8b54e1708d5c49f101eddcb38d4891371d9ca0785d65a85f256052ec4d9217b2

Sharing

Copy URL Twitter E-mail

General

Target

8b54e1708d5c49f101eddcb38d4891371d9ca0785d65a85f256052ec4d9217b2
Size

112KB
MD5

53cb23789eb8d60f3747593971914cc1
SHA1

c523a89978bc8b073c2c70e85b194714c1f981c8
SHA256

8b54e1708d5c49f101eddcb38d4891371d9ca0785d65a85f256052ec4d9217b2
SHA512

4aa95a299c8d6cf2e1ce0ccc6176f8ba123642ddca95177a0a9e722cd5f8dbcca11b695da63063c28dedacf72d76f46c7bbb75134c1fdcbee370a62f5c9d4fb4
SSDEEP

1536:hCUuQOZqU3PMjwRFspKQaT/iEHjMy8zXpkhSLPcnFthN0w6qzF0czEWmytv:hO5ZqE9TeLEHAy8zXGhSuZeazJERytv

Score

N/A

Malware Config

Signatures

Files

8b54e1708d5c49f101eddcb38d4891371d9ca0785d65a85f256052ec4d9217b2
.exe windows x86

6a0af632c86d59f819591f224739df87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
CreateFileMappingW
SetNamedPipeHandleState
WaitForMultipleObjects
lstrcmpiW
FindNextFileW
CreateToolhelp32Snapshot
GetFileTime
DeleteCriticalSection
GetCurrentThreadId
ReleaseMutex
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
GetFileInformationByHandle
LocalFree
SetFileAttributesW
CreateThread
GetDriveTypeW
GetLogicalDrives
ExitThread
GetProcessHeap
CreateTimerQueueTimer
CopyFileW
GetModuleFileNameW
Process32FirstW
Process32NextW
GetFileSize
SetFilePointer
GetExitCodeProcess
ExpandEnvironmentStringsW
GetUserDefaultUILanguage
GetModuleHandleA
OpenFileMappingW
lstrcmpiA
GetPrivateProfileStringW
GetPrivateProfileIntW
GetThreadPriority
CreateProcessW
ConnectNamedPipe
CreateNamedPipeW
GetProcessTimes
DisconnectNamedPipe
lstrcatW
lstrcpyW
lstrcpyA
GlobalLock
GlobalUnlock
ResetEvent
SetLastError
MoveFileExW
GetCurrentThread
GetTickCount
SetEvent
GetComputerNameW
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
HeapCreate
HeapDestroy
GetVersionExW
ReadProcessMemory
Sleep
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
WaitNamedPipeW
VirtualQueryEx
SetFileTime
GetCommandLineA
IsBadReadPtr
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
FreeLibrary
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
WriteProcessMemory
GetCurrentProcessId
CreateEventW
GetProcAddress
GetModuleHandleW
SetErrorMode
SetThreadContext
GetThreadContext
ExitProcess
GetSystemTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetThreadPriority
WaitForSingleObject

user32

PostMessageW
UnregisterClassW
GetTopWindow
RegisterWindowMessageW
GetMessageW
SetTimer
DestroyWindow
EndPaint
GetCursorPos
GetParent
DrawIcon
LoadCursorW
GetWindowThreadProcessId
OpenWindowStationA
GetForegroundWindow
ExitWindowsEx
OpenDesktopA
ToUnicode
GetClipboardData
GetKeyboardState
GetWindowInfo
WindowFromPoint
FindWindowW
DefWindowProcA
ReleaseDC
GetWindowLongW
GetDC
GetClassLongW
GetIconInfo
BeginPaint
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
CharLowerW
OpenWindowStationW
GetUserObjectInformationW
GetSystemMetrics
SetThreadDesktop
CharLowerBuffA
ShowWindow
SendMessageTimeoutW
CreateWindowExW
RegisterClassW
IsWindowVisible
DefWindowProcW
GetWindow
DispatchMessageW
CreateDesktopW
MapVirtualKeyW
SetProcessWindowStation
GetThreadDesktop
CloseDesktop
OpenDesktopW
GetProcessWindowStation
CreateWindowStationW
CloseWindowStation

advapi32

CryptGetHashParam
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
GetSidSubAuthorityCount
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegSetValueExA
RegCreateKeyExA
RegDeleteValueW
RegEnumKeyExW
GetUserNameW
CreateProcessAsUserW
LookupAccountSidW
DuplicateTokenEx
OpenThreadToken
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
GetTokenInformation

shlwapi

StrCmpNIW
SHDeleteKeyA
StrStrIW
StrStrIA
StrCmpNIA
wnsprintfA
StrStrW
wnsprintfW
wvnsprintfA
PathMatchSpecW
PathRemoveFileSpecW
PathFindFileNameW
wvnsprintfW
PathCombineW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

secur32

InitializeSecurityContextW
AcquireCredentialsHandleW
FreeContextBuffer
EncryptMessage
QueryContextAttributesW
FreeCredentialsHandle
DecryptMessage
DeleteSecurityContext
GetUserNameExW

psapi

GetModuleFileNameExW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
BitBlt
DeleteDC
CreateDIBSection
GetDIBits
GdiFlush
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

listen
send
bind
closesocket
WSASetLastError
freeaddrinfo
socket
WSASend
WSAIoctl
getpeername
connect
WSAStartup
recvfrom
getaddrinfo
select
WSAGetLastError
getsockname
shutdown
setsockopt
sendto
recv
accept

crypt32

CertEnumCertificatesInStore
PFXExportCertStoreEx
CertCloseStore
CertOpenSystemStoreW
PFXImportCertStore

wininet

InternetReadFile
InternetGetCookieA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetOpenUrlA
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA
HttpAddRequestHeadersA

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data1
Size: 512B - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6a0af632c86d59f819591f224739df87

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

psapi

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

Sections

.text Size: 104KB - Virtual size: 104KB

.data Size: 1024B - Virtual size: 25KB

.reloc Size: 5KB - Virtual size: 5KB

.data1 Size: 512B - Virtual size: 3KB

.text
Size: 104KB - Virtual size: 104KB

.data
Size: 1024B - Virtual size: 25KB

.reloc
Size: 5KB - Virtual size: 5KB

.data1
Size: 512B - Virtual size: 3KB