8204179506bae7a06ed6080a6269bc285cff12a8cddfe78bb9a77e0caa8920ad

Sharing

Copy URL Twitter E-mail

General

Target

8204179506bae7a06ed6080a6269bc285cff12a8cddfe78bb9a77e0caa8920ad
Size

141KB
MD5

7c71bfb3bba15491b07e11b6d3866ab0
SHA1

da3f74bf245d4b8e3293a3b8ea52fea837963d65
SHA256

8204179506bae7a06ed6080a6269bc285cff12a8cddfe78bb9a77e0caa8920ad
SHA512

e729197963b2ef357d1b954e70a06ff3b44e1d75fd80588f95f393f58efa1e7298f22d3476576f742eea608add0e42903d6c5fbff2637a1d84e98c469f0b7c7e
SSDEEP

3072:tw4mtG8IJHi14Gkt9JQFtEyavbzrXdqQsa+eVdpD0OICQapqRUuy6:tFmtG8Z14Gkt9uFtELXdQaxB0OFHpz6

Score

N/A

Malware Config

Signatures

Files

8204179506bae7a06ed6080a6269bc285cff12a8cddfe78bb9a77e0caa8920ad
.exe windows x86

1331ecd1de23e3c9c256c050a799c6e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
CloseHandle
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
GetThreadContext
SetThreadContext
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessId
GetFileAttributesExW
GetCurrentThreadId
CreateEventW
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalLock
GlobalUnlock
ReadProcessMemory
CreateRemoteThread
WaitForMultipleObjects
Process32NextW
ExitProcess
SetEvent
lstrcmpiA
WTSGetActiveConsoleSessionId
ResetEvent
SetThreadPriority
TlsGetValue
TlsSetValue
TerminateProcess
GetNativeSystemInfo
GetVersionExW
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GetLocalTime
MoveFileExW
GetUserDefaultUILanguage
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
Sleep
LoadLibraryW
RemoveDirectoryW
LoadLibraryA
FindClose
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
GetProcAddress
SetLastError
GetLastError
VirtualFreeEx
WideCharToMultiByte
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
GetFileAttributesW
HeapCreate
HeapDestroy
Process32FirstW
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
GetModuleHandleW
WaitForSingleObject
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW

user32

GetAncestor
GetClassLongW
GetParent
GetWindowRect
GetCapture
RegisterClassExW
SetCursorPos
GetDCEx
PeekMessageA
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
ReleaseCapture
RegisterClassW
SetWindowPos
CallWindowProcW
DefWindowProcW
GetMessagePos
DefFrameProcW
RegisterClassA
CharLowerW
GetKeyboardState
IntersectRect
ToUnicode
DrawIcon
GetIconInfo
GetCursorPos
ExitWindowsEx
IsWindow
MapWindowPoints
RegisterWindowMessageW
DrawEdge
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetWindowThreadProcessId
GetShellWindow
MapVirtualKeyW
GetSystemMetrics
CharLowerBuffA
FillRect
PostMessageW
PostThreadMessageW
GetUpdateRect
BeginPaint
PrintWindow
GetWindowInfo
CallWindowProcA
SendMessageW
IsRectEmpty
EndPaint
GetMessageA
DispatchMessageW
GetWindow
GetUpdateRgn
GetMessageW
RegisterClassExA
GetWindowDC
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
SetCapture
DefDlgProcW
DefFrameProcA
OpenInputDesktop
GetClipboardData
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
CharLowerA
GetWindowLongW
TranslateMessage
EqualRect

advapi32

OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
InitiateSystemShutdownExW
GetLengthSid
EqualSid
ConvertSidToStringSidW
IsWellKnownSid
RegEnumKeyExW

shlwapi

wvnsprintfW
StrStrIW
StrStrIA
PathRenameExtensionW
PathQuoteSpacesW
StrCmpNIW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

SetRectRgn
SelectObject
CreateCompatibleDC
DeleteDC
SetViewportOrgEx
SaveDC
RestoreDC
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

ws2_32

WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
recvfrom
sendto
getpeername
WSASend
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1331ecd1de23e3c9c256c050a799c6e9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 132KB - Virtual size: 131KB

.data Size: 1024B - Virtual size: 7KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 132KB - Virtual size: 131KB

.data
Size: 1024B - Virtual size: 7KB

.reloc
Size: 6KB - Virtual size: 6KB