9d60e6223fad9345e9a2f830fa86eebb9ee8c1272f298fae5e6ae3c6e6416d46

Sharing

Copy URL Twitter E-mail

General

Target

9d60e6223fad9345e9a2f830fa86eebb9ee8c1272f298fae5e6ae3c6e6416d46
Size

79KB
MD5

44b5918f93a7d6c8157344383678881c
SHA1

252f3cd757b03c59703f889416a363ffb3c01f48
SHA256

9d60e6223fad9345e9a2f830fa86eebb9ee8c1272f298fae5e6ae3c6e6416d46
SHA512

69097595960b4d8daa3df758e778de32328ed4e476237a605e992ac57cf9a9c00e2cd22c13676fc9ed32a12b3fd86d80c37b6f84aa41697ed6531af25dd1ffeb
SSDEEP

1536:6hDuzkzatNBLK6/V+uDz65Wh8UhK52SqGQTt+9QggKT1Xjhci:6FUBLK2VRDeEh8H2SqFTt+aggKT1Xjhn

Score

N/A

Malware Config

Signatures

Files

9d60e6223fad9345e9a2f830fa86eebb9ee8c1272f298fae5e6ae3c6e6416d46
.exe windows x86

14013e4d729b52fb23068d3c41da80de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

EndDoc
TextOutA
GetSystemPaletteEntries
SetViewportOrgEx
TextOutW
GetDeviceCaps
StretchBlt
CreatePen
CloseMetaFile
TranslateCharsetInfo
CreateDCA
GetPaletteEntries
CreateCompatibleBitmap
CreateCompatibleDC
ExtTextOutA
FillRgn
PatBlt
ExtSelectClipRgn
CreateDIBitmap
Escape
GetObjectA
GetBkColor
GetStockObject
MoveToEx
DeleteObject
StartPage
CreateMetaFileA
GetTextAlign
GetTextColor
LineTo
SelectPalette
GetClipRgn
SetPixel
RealizePalette
RestoreDC
Rectangle
CombineRgn
SetMapMode
DPtoLP
IntersectClipRect
OffsetViewportOrgEx
ExcludeClipRect
PlayMetaFile
EnumFontFamiliesExW
CreateHalftonePalette
DeleteDC
CreateSolidBrush
SetBkMode
EndPage
GetTextExtentPointW
GetBkMode
Polyline
GetTextMetricsW
LPtoDP
GetTextExtentPoint32W
GetPixel
GetTextMetricsA
CreatePatternBrush
SetTextColor
SetWindowExtEx
GetWindowExtEx
GetObjectType
SelectClipRgn
StretchDIBits
DeleteMetaFile
GetRgnBox
PtVisible
Ellipse
GetViewportExtEx
RectVisible
CreateDCW
CreateRectRgn
GetCurrentObject
SetViewportExtEx
CreateBrushIndirect
ExtTextOutW
SetWindowOrgEx
CreateRectRgnIndirect
GetTextExtentPoint32A
CreateBitmap
OffsetRgn
SetBkColor
GetTextExtentPointA
CreatePalette
GetGlyphOutlineA
UnrealizeObject
GetNearestColor
CreateFontIndirectA
BitBlt
CreateFontA
GetDIBits
SetBrushOrgEx
CreateFontIndirectW
GetObjectW
GetBitmapBits
GetClipBox
SetTextAlign
SetROP2
GetMapMode
ScaleViewportExtEx
SetStretchBltMode
SaveDC
CreateDIBSection
CreateMetaFileW
SelectObject
ScaleWindowExtEx

ole32

CoTaskMemFree
StringFromIID
ReleaseStgMedium
OleUninitialize
CoGetInterfaceAndReleaseStream
CreateOleAdviseHolder
CoGetMalloc
IIDFromString
OleRegGetMiscStatus
CreateBindCtx
CoInitialize
CreateILockBytesOnHGlobal
WriteClassStm
OleInitialize
StgCreateDocfileOnILockBytes
CoInitializeSecurity
CoRegisterClassObject
StgOpenStorage
CoFreeUnusedLibraries
OleSaveToStream
GetRunningObjectTable
CoCreateInstanceEx
CoRevertToSelf
MkParseDisplayName
ProgIDFromCLSID
StringFromCLSID
CoMarshalInterface
CoImpersonateClient
CoUnmarshalInterface
CreateStreamOnHGlobal
CoGetClassObject
CoReleaseMarshalData
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoDisconnectObject
PropVariantClear
OleRegGetUserType
OleRegEnumVerbs
CoRevokeClassObject
StgIsStorageFile
CreateDataAdviseHolder
StgCreateDocfile
PropVariantCopy
CoTaskMemRealloc
CoTaskMemAlloc
CreateItemMoniker
CoMarshalInterThreadInterfaceInStream
OleRun

version

GetFileVersionInfoW
VerLanguageNameA
VerFindFileW
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoSizeW
VerQueryValueW

comctl32

ImageList_Create
InitCommonControlsEx
PropertySheetW
PropertySheetA
InitCommonControls
ImageList_Draw
ImageList_Destroy
CreatePropertySheetPageW
ImageList_ReplaceIcon

ntdll

wcsrchr
RtlNtStatusToDosError
NtTerminateProcess
NtQueryInformationFile
_vsnprintf
RtlGetOwnerSecurityDescriptor
NtQueryInformationThread
RtlUnicodeStringToOemString
NtQueryDirectoryObject
RtlInitializeSid
_wcsicmp
wcstol
NtQueryKey
RtlAllocateAndInitializeSid
RtlDeleteSecurityObject
RtlLeaveCriticalSection
wcscmp
RtlCreateTimerQueue
NtFreeVirtualMemory
wcschr
RtlFreeAnsiString
RtlAddAce
NtQueryInformationToken
strchr
RtlCopyUnicodeString
RtlQueryInformationAcl
RtlExpandEnvironmentStrings_U
RtlDetermineDosPathNameType_U
_allmul
RtlAllocateHeap
RtlDestroyEnvironment
RtlConvertSidToUnicodeString
NtDeviceIoControlFile
RtlDeleteCriticalSection
RtlxAnsiStringToUnicodeSize
_wcslwr
NtClose
RtlCreateUnicodeStringFromAsciiz
RtlExtendedLargeIntegerDivide
RtlValidRelativeSecurityDescriptor
_strnicmp
wcsstr
RtlAcquireResourceExclusive
RtlInitializeCriticalSectionAndSpinCount
RtlFormatCurrentUserKeyPath
RtlEqualSid
strncpy
wcslen
NtOpenKey
RtlCreateAcl
NtCancelIoFile
NtQuerySystemInformation
NtAdjustPrivilegesToken
RtlCreateHeap
NtImpersonateAnonymousToken
RtlInitializeGenericTable
RtlSubAuthoritySid
NtOpenEvent
DbgBreakPoint
RtlSetOwnerSecurityDescriptor
RtlCreateUnicodeString
RtlGUIDFromString
NtDelayExecution
VerSetConditionMask
RtlLookupElementGenericTable
NtAllocateLocallyUniqueId
RtlAcquireResourceShared
RtlCreateTimer
NtTerminateThread
RtlInsertElementGenericTable
atol
NtSetInformationThread
NtCreateFile
NtFsControlFile
NtQuerySystemTime
NtSetSecurityObject
RtlRegisterWait
RtlRaiseStatus
RtlUnicodeToOemN
wcsncmp
RtlLengthRequiredSid
NtOpenProcessToken
_wcsupr
NtDeleteValueKey
RtlCreateSecurityDescriptor
RtlRunDecodeUnicodeString
RtlClearBits
RtlGetAce
NtWriteFile
NtRequestWaitReplyPort
RtlTimeToTimeFields
NtWaitForMultipleObjects
RtlReleaseResource
RtlGetSaclSecurityDescriptor
RtlxOemStringToUnicodeSize
RtlStringFromGUID
RtlUnwind
NtQueryVolumeInformationFile
RtlGetVersion
RtlAppendUnicodeToString
RtlUpcaseUnicodeChar
NtSetEvent
RtlWriteRegistryValue
NtDeleteKey
RtlInitString
NtQueryPerformanceCounter

advapi32

LookupPrivilegeValueA
AddAce
EqualSid
GetSidSubAuthority
RegFlushKey
LookupPrivilegeValueW
RegConnectRegistryW
OpenThreadToken
CryptReleaseContext
ImpersonateLoggedOnUser
AllocateAndInitializeSid
GetTraceEnableFlags
QueryServiceStatus
RegCreateKeyExW
GetAclInformation
CryptGetHashParam
SetFileSecurityW
GetSidIdentifierAuthority
CloseServiceHandle
RegQueryInfoKeyW
LsaOpenPolicy
GetSecurityDescriptorOwner
ControlService
LsaQueryInformationPolicy
GetSidLengthRequired
GetSecurityDescriptorLength
GetUserNameW
RegEnumKeyExW
CryptCreateHash
FreeSid
GetSecurityDescriptorControl
IsValidSecurityDescriptor
GetSidSubAuthorityCount
LockServiceDatabase
RegOpenKeyW
RegQueryValueA
StartServiceW
RegSetValueExW
RegOpenKeyExW
RegSetValueW
ReportEventW
DuplicateTokenEx
DeregisterEventSource
RegQueryInfoKeyA
RegEnumValueW
OpenSCManagerA
RegEnumValueA
RegNotifyChangeKeyValue
UnlockServiceDatabase
DeleteService
RegEnumKeyA
RegOpenKeyExA
OpenSCManagerW
RegisterEventSourceW
CryptDestroyKey
CopySid
GetLengthSid
LookupAccountSidW
SetThreadToken
GetTraceLoggerHandle
GetTraceEnableLevel
InitializeAcl
RevertToSelf
RegCreateKeyA
RegDeleteKeyW
RegSetValueA
ConvertStringSidToSidW
SetSecurityDescriptorGroup
RegQueryValueExW
GetUserNameA
OpenServiceW
GetTokenInformation
RegDeleteKeyA
ChangeServiceConfigW
AdjustTokenPrivileges
InitializeSecurityDescriptor
RegCloseKey
RegOpenKeyA
SetNamedSecurityInfoW
UnregisterTraceGuids
ConvertSidToStringSidW
RegCreateKeyW
LookupAccountNameW
OpenServiceA
SetServiceStatus
SetSecurityDescriptorDacl
QueryServiceConfigW
CryptAcquireContextA
CryptDestroyHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
RegDeleteValueW
LsaClose
RegQueryValueExA
CryptGenRandom
SetEntriesInAclW
GetSecurityDescriptorDacl
CryptAcquireContextW
GetAce
RegQueryValueW
AddAccessAllowedAce
RegSetValueExA
RegDeleteValueA

kernel32

GetFileAttributesA
Sleep
lstrcmpiW
SetHandleCount
GetThreadLocale
GetLocaleInfoA
IsBadWritePtr
GetExitCodeThread
GetTickCount
GetConsoleMode
lstrcatA
GetCurrentThreadId
VirtualAlloc
GetCurrentProcessId
GetExitCodeProcess
GetComputerNameW
GetVersion
GetModuleHandleW
GetModuleHandleA
EscapeCommFunction
GetCommandLineA
SetEvent
GetACP
GetCommandLineW
OutputDebugStringA

msvcrt

malloc
exit
wcsstr
_rotr
_lock
strncmp
calloc
_finite
_unlock
wcscmp
wcsncat
_stat
realloc
__CxxFrameHandler
time
strlen
wcstok
strstr
wcstombs
_exit
wcstoul
_ltoa
_chsize
isleadbyte
wcscat
_ultow
_wfopen
__p__iob
iswdigit
tolower
isdigit
__initenv
??2@YAPAXI@Z
swscanf
ceil
_tell
_wcsnicmp
srand
_CIpow
printf
iswalpha
_wtol
_controlfp
towupper
isxdigit
strchr
_except_handler3
wcsncmp
??3@YAXPAX@Z
__setusermatherr
_wtoi
memmove
isspace
sprintf
_strdup
??1type_info@@UAE@XZ
__dllonexit
_stricmp
_ltow
memset
_rotl
_ftol
_itow
__p__fmode
__badioinfo
ctime
wcsrchr
_fileno
__pioinfo
_ultoa
sscanf
atol
toupper
_errno
qsort
_strnicmp
__getmainargs
strncpy
bsearch
fprintf
_local_unwind2
_purecall
iswspace
mbstowcs
fread
_snwprintf
setlocale
_lseeki64
free
memcpy
strtoul
__wgetmainargs
_onexit
_isatty
wcschr
_commit
atoi
_wcsicmp
towlower
_CIacos
floor
_access
isalnum
wcsspn
_wcsdup
wcscspn
isalpha
_acmdln
??0exception@@QAE@ABV0@@Z
_adjust_fdiv
_CxxThrowException
_snprintf
_write
_CIsqrt
fseek
?terminate@@YAXXZ
_XcptFilter
fflush
wcscpy
iswctype
__p__commode
fclose
rand
_beginthreadex
fopen
_vsnwprintf
wcspbrk
wcstol
fwrite
__p__osver
_itoa
wcsncpy
_amsg_exit

comdlg32

GetOpenFileNameA
PageSetupDlgA
GetFileTitleA
GetSaveFileNameA
PrintDlgA
FindTextA
ChooseFontA
ChooseFontW
GetFileTitleW
GetSaveFileNameW
ChooseColorW
GetOpenFileNameW
PageSetupDlgW
PrintDlgW
ChooseColorA

oleaut32

OleLoadPicture
GetActiveObject
SafeArrayUnaccessData
VariantCopy
SysAllocStringLen
GetErrorInfo
VariantChangeTypeEx
SafeArrayAccessData
RegisterTypeLib
SetErrorInfo
VariantChangeType
SafeArrayCreate
SafeArrayPtrOfIndex
SafeArrayGetLBound
VariantClear
VariantInit
SafeArrayPutElement
SafeArrayGetUBound
SafeArrayGetElement
SysReAllocStringLen
LoadTypeLib
SysAllocStringByteLen
SysFreeString

shell32

SHBrowseForFolderW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetPathFromIDListA
ShellExecuteA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteW
SHGetMalloc
DragQueryFileW
DragQueryFileA
SHGetFileInfoW
SHChangeNotify
SHGetPathFromIDListW
SHBindToParent
SHGetFolderPathW
SHGetSpecialFolderLocation
CommandLineToArgvW
SHFileOperationW

shlwapi

PathStripToRootA
StrCmpNW
PathRemoveBlanksW
PathIsDirectoryW
PathSkipRootW
PathIsRootW
StrChrW
PathStripToRootW
SHDeleteValueA
PathCombineW
PathIsUNCW
SHDeleteKeyA
StrToIntW
StrTrimW
PathRemoveBackslashW
StrCmpNIW
StrRChrW
PathFileExistsW
StrStrIW
StrDupW
UrlUnescapeW
wnsprintfW
SHDeleteValueW
StrToIntExW
SHGetValueW
PathIsRelativeW
PathFindExtensionW
PathAddBackslashW
StrCatW
StrCmpW
PathIsURLW
PathRemoveExtensionW
StrCatBuffW
PathFindFileNameW
StrChrIW
UrlCanonicalizeW
PathGetDriveNumberW
StrRetToBufW
SHDeleteKeyW
PathRemoveFileSpecW
StrCmpNIA
StrCpyNW
StrStrIA
PathCreateFromUrlW
UrlIsW
SHStrDupW
PathRemoveFileSpecA
SHRegGetBoolUSValueW
PathAppendW
StrCmpIW
SHSetValueW
PathFindExtensionA

user32

GetWindow
LoadIconA
LoadStringA
LoadStringW
GetClassNameA
GetActiveWindow
wsprintfW
GetMessageW
SendMessageW
PostMessageA
GetCapture
CreateWindowExW
MessageBoxW
GetWindowLongW
IsWindowVisible
InflateRect
EndDialog
GetDlgItemTextA
EnumChildWindows
IsDlgButtonChecked
ExitWindowsEx
TranslateMessage
UnregisterClassW
GetAsyncKeyState
ScreenToClient
EndPaint
GetMessagePos
GetWindowThreadProcessId
WinHelpW
SetDlgItemTextW
SetTimer
BeginPaint
GetSubMenu
GetSystemMetrics
RegisterWindowMessageW
DispatchMessageW
RegisterClassA
MessageBeep
GetCursorPos
SetWindowRgn
IsWindow
GetDlgCtrlID
SetWindowTextA
SendDlgItemMessageW
CreatePopupMenu
ReleaseCapture
FindWindowA
DrawTextW
CheckRadioButton
GetFocus
GetWindowTextLengthW
SetRect
EnableWindow
IsWindowEnabled
DrawFocusRect
InvalidateRect
RegisterClassExW
GetSysColor
CopyRect
RedrawWindow
IntersectRect
GetParent
PeekMessageW
PostQuitMessage
CreateDialogParamW
DestroyIcon
DialogBoxParamA
SetCapture
OffsetRect
RegisterWindowMessageA
GetSystemMenu
LoadBitmapA
CharPrevW
CreateWindowExA
PeekMessageA
CharLowerW
EqualRect
GetClassNameW
GetMessageA
GetWindowLongA
SetFocus
UpdateWindow
GetKeyState
IsIconic
GetDesktopWindow
CallNextHookEx
DispatchMessageA
GetWindowRect
GetMenu
GetDlgItem
DialogBoxParamW
GetProcessWindowStation
SendDlgItemMessageA
PtInRect
ClientToScreen
CheckDlgButton
SystemParametersInfoW
LoadBitmapW
SetWindowLongA
CallWindowProcW
FillRect
TrackPopupMenu
UnhookWindowsHookEx
SetWindowTextW
RegisterClassW
CheckMenuItem
SendMessageA
GetClientRect
CharUpperA
GetDC
GetWindowTextW
RegisterClipboardFormatW
FindWindowW
DestroyMenu
ReleaseDC
GetMenuItemCount
RegisterClassExA
EnableMenuItem
CharNextW
GetDlgItemTextW
GetSysColorBrush
GetWindowDC
LoadImageW
CharNextA
LoadCursorW
SystemParametersInfoA
GetWindowTextA
LoadIconW
IsRectEmpty
CharUpperW
SetWindowPos
KillTimer
DestroyWindow
CharPrevA
SetCursor
LoadCursorA
MsgWaitForMultipleObjects
MessageBoxA
MapWindowPoints
GetWindowPlacement
IsChild
GetForegroundWindow
PostMessageW
DrawTextA
CallWindowProcA
SetForegroundWindow
UnregisterClassA
SetWindowLongW

rpcrt4

CStdStubBuffer_QueryInterface
RpcStringFreeW
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_AddRef
CStdStubBuffer_CountRefs
UuidToStringW
UuidFromStringW
RpcServerRegisterIfEx
CStdStubBuffer_DebugServerQueryInterface
NdrDllGetClassObject
RpcRaiseException
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
UuidCreate
NdrDllUnregisterProxy
NdrOleFree
NdrClientCall2
CStdStubBuffer_Invoke
NdrServerCall2
NdrStubCall2
NdrStubForwardingFunction
IUnknown_AddRef_Proxy
RpcStringBindingParseW
NdrOleAllocate
NdrCStdStubBuffer2_Release
RpcImpersonateClient
IUnknown_Release_Proxy
NdrDllRegisterProxy
RpcEpResolveBinding
RpcBindingToStringBindingW
NdrDllCanUnloadNow
RpcServerUnregisterIf
RpcRevertToSelf
RpcBindingSetAuthInfoExW
CStdStubBuffer_DebugServerRelease
UuidToStringA

Sections

.textbss
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textbss
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 481B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 483B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14013e4d729b52fb23068d3c41da80de

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

ole32

version

comctl32

ntdll

advapi32

kernel32

msvcrt

comdlg32

oleaut32

shell32

shlwapi

user32

rpcrt4

Sections

.textbss Size: 512B - Virtual size: 496B

DATA Size: 512B - Virtual size: 492B

.bss Size: 512B - Virtual size: 490B

.textbss Size: 512B - Virtual size: 490B

DATA Size: 512B - Virtual size: 484B

DATA Size: 512B - Virtual size: 488B

.text Size: 71KB - Virtual size: 71KB

.tls Size: 512B - Virtual size: 50KB

.tls Size: 512B - Virtual size: 481B

.reloc Size: 512B - Virtual size: 483B

.textbss
Size: 512B - Virtual size: 496B

DATA
Size: 512B - Virtual size: 492B

.bss
Size: 512B - Virtual size: 490B

.textbss
Size: 512B - Virtual size: 490B

DATA
Size: 512B - Virtual size: 484B

DATA
Size: 512B - Virtual size: 488B

.text
Size: 71KB - Virtual size: 71KB

.tls
Size: 512B - Virtual size: 50KB

.tls
Size: 512B - Virtual size: 481B

.reloc
Size: 512B - Virtual size: 483B