5c0a4683b734d744125e2d988565619c407d9d3e1b6dbe24eff746aec2ffffa8

Sharing

Copy URL Twitter E-mail

General

Target

5c0a4683b734d744125e2d988565619c407d9d3e1b6dbe24eff746aec2ffffa8
Size

176KB
MD5

75e51c871e509db605339b4d714f9a70
SHA1

a439c6469a599be81afc0fb6ebc974e31158576d
SHA256

5c0a4683b734d744125e2d988565619c407d9d3e1b6dbe24eff746aec2ffffa8
SHA512

affd940abe947d265f58a108d66bb80b1bd8d46a273a1e3410faca2eaecaf72508857926f84593e63822a3f80eb70249b01e434d06c13e014b98c0724d651f5e
SSDEEP

3072:uRBjMtXl8kO0aDEYosxF1RyUM5DE7+mH3028CzGg8MD4QYEV:uDMtXqDEQ7RyUiDE7Rj8VxUYi

Score

N/A

Malware Config

Signatures

Files

5c0a4683b734d744125e2d988565619c407d9d3e1b6dbe24eff746aec2ffffa8
.exe windows x86

7849a2d9732b4412d464f1142c1ef013

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GlobalUnlock
ReleaseMutex
OpenEventA
SetErrorMode
GetCurrentProcess
RaiseException
GetStartupInfoA
GetModuleHandleA
DeleteFileA
ExitProcess
GetLastError
GetModuleFileNameA
SetFilePointer
WriteFile
CreateFileA
RemoveDirectoryA
LocalAlloc
MoveFileA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateDirectoryA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
GetProcessHeap
HeapAlloc
FreeLibrary
CreateThread
GetLocalTime
GetTickCount
Sleep
InterlockedExchange
SetEvent
GetProcAddress
TerminateThread
CreateProcessA
DeviceIoControl
LocalFree
GetVersion
CreateEventA
VirtualAlloc
VirtualFree
DeleteCriticalSection
CloseHandle
LoadLibraryA
OutputDebugStringA

user32

SetClipboardData
EmptyClipboard
GetClipboardData
LoadCursorA
SystemParametersInfoA
SetCursorPos
ReleaseDC
GetDC
GetDesktopWindow
SetRect
GetCursorPos
wsprintfA
SendMessageA
SetCapture
CloseWindow
DispatchMessageA
TranslateMessage
CharNextA
SetProcessWindowStation
GetProcessWindowStation
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
CloseDesktop
OpenInputDesktop
GetUserObjectInformationA
OpenDesktopA
PostMessageA
IsWindow
MapVirtualKeyA
keybd_event
GetKeyState
GetWindowTextA
ExitWindowsEx
GetAsyncKeyState
GetForegroundWindow
WindowFromPoint

gdi32

SelectObject
BitBlt
CreateCompatibleDC
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleBitmap
CreateDIBSection

advapi32

RegQueryValueA
LsaFreeMemory
LsaOpenPolicy
LsaClose
LookupAccountNameA
IsValidSid
RegOpenKeyA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseEventLog
ClearEventLogA
OpenEventLogA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
LookupAccountSidA
GetTokenInformation

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

msvcrt

_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
atol
strncat
wcscpy
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
strstr
rand
putchar
puts
sprintf
strncpy
strchr
malloc
free
_except_handler3
strrchr
rename
atoi

wininet

InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA

msvcp60

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

netapi32

NetLocalGroupAddMembers
NetUserAdd

avicap32

capGetDriverDescriptionA

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSFreeMemory

Sections

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7849a2d9732b4412d464f1142c1ef013

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

wininet

msvcp60

netapi32

avicap32

psapi

wtsapi32

Sections

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 108KB - Virtual size: 108KB

.rsrc Size: 48KB - Virtual size: 48KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 108KB - Virtual size: 108KB

.rsrc
Size: 48KB - Virtual size: 48KB