f5a89bb08a9de198dea466c097ec3b7c8447d50bec152d5d48f87617e8ce14da

Sharing

Copy URL Twitter E-mail

General

Target

f5a89bb08a9de198dea466c097ec3b7c8447d50bec152d5d48f87617e8ce14da
Size

63KB
MD5

601e12bad32bfa9cec620fc28f72bea0
SHA1

d2f2c71538dbfd60e3cf74d02d100f28596f989d
SHA256

f5a89bb08a9de198dea466c097ec3b7c8447d50bec152d5d48f87617e8ce14da
SHA512

f3808fe7e380f665b48428d0e3105f1c85f3866325d1155fe8bd28e374d331831f30053b628514ba805b25569abe827989a6b64945035f76badd67b1900a351a
SSDEEP

1536:qhqx0okzmxp/U0vCufRD5i7Uy2Iobz3tOJM2as:hSoDtvpfR9iR2Io/tOv

Score

N/A

Malware Config

Signatures

Files

f5a89bb08a9de198dea466c097ec3b7c8447d50bec152d5d48f87617e8ce14da
.exe windows x86

0f5b4050c85dda9a2fb75cb998ff0f81

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
CloseServiceHandle
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
OpenSCManagerA
CreateServiceA
StartServiceA

shlwapi

StrStrIA
StrStrA
wnsprintfA

ws2_32

closesocket
sendto
setsockopt
getsockname
recvfrom
send
socket
connect
htons
WSAStartup
getsockopt
inet_ntoa
gethostbyname
recv

kernel32

CreateFileA
MultiByteToWideChar
GlobalAlloc
GlobalFree
lstrcmpW
GetSystemTime
OpenFile
SetFilePointer
WriteFile
CreateProcessA
VirtualAllocEx
WriteProcessMemory
GetCommandLineA
GetVersion
MapViewOfFile
CreateFileMappingA
ExitProcess
ExitThread
Sleep
TerminateThread
OpenThread
GetCurrentThreadId
CloseHandle
CreateThread
CreateMutexA
OpenMutexA
GetSystemDirectoryA
lstrcmpA
lstrlenW
IsBadReadPtr
lstrcmpiA
GetTickCount
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
IsBadWritePtr
WaitForSingleObject
ReleaseMutex
SystemTimeToFileTime
GetTimeZoneInformation
GetLastError
CreateRemoteThread

user32

GetDC
wsprintfA
CharLowerA

dnsapi

DnsQuery_A
DnsExtractRecordsFromMessage_W
DnsRecordListFree

gdiplus

GdipDeletePen
GdipDeleteGraphics
GdipGetFontCollectionFamilyCount
GdipNewPrivateFontCollection
GdipPrivateAddMemoryFont
GdipDeleteFont
GdipLoadImageFromStream
GdipCreatePen1
GdipDisposeImage
GdipSaveImageToStream
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetDC
GdipReleaseDC
GdipDrawLineI
GdipFillRectangleI
GdipDrawString
GdipDrawImageI
GdipCloneFontFamily
GdipGetFontCollectionFamilyList
GdipDeletePrivateFontCollection
GdipCreateFont
GdipCloneBitmapAreaI
GdipCloneBrush
GdipCloneImage
GdipDeleteBrush
GdipAlloc
GdipFree
GdipLoadImageFromStreamICM

gdi32

GetTextExtentPoint32A

ole32

CreateStreamOnHGlobal

shell32

ShellExecuteA

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 21.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f5b4050c85dda9a2fb75cb998ff0f81

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shlwapi

ws2_32

kernel32

user32

dnsapi

gdiplus

gdi32

ole32

shell32

Sections

.text Size: 59KB - Virtual size: 58KB

.data Size: 2KB - Virtual size: 21.2MB

.rsrc Size: 512B - Virtual size: 16B

.text
Size: 59KB - Virtual size: 58KB

.data
Size: 2KB - Virtual size: 21.2MB

.rsrc
Size: 512B - Virtual size: 16B