124949e3607ae0181c6361ee2089bfdaffd82ac2f9df2f89d780fae9dfbcee72

Sharing

Copy URL Twitter E-mail

General

Target

124949e3607ae0181c6361ee2089bfdaffd82ac2f9df2f89d780fae9dfbcee72
Size

654KB
MD5

63b3823758afe2eb607ad08cea846bd0
SHA1

c707fac1f244bca2aa230a80dce31f3eec72db79
SHA256

124949e3607ae0181c6361ee2089bfdaffd82ac2f9df2f89d780fae9dfbcee72
SHA512

f103dd101defd90383dcfab8602fc3487c2c4cca40e014132f2d2b8f972a0aff2699e44b23c0c6e5905d88344abce2dab538aef8056ac2af60559285d9bed17e
SSDEEP

6144:4XNK24U7gLcd70vPIL0DxtiRlQzuFDsfpxyN90vE8zgthRmLgWpxyN90vEdaGZUk:2a+gvPi0ulAfy90sRmRy90MaGdv

Score

N/A

Malware Config

Signatures

Files

124949e3607ae0181c6361ee2089bfdaffd82ac2f9df2f89d780fae9dfbcee72
.dll windows x86

6fa83f7a16601c716569a77979419645

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__CxxFrameHandler3
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
_vsnprintf
memcmp
memset
memcpy
qsort
isdigit
vswprintf_s
_vscwprintf
memmove_s
wcsstr
memmove
_wcsicmp
memcpy_s
free
malloc
wcsncpy_s
wcstoul
_vsnwprintf
_ftol2_sse

ntdll

VerSetConditionMask
WinSqmStartSession
WinSqmEndSession
WinSqmSetDWORD
WinSqmSetString
WinSqmAddToStreamEx
WinSqmAddToStream
NtQueryInformationToken
NtOpenProcessToken
NtClose
NtOpenThreadToken

api-ms-win-core-path-l1-1-0

PathCchAppend

advapi32

RegOpenKeyExW
RegCloseKey
RegGetValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
EventWrite
GetManagedApplications
InstallApplication
EventRegister
EventUnregister
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueW
GetLocalManagedApplicationData
RegEnumKeyExW
RegEnumKeyW

duser

SetGadgetStyle
InvalidateGadget

gdi32

CreateFontIndirectW
DeleteObject
SelectObject
GetTextMetricsW
GetObjectW
GdiGradientFill
GetStockObject
GetTextExtentPointW

user32

ExitWindowsEx
GetWindowThreadProcessId
IsCharAlphaNumericW
PostMessageW
SendMessageW
LoadStringW
InsertMenuW
SetMenuDefaultItem
DispatchMessageW
LoadCursorW
SetCursor
TranslateMessage
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
DialogBoxParamW
UnregisterClassA
SetDlgItemTextW
GetFocus
SetFocus
IsWindowVisible
ChangeWindowMessageFilterEx
RegisterWindowMessageW
GetWindowTextLengthW
RegisterClipboardFormatW
SetWindowPos
GetWindow
GetLastActivePopup
GetClassNameW
GetCursorPos
GetWindowRect
SwitchToThisWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
AdjustWindowRect
SetTimer
KillTimer
SetForegroundWindow
FindWindowW
ReleaseDC
GetDC
SystemParametersInfoW
SetRect
GetMessageW
LockWindowUpdate
GetSysColor
GetSystemMetrics
DestroyIcon
SendDlgItemMessageW
AllowSetForegroundWindow
GetDlgItemTextW
EndDialog
GetSysColorBrush
DestroyWindow
CallWindowProcW
GetWindowLongW
SetWindowLongW
DefWindowProcW
GetParent
ShowWindow
GetDlgItem
EnableWindow
SetWindowTextW
GetActiveWindow
LoadIconW
MessageBoxW
CharNextW

ole32

CoMarshalInterface
CoUninitialize
CoInitializeEx
CoTaskMemRealloc
CoGetApartmentType
CoWaitForMultipleHandles
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CreateStreamOnHGlobal
CoUnmarshalInterface
CoInitialize
CoInitializeSecurity
CoTaskMemAlloc
PropVariantClear
CoGetObject
StringFromGUID2
CoCreateInstance
CoTaskMemFree
HWND_UserSize
HWND_UserFree
HWND_UserMarshal
HWND_UserUnmarshal
ReleaseStgMedium

msi

ord113
ord16
ord131
ord215
ord244
ord78
ord150
ord8
ord45
ord70
ord141
ord238
ord92
ord270

oleaut32

VariantClear
SysAllocStringByteLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantInit
VarUI4FromStr
SysAllocString
SysFreeString

shlwapi

StrCmpNW
PathIsRootW
ord156
PathIsDirectoryW
SHAutoComplete
StrRetToBufW
ord236
ord157
ord215
PathRemoveBlanksW
PathQuoteSpacesW
PathFindExtensionW
ord476
ord619
ord460
ord9
ord8
ord10
ord7
ord176
ord270
StrDupW
PathIsNetworkPathW
PathIsRelativeW
PathRemoveArgsW
ord194
SHSetThreadRef
SHCreateThreadRef
SHSetValueW
SHRegGetValueW
PathRemoveFileSpecW
PathFindFileNameW
PathCombineW
ord191
SHGetValueW
PathGetArgsW
StrCmpNIW
PathRemoveBackslashW
PathUnquoteSpacesW
SHDeleteKeyW
StrToIntW
ord437
AssocCreate
ord158
StrChrW
ord618
ord16
ord199
ord219
PathFileExistsW
PathParseIconLocationW
SHQueryValueExW
SHStrDupW
ord439
PathStripToRootW
PathIsUNCW
ord388
ord12

kernel32

SetTermsrvAppInstallMode
DeleteFileW
CopyFileW
MulDiv
CreateMutexW
LocalReAlloc
DelayLoadFailureHook
ResolveDelayLoadedAPI
HeapReAlloc
GlobalFree
GetSystemTimeAsFileTime
LoadLibraryW
CompareStringOrdinal
InterlockedExchange
GlobalSize
GlobalLock
GlobalUnlock
WideCharToMultiByte
GetCurrentProcessId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FindResourceW
InterlockedCompareExchange
GetLocaleInfoW
GetUserDefaultUILanguage
TermsrvAppInstallMode
CompareFileTime
ExpandEnvironmentStringsW
GetUserPreferredUILanguages
FlushInstructionCache
GetCurrentThreadId
LockResource
ResetEvent
CreateEventW
GetExitCodeProcess
GetEnvironmentVariableW
IsWow64Process
SetEvent
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameW
FindResourceExW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetExitCodeThread
GetTickCount
WaitForMultipleObjectsEx
CreateThread
CreateIoCompletionPort
SetInformationJobObject
QueryInformationJobObject
WaitForSingleObject
GetQueuedCompletionStatus
ResumeThread
AssignProcessToJobObject
CreateProcessW
CreateJobObjectW
FileTimeToSystemTime
FileTimeToLocalFileTime
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
CompareStringW
lstrcmpW
LocalAlloc
GetDriveTypeW
VerifyVersionInfoW
lstrlenW
FormatMessageW
LocalFree
CloseHandle
OpenProcess
GetLastError
GetCurrentProcess
GetVersionExW
HeapFree
GetProcessHeap
HeapAlloc
SystemTimeToFileTime
AcquireSRWLockShared
ReleaseSRWLockShared
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
GetSystemWindowsDirectoryW
WriteFile
CreateFileW
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
MoveFileW
SetThreadPriority
HeapDestroy
HeapSize
VirtualFree
InterlockedPopEntrySList
IsProcessorFeaturePresent
VirtualAlloc
InterlockedPushEntrySList
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
OutputDebugStringA
QueryPerformanceCounter
TerminateProcess

shell32

SHParseDisplayName
ord19
ord21
ord152
ord866
ord100
ord680
ord744
SHGetFileInfoW
ord190
SHCreateItemFromIDList
ord28
ShellExecuteExW
CommandLineToArgvW
ord196
SHEvaluateSystemCommandTemplate
ord6
AssocGetDetailsOfPropKey
SHCreateDefaultContextMenu
ord25
ord256
ord763
SHChangeNotify
ShellExecuteW
ord730
ord18
ord155
SHGetNameFromIDList
ord171
ord47
SHFileOperationW
ord709
SHBrowseForFolderW
ord63
ord180
ord51
ord173
ord147
ord13
ord10
ord9
SHGetStockIconInfo
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBindToParent
SHBindToFolderIDListParentEx

shcore

SetProcessReference

osbaseln

OpenOsBaseline
GetOsBaselineComponentInfoW
GetOsInstalledComponentInfoW
CloseOsBaseline

propsys

VariantToUInt64
VariantToPropVariant
VariantCompare
PSFormatForDisplay
PropVariantToUInt32WithDefault
PropVariantToVariant
PropVariantCompareEx
PSGetPropertyFromPropertyStorage
PSCreateMemoryPropertyStore
PropVariantToInt32WithDefault
PropVariantToStringWithDefault
PropVariantToStrRet
PSGetPropertyDescription

rpcrt4

IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrCStdStubBuffer_Release
CStdStubBuffer_CountRefs
NdrDllCanUnloadNow
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrDllGetClassObject
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
CStdStubBuffer_Connect
CStdStubBuffer_AddRef

Exports

Exports

ConfigStartMenu
DllCanUnloadNow
DllGetClassObject
DllGetVersion
GetProgramsOnline
NewLinkHereW
RunFODW
RunOCMW
RunSPADW

Sections

.text
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 178B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 429KB - Virtual size: 429KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fa83f7a16601c716569a77979419645

Headers

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-path-l1-1-0

advapi32

duser

gdi32

user32

ole32

msi

oleaut32

shlwapi

kernel32

shell32

shcore

osbaseln

propsys

rpcrt4

Exports

Exports

Sections

.text Size: 194KB - Virtual size: 194KB

.orpc Size: 512B - Virtual size: 178B

.data Size: 4KB - Virtual size: 5KB

.idata Size: 11KB - Virtual size: 11KB

.rsrc Size: 429KB - Virtual size: 429KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 194KB - Virtual size: 194KB

.orpc
Size: 512B - Virtual size: 178B

.data
Size: 4KB - Virtual size: 5KB

.idata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 429KB - Virtual size: 429KB

.reloc
Size: 13KB - Virtual size: 12KB