
UrlHashW
PathMatchSpecW
PathRemoveArgsA
UrlGetPartA
PathGetDriveNumberA
StrRetToStrW
SHRegWriteUSValueW
IntlStrEqWorkerW
PathCommonPrefixW
SHRegOpenUSKeyW
UrlCompareW
StrCmpNIW
StrFromTimeIntervalA
PathIsPrefixA
PathAddExtensionW
StrCmpCW
PathUnmakeSystemFolderW
UrlHashA
UrlCombineW
SHRegQueryInfoUSKeyA
StrToIntW
ColorHLSToRGB
SHAutoComplete
StrRetToBufA
SHEnumValueW
PathRemoveBackslashW
SHQueryInfoKeyA
PathParseIconLocationW
StrRChrA
AssocQueryKeyW
SHGetValueW
StrCmpCA
StrToIntA
PathIsPrefixW
PathFindSuffixArrayA
StrTrimW
StrRChrIW
UrlIsNoHistoryA
UrlApplySchemeA
UrlIsW
SHRegEnumUSValueW

gdi32

GdiPlayPrivatePageEMF
SetBrushAttributes
CombineRgn
GetCurrentPositionEx
GdiValidateHandle
GetWindowExtEx
StartDocA
EngAlphaBlend
EngUnlockSurface
GetTransform
DdEntry23
FONTOBJ_pvTrueTypeFontFile
EngCreateBitmap
FillRgn
EngFindResource
GdiPlayJournal
BRUSHOBJ_pvGetRbrush
GdiSetLastError
GetTextExtentPoint32A
FONTOBJ_pQueryGlyphAttrs
XLATEOBJ_piVector
DdEntry56
DdEntry7
OffsetViewportOrgEx
PtInRegion
GetCharacterPlacementW
SetLayoutWidth
ExcludeClipRect
GetDeviceGammaRamp
GetETM
DdEntry27
EngDeleteClip
MaskBlt
RemoveFontMemResourceEx
DdEntry11
EngCreateDeviceSurface
DdEntry24
GetLogColorSpaceA
SetDCBrushColor
CreateDIBPatternBrush
BitBlt
Chord
GetEnhMetaFileHeader
SetPixelV
GdiPlayPageEMF
FixBrushOrgEx
SetColorSpace
GdiInitSpool
EngCheckAbort
EngComputeGlyphSet
GetEnhMetaFileDescriptionA
UnrealizeObject
IntersectClipRect
GetOutlineTextMetricsW
CreateEllipticRgnIndirect
GdiEntry4
EngMultiByteToUnicodeN
SetICMMode
Arc
GdiComment
GetBrushAttributes
GetRasterizerCaps
SwapBuffers
GdiConvertEnhMetaFile
ColorMatchToTarget
GetPolyFillMode
SetViewportExtEx
GetStretchBltMode
EudcLoadLinkW
EngFreeModule
SetMiterLimit
CreateEllipticRgn
GdiConvertAndCheckDC
GdiSetAttrs
ScaleWindowExtEx
SetEnhMetaFileBits
SetColorAdjustment
CreateDCA
ChoosePixelFormat
CreateRoundRectRgn
GetDCBrushColor
GdiEntry16
GetMetaFileA
EngFillPath
GetGlyphIndicesW
CLIPOBJ_bEnum
EngCreatePalette
ResizePalette
DeleteEnhMetaFile
GetTextExtentExPointI
EndPath
DdEntry42
PaintRgn
PolyBezierTo
SetViewportOrgEx

shell32

ShellAboutW
SHAddToRecentDocs
StrRChrA
SHMultiFileProperties
ShellExecuteExA
Win32DeleteFile
FindExecutableW
IsLFNDrive
SHGetNewLinkInfoW
DAD_DragLeave
SHEnumerateUnreadMailAccountsW
Options_RunDLLW
SHInvokePrinterCommandW
DAD_ShowDragImage
ShellMessageBoxW
Control_RunDLLAsUserW
ShellExecuteExW
DAD_AutoScroll
FindExecutableA
StrStrIA
ILAppendID
SHSetUnreadMailCountW
DAD_SetDragImage
SHFind_InitMenuPopup
SHSetLocalizedName
SHFileOperationW
ExtractIconExA
DragFinish
IsNetDrive
SHGetNewLinkInfoA
SHAppBarMessage
SHFlushSFCache
PifMgr_SetProperties
OpenAs_RunDLLW
CommandLineToArgvW
ILCreateFromPath
SheChangeDirExW
SHStartNetConnectionDialogW
SHGetFileInfo
OpenAs_RunDLL
ILGetSize
ILRemoveLastID
SHCreateDirectory
SHHelpShortcuts_RunDLLA
Shell_GetImageLists
SHDestroyPropSheetExtArray
SheSetCurDrive
SHEmptyRecycleBinW
Control_RunDLLA
ExtractAssociatedIconExW
SHLoadNonloadedIconOverlayIdentifiers
Shell_MergeMenus
SHBrowseForFolderA
SHBindToParent
SheGetDirA
SHGetDataFromIDListA
ExtractIconEx
ExtractAssociatedIconA
SHTestTokenMembership
RealDriveType
SHGetMalloc
Shell_NotifyIcon
RealShellExecuteW
StrNCmpA
SHPropStgReadMultiple
SHChangeNotifyDeregister
SHGetFileInfoW
SHGetSettings
SHChangeNotifyRegister
IsLFNDriveW
SHPropStgCreate
SHGetUnreadMailCountW
StrCmpNW
WriteCabinetState
ShellExecuteA
OpenRegStream
PathMakeUniqueName
ILGetNext
SHGetAttributesFromDataObject
PathGetShortPath
PifMgr_GetProperties
StrChrA
StrChrIA
DAD_DragMove
PifMgr_CloseProperties
ILCloneFirst
RealShellExecuteExW
StrRStrIW
SHGetDataFromIDListW
ExtractIconA

user32

GetMenuItemInfoW
CsrBroadcastSystemMessageExW
EnumPropsA
GetKeyboardLayoutNameA
DialogBoxParamW
DrawTextW
MapVirtualKeyExA
UnpackDDElParam
DdeQueryStringW
RegisterMessagePumpHook
UserClientDllInitialize
DrawFocusRect
GetMenuCheckMarkDimensions
OpenWindowStationW
DisableProcessWindowsGhosting
SetActiveWindow
WINNLSGetEnableStatus
ValidateRect
GetUpdateRgn
LoadKeyboardLayoutEx
DragDetect
SetUserObjectInformationA
LoadCursorFromFileW
ReuseDDElParam
GetScrollInfo
VRipOutput
GetClassInfoW
GetClientRect
PtInRect
PostQuitMessage
LoadCursorW
SetCapture
UserRegisterWowHandlers
IsCharAlphaNumericW
MapWindowPoints
GetClassWord
DdeCmpStringHandles
DdeCreateStringHandleW
GetAsyncKeyState
LoadKeyboardLayoutA
SendMessageTimeoutA
GetDialogBaseUnits
MonitorFromPoint
GetKeyboardType
GetTitleBarInfo
GetKeyNameTextW
VkKeyScanW
SetMenuItemBitmaps
RegisterLogonProcess
CopyAcceleratorTableW
IsWinEventHookInstalled
ResolveDesktopForWOW
FindWindowExW
CreateWindowStationA
IsWindowInDestroy
IsRectEmpty
CloseDesktop
FreeDDElParam
MessageBoxTimeoutA
IsCharAlphaA
GetSysColorBrush
DrawMenuBar
SetShellWindowEx
SetShellWindow
ChangeDisplaySettingsA
DialogBoxIndirectParamAorW
AllowForegroundActivation
DdeUnaccessData
OemToCharA
SetSysColors
SetMenuDefaultItem
CharNextW
SetMessageQueue
SendInput
UserHandleGrantAccess
LoadRemoteFonts
GetMenuItemID
PostMessageW
CharUpperBuffA
ScrollDC
WaitForInputIdle
LoadKeyboardLayoutW
DdeSetUserHandle
IMPSetIMEA
SetLayeredWindowAttributes
DrawIcon
EnumThreadWindows
DlgDirSelectComboBoxExA
SwapMouseButton
DdeCreateStringHandleA
GetKeyboardState
IsWindowUnicode
GetDCEx
InitializeLpkHooks
CreateIcon
PrivateExtractIconsA
TileChildWindows
RegisterSystemThread
SetWinEventHook
LoadImageA
SwitchToThisWindow
DdeGetData

kernel32

Thread32First
ClearCommBreak
GetVolumeInformationW
GetFileSizeEx
SetTapeParameters
ExitProcess
WaitForSingleObjectEx
CancelIo
GetComputerNameExA
RegisterWaitForInputIdle
CreateActCtxA
CancelTimerQueueTimer
AreFileApisANSI
EnumerateLocalComputerNamesA
GetLogicalDriveStringsW
SetEnvironmentVariableA
SetThreadPriority
InterlockedIncrement
GetCPInfo
LocalShrink
GetProcessAffinityMask
CreateTapePartition
VirtualAlloc
GetVersion
lstrcpyW
CancelDeviceWakeupRequest
DeleteTimerQueueTimer
Sleep
EndUpdateResourceA
RtlMoveMemory
Heap32ListNext
ReadConsoleOutputAttribute
WriteConsoleInputVDMA
GetTempPathA
AddConsoleAliasW
GetLargestConsoleWindowSize
RegisterConsoleOS2
GetModuleHandleA
GetSystemWindowsDirectoryW
GetSystemDefaultLangID
GlobalDeleteAtom
WaitForMultipleObjectsEx
SetComputerNameA
SetCommBreak
GetDiskFreeSpaceExA
GetProfileStringW
CreateProcessInternalA
SetFileTime
GetExitCodeProcess
GetModuleHandleW
ReadProcessMemory
OpenJobObjectA
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryW
GetHandleInformation
GetThreadPriorityBoost
GetTimeFormatW
QueueUserWorkItem
GetTempFileNameW
BackupRead
SetEnvironmentVariableW
SetConsoleCursorInfo
InitAtomTable
GetFirmwareEnvironmentVariableA
GetProcessTimes
GetPrivateProfileSectionNamesW
CloseConsoleHandle
DeleteFiber
FindVolumeClose
InterlockedDecrement
GetBinaryTypeW
IsBadWritePtr
SetLastError
FindResourceExA
GetNumaAvailableMemoryNode
SetConsoleTitleA
AddAtomW
EncodeSystemPointer
AddLocalAlternateComputerNameW
LocalFileTimeToFileTime
FreeResource
ReadConsoleInputW
GetOverlappedResult
SetProcessPriorityBoost
IsValidLocale
EnumResourceTypesW
LoadLibraryA
GetACP
GetSystemTimeAdjustment
_llseek
QueryMemoryResourceNotification
RequestDeviceWakeup
AddAtomA
lstrcmpi
GetSystemPowerStatus

advapi32

LsaGetQuotasForAccount
AccessCheckByTypeAndAuditAlarmA
RegSetValueA
LsaRemoveAccountRights
WmiSetSingleInstanceA
SystemFunction034
CredMarshalCredentialW
ElfBackupEventLogFileA
GetMultipleTrusteeA
SetUserFileEncryptionKey
SystemFunction013
LsaLookupSids
LsaQueryTrustedDomainInfoByName
SetSecurityDescriptorOwner
WmiSetSingleItemW
ChangeServiceConfigW
OpenEncryptedFileRawA
RegSaveKeyExW
DecryptFileW
EnumServicesStatusA
GetAuditedPermissionsFromAclW
RevertToSelf
ObjectDeleteAuditAlarmA
ConvertStringSidToSidA
SystemFunction025
WmiQueryGuidInformation
AccessCheckByType
IsTokenUntrusted
SaferRecordEventLogEntry
LsaEnumeratePrivilegesOfAccount
OpenBackupEventLogA
RegOpenKeyW
ReportEventW
AddUsersToEncryptedFile
I_ScPnPGetServiceName
GetManagedApplications
BuildExplicitAccessWithNameA
ChangeServiceConfig2W
GetAclInformation
LsaGetRemoteUserName
RegisterEventSourceW
AddAce
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetMultipleTrusteeW
WmiDevInstToInstanceNameA
SetServiceBits
CredFree
CreateProcessAsUserW
WmiQueryAllDataA
ImpersonateAnonymousToken
RegisterEventSourceA
SetEntriesInAuditListA
OpenServiceW
ConvertToAutoInheritPrivateObjectSecurity
CredEnumerateW
RegisterServiceCtrlHandlerA
ElfNumberOfRecords
RegQueryValueW
LsaLookupPrivilegeValue
RegQueryValueA
RegEnumValueW
OpenSCManagerW
QueryServiceConfigA
I_ScGetCurrentGroupStateW
SaferiPopulateDefaultsInRegistry
BuildTrusteeWithNameW
CredUnmarshalCredentialW
ElfRegisterEventSourceA
GetTokenInformation
CopySid
LsaCreateTrustedDomain
RegQueryMultipleValuesA
LsaClearAuditLog
GetUserNameA
RegOpenCurrentUser
CredpConvertTargetInfo
QueryServiceObjectSecurity
BuildTrusteeWithObjectsAndNameA
CredProfileLoaded
CryptCreateHash
LsaLookupPrivilegeDisplayName
SystemFunction029
LsaSetQuotasForAccount
WmiExecuteMethodA
CryptGetProvParam
ConvertAccessToSecurityDescriptorA
DeleteAce
CryptContextAddRef
MakeAbsoluteSD2
ConvertAccessToSecurityDescriptorW

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3840d23b451979fd0e44ea1e48be5e3d

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

gdi32

shell32

user32

kernel32

advapi32

Sections

.text Size: 155KB - Virtual size: 155KB

.idata Size: 15KB - Virtual size: 15KB

.rdata Size: 33KB - Virtual size: 33KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 155KB - Virtual size: 155KB

.idata
Size: 15KB - Virtual size: 15KB

.rdata
Size: 33KB - Virtual size: 33KB

.reloc
Size: 2KB - Virtual size: 1KB