4b29264e2e90f4c323d28a7f470d98bc810f1ce20248da5f8c392cb8478331ae

Sharing

Copy URL Twitter E-mail

General

Target

4b29264e2e90f4c323d28a7f470d98bc810f1ce20248da5f8c392cb8478331ae
Size

97KB
MD5

718aa9af6fa6b6b51e60b53248304970
SHA1

aaeece515bc06103dcba771ae00afecf519fbcf8
SHA256

4b29264e2e90f4c323d28a7f470d98bc810f1ce20248da5f8c392cb8478331ae
SHA512

56891e62e685193e1f197a2b218e1a743fb0f4416bb94cc3ced5b8d2dd6fd651ec31eaa5f8309749a4420c6b2f01fb305b42fe8ed0eeb1adeccf20a0c36259bf
SSDEEP

1536:5Nuc4QlfadE0QE4uMct3/1/3j3xD3u4ZfQf5Qwi:5xDRad7Q5Lcth9DzZfQf5Qwi

Score

N/A

Malware Config

Signatures

Files

4b29264e2e90f4c323d28a7f470d98bc810f1ce20248da5f8c392cb8478331ae
.exe windows x86

c87a7cf76ac1ac26eb9cd8375ba174ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
ExitProcess
OpenFileMappingA
CloseHandle
GetVersionExA
DeleteCriticalSection
VirtualProtect
GetModuleHandleA
GetModuleFileNameA
CreateFileMappingA
EnterCriticalSection
VirtualAlloc
lstrcmpiA
LeaveCriticalSection
GetSystemWindowsDirectoryA
TerminateThread
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileA
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
ReadFile
MultiByteToWideChar
RtlUnwind
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
WriteFile
Sleep
GetModuleHandleW
HeapReAlloc
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
GetCommandLineA
CreateThread
GetCurrentThreadId
ExitThread
HeapAlloc
HeapFree
GetLastError
InitializeCriticalSection
ExpandEnvironmentStringsA
VirtualFree
GetTickCount
GetFileAttributesExA
WaitForSingleObject
MapViewOfFileEx
lstrcpynA
UnmapViewOfFile
lstrlenA
lstrcmpA
GetProcAddress
LoadLibraryA
SetEndOfFile

gdi32

GetRandomRgn
RestoreDC
GetClipRgn
GetCharABCWidthsI
SetBitmapBits
SetWindowOrgEx
GetDeviceGammaRamp
FrameRgn
GetICMProfileW
SetMetaFileBitsEx
GetICMProfileA
GetEnhMetaFileA
WidenPath
GetCharABCWidthsFloatW
DrawEscape
GetOutlineTextMetricsA
MaskBlt
GetROP2
GetCharacterPlacementW
CreateHatchBrush
GetBkMode
StretchBlt
SetBkColor
SetMiterLimit
GetWinMetaFileBits
PlayMetaFileRecord
GetDCOrgEx
SetBkMode
CheckColorsInGamut
GetKerningPairsA
PlayEnhMetaFile
CombineRgn
GdiSetBatchLimit
EnumICMProfilesW
GetOutlineTextMetricsW
PtVisible
EndPath
SetMapperFlags
PolylineTo
SetDCPenColor
GetCharacterPlacementA
PlayEnhMetaFileRecord
GetBkColor
GetDIBColorTable
CopyEnhMetaFileW
EnumFontFamiliesA
SetPixelV
GetNearestColor
GetTextExtentPointA
ModifyWorldTransform
GetCharABCWidthsFloatA
CreatePatternBrush
SetTextJustification
SetViewportExtEx
GdiGradientFill
ChoosePixelFormat
EnumFontFamiliesExW
RectVisible
SetTextAlign
GetPixel
EndDoc
PaintRgn
CreateEnhMetaFileW
GdiComment
GetBrushOrgEx

comdlg32

FindTextW
PrintDlgW

ole32

CoInitialize

activeds

ord21
ord3
ord7
ord17
ord23
ord19
ord6
ord12
ord13
ord14

comsvcs

RecycleSurrogate
CoCreateActivity

crypt32

CertSerializeCertificateStoreElement
CertCreateCTLEntryFromCertificateContextProperties
CertRDNValueToStrW
CryptStringToBinaryW
CertDuplicateCTLContext
CryptGetKeyIdentifierProperty
CertAddSerializedElementToStore
CryptMsgCountersign
CertRemoveEnhancedKeyUsageIdentifier
CertFreeCertificateChainEngine
CryptSignAndEncryptMessage
CertEnumSystemStoreLocation
CryptSignAndEncodeCertificate
CryptMsgGetParam
CryptInitOIDFunctionSet
CryptMemRealloc
CertFreeCTLContext
CertSetCertificateContextPropertiesFromCTLEntry
CryptMsgOpenToEncode
CertEnumCertificatesInStore
CertAddEncodedCertificateToSystemStoreW
CryptDecryptAndVerifyMessageSignature
CertFindChainInStore
CryptVerifyCertificateSignature
CertEnumCTLsInStore
CertDeleteCTLFromStore
CertGetCertificateContextProperty
CertSerializeCRLStoreElement
CryptMsgUpdate
CertGetNameStringA
CryptDecodeMessage
CertGetCRLFromStore
CryptInstallOIDFunctionAddress
CertVerifySubjectCertificateContext
CryptImportPublicKeyInfoEx
CertCreateCertificateChainEngine
CertCloseStore
CertStrToNameW
CertFindCertificateInStore
CryptInstallDefaultContext
CertEnumCTLContextProperties
CertCompareCertificate
CertAddCertificateContextToStore
CertFindCTLInStore
CertSerializeCTLStoreElement
CertFreeCertificateContext
CertGetIntendedKeyUsage
PFXVerifyPassword
CertFindAttribute
CryptMsgCalculateEncodedLength
CertEnumPhysicalStore
CertFindExtension
CertCompareIntegerBlob
CertDuplicateCertificateChain
CertVerifyRevocation
CryptMsgSignCTL
CertFreeCertificateChain
CryptSetAsyncParam
CertVerifyCRLRevocation
CertEnumCRLsInStore
CryptMsgDuplicate
CryptMemFree
CertGetEnhancedKeyUsage
CertFindSubjectInCTL
CryptFindLocalizedName
CryptSignMessage
CryptEnumOIDFunction
CryptMsgOpenToDecode
CertResyncCertificateChainEngine
CryptProtectData
CertVerifyCTLUsage
CertAddEncodedCTLToStore
CertVerifyTimeValidity
CertAddStoreToCollection
CertControlStore
CertFindRDNAttr
CertAddEnhancedKeyUsageIdentifier
CryptUnprotectData
CryptEnumKeyIdentifierProperties
CertAddEncodedCRLToStore
CertGetSubjectCertificateFromStore
CertSetCertificateContextProperty
CryptVerifyDetachedMessageSignature
CryptCreateAsyncHandle
PFXExportCertStoreEx
CryptGetDefaultOIDDllList
CryptGetOIDFunctionAddress
PFXExportCertStore
CryptHashToBeSigned
CryptMsgControl
CryptExportPublicKeyInfo
CertFindSubjectInSortedCTL
CertIsValidCRLForCertificate
CertOIDToAlgId
CryptMsgVerifyCountersignatureEncodedEx
CertSetStoreProperty
CryptVerifyMessageSignature
CryptExportPKCS8
CryptSignMessageWithKey
CryptCreateKeyIdentifierFromCSP
CertAddCTLLinkToStore
CertAddCTLContextToStore
CryptAcquireCertificatePrivateKey
CryptSetKeyIdentifierProperty
CryptFormatObject
CertIsRDNAttrsInCertificateName
CertDeleteCRLFromStore
CryptMsgCountersignEncoded
CryptMsgClose
CryptMsgEncodeAndSignCTL
CertAddCRLLinkToStore
CryptDecodeObject
CertRemoveStoreFromCollection
CertAlgIdToOID
CertRDNValueToStrA
CryptFreeOIDFunctionAddress
CryptStringToBinaryA
CryptGetMessageSignerCount
CryptSignCertificate
CertAddCertificateLinkToStore

imm32

ImmNotifyIME
ImmGetCandidateListCountW
ImmEnumRegisterWordA
ImmGetConversionStatus
ImmSetStatusWindowPos
ImmGetConversionListW
ImmGetProperty
ImmConfigureIMEW
ImmGetDefaultIMEWnd
ImmAssociateContext
ImmInstallIMEW
ImmGetCandidateListW
ImmInstallIMEA
ImmGetVirtualKey
ImmGetImeMenuItemsW
ImmGetCompositionWindow
ImmUnregisterWordW
ImmSetCompositionStringW
ImmGetGuideLineA
ImmEscapeW
ImmSetCompositionFontA
ImmRegisterWordW
ImmEnumInputContext
ImmGetIMEFileNameA
ImmUnregisterWordA
ImmDestroyContext
ImmSetCompositionStringA
ImmIsIME
ImmGetCompositionFontA
ImmDisableTextFrameService
ImmRegisterWordA
ImmReleaseContext
ImmSetCompositionFontW
ImmGetGuideLineW
ImmGetCompositionStringW
ImmDisableIME
ImmGetStatusWindowPos

iphlpapi

GetTcpStatistics
NhpAllocateAndGetInterfaceInfoFromStack
IpRenewAddress
GetAdapterOrderMap
GetIpStatisticsEx
GetOwnerModuleFromTcpEntry
GetPerAdapterInfo
GetExtendedUdpTable
GetIfTable
SendARP
CreateIpNetEntry
DisableMediaSense
GetIpStatistics
EnableRouter
SetTcpEntry
GetRTTAndHopCount
GetUniDirectionalAdapterInfo
GetUdpStatistics
DeleteIpForwardEntry
GetUdpStatisticsEx
GetNumberOfInterfaces
GetAdaptersInfo
CreateIpForwardEntry
GetIfEntry
SetIpStatistics
DeleteProxyArpEntry
GetBestInterfaceEx
CancelIPChangeNotify
CreateProxyArpEntry
GetNetworkParams

msi

ord157
ord129
ord11
ord41
ord261
ord69
ord7
ord108
ord44
ord217
ord214
ord178
ord208
ord247
ord15
ord59
ord244
ord228
ord192
ord240
ord55
ord107

msimg32

AlphaBlend

comctl32

UninitializeFlatSB
ImageList_GetIcon
ImageList_DrawEx
ImageList_EndDrag
ord323
ImageList_Remove
ImageList_BeginDrag
FlatSB_SetScrollInfo
ImageList_Add
ImageList_Read
ord337
InitializeFlatSB
FlatSB_SetScrollPos
CreateToolbarEx
ord324
ord2

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c87a7cf76ac1ac26eb9cd8375ba174ed

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

comdlg32

ole32

activeds

comsvcs

crypt32

imm32

iphlpapi

msi

msimg32

comctl32

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 14KB - Virtual size: 21KB

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 14KB - Virtual size: 21KB