3264a5b56e34c69f4aed0b7e4d94269ea147d4cc5a9d2f38ea56185f2a36586e

Sharing

Copy URL Twitter E-mail

General

Target

3264a5b56e34c69f4aed0b7e4d94269ea147d4cc5a9d2f38ea56185f2a36586e
Size

200KB
MD5

6bef9a5023ee21ab2d5ccd2d4fc77d80
SHA1

b1c2cf0ab33264f0591afbbbe9904c3ca6bb2f16
SHA256

3264a5b56e34c69f4aed0b7e4d94269ea147d4cc5a9d2f38ea56185f2a36586e
SHA512

98aa1f4cd272da08d1e7349ec683c17bea9a9d1e6314203b0d0b7622f11566cb611309ceb474530ca4a06ce43ad004cacee1d346bbe13c7bab46cbde7cbe0d68
SSDEEP

3072:pl+5dJVHFfEaPC8GRKuCllO9YFHa8I2+AK2BTY+k8Dp2Qs:pl+5dlE0CvYOl8Iv2YPS2Qs

Score

N/A

Malware Config

Signatures

Files

3264a5b56e34c69f4aed0b7e4d94269ea147d4cc5a9d2f38ea56185f2a36586e
.exe windows x86

eb894b30edaa0d5379540b4bdd59602e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GlobalUnlock
ReleaseMutex
OpenEventA
SetErrorMode
GetCurrentProcess
RaiseException
GetStartupInfoA
GetModuleHandleA
HeapFree
DeleteFileA
ExitProcess
SetLastError
GetLastError
GetModuleFileNameA
SetFilePointer
WriteFile
CreateFileA
RemoveDirectoryA
LocalAlloc
LocalFree
MoveFileA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateDirectoryA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
GetProcessHeap
HeapAlloc
FreeLibrary
CreateThread
GetLocalTime
GetTickCount
Sleep
InterlockedExchange
GetProcAddress
SetEvent
CreateEventA
VirtualAlloc
TerminateThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CreateProcessA
DeviceIoControl
GetVolumeInformationA
GetVersion
VirtualFree
DeleteCriticalSection
CloseHandle
LoadLibraryA
OutputDebugStringA

user32

LoadCursorA
SystemParametersInfoA
SendMessageA
ReleaseDC
GetDC
GetDesktopWindow
SetRect
GetCursorPos
wsprintfA
SetProcessWindowStation
GetProcessWindowStation
GetForegroundWindow
DispatchMessageA
TranslateMessage
CharNextA
GetAsyncKeyState
GetClipboardData
IsWindowVisible
EnumWindows
CloseDesktop
OpenInputDesktop
GetUserObjectInformationA
OpenDesktopA
PostMessageA
IsWindow
CloseWindow
EmptyClipboard
SetClipboardData
SetCursorPos
GetKeyState
keybd_event
GetWindowTextA
WindowFromPoint
SetCapture
ExitWindowsEx
MapVirtualKeyA
GetWindowThreadProcessId

shlwapi

SHDeleteKeyA

gdi32

SelectObject
BitBlt
CreateCompatibleDC
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleBitmap
CreateDIBSection

advapi32

ControlService
LsaOpenPolicy
LsaClose
LookupAccountNameA
IsValidSid
RegQueryValueA
CloseServiceHandle
DeleteService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
RegOpenKeyA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseEventLog
ClearEventLogA
OpenEventLogA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
LookupAccountSidA
GetTokenInformation
LsaFreeMemory

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteA

msvcrt

strncmp
_strnicmp
_onexit
__dllonexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
atol
strncat
strtok
wcscpy
_errno
_strupr
atoi
rename
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
strstr
rand
putchar
puts
sprintf
strncpy
strchr
malloc
free
_except_handler3
strrchr

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

msvcp60

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

netapi32

NetUserAdd
NetLocalGroupAddMembers

urlmon

URLDownloadToFileA

avicap32

capGetDriverDescriptionA

msvfw32

ICSeqCompressFrameEnd
ICSendMessage

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSFreeMemory

Sections

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 152KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb894b30edaa0d5379540b4bdd59602e

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

gdi32

advapi32

shell32

msvcrt

wininet

msvcp60

netapi32

urlmon

avicap32

msvfw32

psapi

wtsapi32

Sections

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 152KB - Virtual size: 155KB

.idata Size: 12KB - Virtual size: 8KB

.didat Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 332B

.reloc Size: 12KB - Virtual size: 8KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 152KB - Virtual size: 155KB

.idata
Size: 12KB - Virtual size: 8KB

.didat
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 332B

.reloc
Size: 12KB - Virtual size: 8KB