2b340da3b36a3965bb096eb5da477d74ec9572cdd711e03a0581b6ba306a1ddc

Sharing

Copy URL Twitter E-mail

General

Target

2b340da3b36a3965bb096eb5da477d74ec9572cdd711e03a0581b6ba306a1ddc
Size

228KB
MD5

675c0584d95eb4f4a3c8bcaf98b852d9
SHA1

29e5069d85d989aff11d5882164234c5918ddc74
SHA256

2b340da3b36a3965bb096eb5da477d74ec9572cdd711e03a0581b6ba306a1ddc
SHA512

019b8ddce6ccd9346775fb858392d4018479b906ef9e7cc48201ef4f0bc0d35d1104699947b46ff88c49c617e0d803cb867f74468b12578eccb783ec249aee11
SSDEEP

3072:eAdB3a1EPjMgnElNdxRkwjcU5rBhRJgiAwdVy26YvSEAwlGEX+KXo2hVLJY:ew3a1EPDANdxewjciDT/YlYhlPXfo+

Score

N/A

Malware Config

Signatures

Files

2b340da3b36a3965bb096eb5da477d74ec9572cdd711e03a0581b6ba306a1ddc
.exe windows x86

28f48d4c6eb56da97dfe67a8900e7709

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmSetOpenStatus
ImmGetContext
ImmGetIMEFileNameA
ImmGetConversionStatus
ImmSetConversionStatus
ImmReleaseContext
ImmCreateContext
ImmAssociateContext
ImmDestroyContext
ImmNotifyIME
ImmIsIME

kernel32

WriteFile
SetFilePointer
CreateFileA
GetLocaleInfoA
GetSystemDirectoryA
DeleteFileA
GetSystemDefaultLCID
GetSystemInfo
RemoveDirectoryA
Sleep
lstrcpyW
lstrlenW
WideCharToMultiByte
lstrcmpA
GetWindowsDirectoryA
lstrcpynA
GetEnvironmentVariableA
CreateDirectoryA
GetPrivateProfileStringA
FlushFileBuffers
GetProcAddress
CompareStringW
SetStdHandle
ReadFile
SetConsoleCtrlHandler
GetTimeZoneInformation
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetCurrentDirectoryA
GetCurrentDirectoryA
GetFullPathNameA
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
TerminateProcess
LCMapStringW
LCMapStringA
HeapFree
ExitProcess
GetVersion
GetStartupInfoA
GetModuleHandleA
FindFirstFileA
InterlockedExchange
GetDriveTypeA
FileTimeToLocalFileTime
GetCurrentThread
GetCurrentProcess
GetLastError
FreeLibrary
LoadLibraryA
GetFileAttributesA
WinExec
lstrcatA
GetTickCount
ReleaseMutex
WaitForSingleObject
UnmapViewOfFile
CloseHandle
CreateMutexA
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
lstrlenA
lstrcpyA
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalHandle
GlobalUnlock
GlobalFree
lstrcmpiA
CompareStringA
GetCommandLineA
SetEnvironmentVariableA
FileTimeToSystemTime
FindClose
HeapAlloc
RtlUnwind
GetCurrentThreadId
SetLastError
GetVersionExA
LocalAlloc
GetModuleFileNameA
GetBinaryTypeA
LocalFree

user32

CharLowerA
LoadKeyboardLayoutA
SystemParametersInfoA
wsprintfA
IsCharAlphaA
GetKeyboardLayoutList
GetDlgItem
SetFocus
wsprintfW
DialogBoxParamA
DialogBoxParamW
FindWindowA
EnumChildWindows
GetDC
wvsprintfA
ReleaseDC
DrawTextW
DrawTextA
GetWindowTextLengthA
GetWindowTextLengthW
GetWindowTextW
GetWindowTextA
SetWindowTextW
SetWindowTextA
MessageBoxW
MessageBoxA
IsDialogMessageW
IsDialogMessageA
DefWindowProcW
DefWindowProcA
CallWindowProcW
CallWindowProcA
GetWindowLongW
GetWindowLongA
SetWindowLongW
SetWindowLongA
DispatchMessageW
DispatchMessageA
PeekMessageW
PeekMessageA
PostMessageW
IsWindowUnicode
SendMessageW
SendMessageA
GetClassNameA
SendMessageTimeoutA
PostMessageA
RegisterWindowMessageA
CharNextA
PostThreadMessageA
EnumWindows
UnloadKeyboardLayout
GetSysColor
GetKeyboardLayout
EndDialog

gdi32

TextOutW
TextOutA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorDacl
AllocateAndInitializeSid
IsValidSid
FreeSid
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegQueryValueExW
RegOpenKeyA
RegCreateKeyExW
RegSetValueExW
GetUserNameA
OpenThreadToken
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
InitializeSecurityDescriptor
RegSetKeySecurity
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
RegFlushKey
LookupPrivilegeValueA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegEnumValueA
RegDeleteValueA
RegSetValueExA
RegEnumKeyExA
RegUnLoadKeyA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc

ole32

CoInitialize
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoUninitialize

msi

ord81

Sections

_kelly_
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28f48d4c6eb56da97dfe67a8900e7709

Headers

File Characteristics

Imports

imm32

kernel32

user32

gdi32

advapi32

shell32

ole32

msi

Sections

_kelly_ Size: 144KB - Virtual size: 140KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 32KB - Virtual size: 42KB

.rsrc Size: 4KB - Virtual size: 1KB

.text Size: 24KB - Virtual size: 23KB

_kelly_
Size: 144KB - Virtual size: 140KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 32KB - Virtual size: 42KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 24KB - Virtual size: 23KB