149ee01ff61d3795cfeabded57d28ffc90bba59bba0f7c2739977d702edb93b1

Sharing

Copy URL Twitter E-mail

General

Target

149ee01ff61d3795cfeabded57d28ffc90bba59bba0f7c2739977d702edb93b1
Size

696KB
MD5

64f07d502d92a2db8b9ad52ea15457f0
SHA1

3117c3dfcb0353d17f3d8c4bca2070a4d51f334d
SHA256

149ee01ff61d3795cfeabded57d28ffc90bba59bba0f7c2739977d702edb93b1
SHA512

e51dd9292db2375e0e4e3095702fa37fed74c3d07fb93a79ce890bbc827318e776775f0a7773423c0d9e31a23d4db86d54c4f353d6a5bb6511703096d8c5a2b7
SSDEEP

12288:RGCPORdIjfbOToMrEDL1FwhdFbjzlZXHFtlxJuZUQd3i/SmDtVvg8JANnSc7iVm7:oCPOHIbbO

Score

N/A

Malware Config

Signatures

Files

149ee01ff61d3795cfeabded57d28ffc90bba59bba0f7c2739977d702edb93b1
.exe windows x86

7d2dbc8c81fc75a012f01cf4d8c3f431

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyW
RegSetValueW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegGetValueW
OpenThreadToken
CryptEncrypt
CryptGetKeyParam
CryptSetKeyParam
CryptDeriveKey
CryptDestroyKey
CryptVerifySignatureW
CryptSetHashParam
CryptGenRandom
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
ConvertSidToStringSidW
EventWrite
GetNamedSecurityInfoW
SetNamedSecurityInfoW
AddMandatoryAce
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
IsValidSid
CopySid
GetTokenInformation
OpenProcessToken
GetSecurityDescriptorDacl
GetLengthSid
AddAce
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
InitializeAcl
SetKernelObjectSecurity
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
EqualSid
GetKernelObjectSecurity
AddAccessAllowedAceEx
GetSidSubAuthorityCount
DeleteAce
GetSidSubAuthority
GetSidIdentifierAuthority
ConvertStringSidToSidW
CheckTokenMembership

kernel32

GetCurrentThread
FreeLibrary
SetErrorMode
GetEnvironmentVariableW
QueueUserWorkItem
QueryPerformanceFrequency
LCMapStringW
GetSystemTime
GetUserDefaultLocaleName
OpenFileMappingW
CreateFileMappingW
OpenMutexW
GetFileSizeEx
FlushFileBuffers
SetFileTime
FlushViewOfFile
SystemTimeToFileTime
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
GetFullPathNameW
ReleaseMutex
GetSystemInfo
GetSystemDefaultLangID
GetUserPreferredUILanguages
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMutexW
RaiseException
VirtualAlloc
GetFileAttributesW
OpenProcess
GetProcessHeap
HeapFree
HeapAlloc
LocalAlloc
WideCharToMultiByte
GetNativeSystemInfo
IsWow64Process
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetSystemDirectoryW
LoadLibraryW
ExpandEnvironmentStringsW
DuplicateHandle
GetStdHandle
GetTempPathW
GetExitCodeProcess
CompareStringOrdinal
WaitForSingleObject
GetTempFileNameW
SetFilePointer
SetFileAttributesW
DeleteFileW
CloseHandle
GetVersionExA
GetShortPathNameW
FindNextFileW
SetCurrentDirectoryW
LockResource
FindClose
GetCurrentDirectoryW
lstrcmpW
CreateFileW
ReadFile
SizeofResource
WriteFile
GetTickCount
FindFirstFileExW
CreateDirectoryW
GetCurrentProcess
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
SetPriorityClass
LocalFree
HeapSetInformation
GetProcAddress
GetLastError
GetModuleFileNameW
GetVersionExW
Sleep

user32

CharNextW
GetShellWindow
SendMessageTimeoutW
LoadStringW
PostMessageW

msvcrt

_vsnwprintf_s
_purecall
rand_s
wcscat_s
iswalpha
wcschr
memset
wcsnlen
strnlen
??_V@YAXPAX@Z
sprintf_s
_wfopen_s
fgetws
swscanf_s
fclose
??2@YAPAXI@Z
_XcptFilter
isalnum
_wtoi
_ultow_s
wcsrchr
_wcsnicmp
??_U@YAPAXI@Z
_time64
_vsnwprintf
??3@YAXPAX@Z
_CxxThrowException
memcmp
wcsncpy_s
_onexit
__dllonexit
_unlock
_lock
_except_handler4_common
_controlfp
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
memcpy_s

shell32

CommandLineToArgvW
SHSetLocalizedName
ord190
SHChangeNotify
SHCreateItemFromParsingName
SHGetSpecialFolderLocation
SHGetKnownFolderPath
ord526
SHGetDesktopFolder
ord155
ord165
SHGetFolderPathW
SHGetSpecialFolderPathW

ieadvpack

ExecuteCabW
RegRestoreAllW

shlwapi

SHCopyKeyW
StrCmpIW
SHRegSetUSValueW
ord388
PathFileExistsW
SHDeleteKeyW
StrCmpNIW
PathFindFileNameW
SHDeleteValueW
PathRemoveBlanksW
SHGetValueW
SHSetValueW
SHStrDupW
ord158
SHRegDeleteUSValueW
StrStrW
SHRegGetUSValueW
StrTrimW
PathRemoveExtensionW
ord2
UrlCreateFromPathW
UrlCanonicalizeW
UrlApplySchemeW
PathIsURLW
StrCmpNIA
ord487
UrlEscapeW
UrlUnescapeW
PathIsNetworkPathW
StrStrIW
ord219
ord433
StrCmpW
StrCmpNA
StrCmpNW

iertutil

ord151
ord701
ord654
ord665
ord660
ord675
ord678
ord672
ord655
ord682
ord651
ord657
ord650
ord652
ord653
ord662
ord91
ord74
ord81
ord90
ord76
ord85
ord79
ord134
ord398
ord791
ord559
ord281
ord282
ord677
ord558

oleaut32

VariantClear
SysStringByteLen
VarBstrCat
SysAllocStringLen
VarBstrCmp
SysAllocStringByteLen
VariantCopy
SysStringLen
SysFreeString
VariantInit
SysAllocString

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CoUninitialize
PropVariantClear
CoTaskMemFree
CoInitializeEx
StringFromGUID2
CoCreateGuid

iedkcs32

BrandIEActiveSetup

crypt32

CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CryptStringToBinaryW
CertGetNameStringW
CertOpenStore
CertCreateCertificateContext
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CryptImportPublicKeyInfo
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CryptHashCertificate
CryptStringToBinaryA
CryptBinaryToStringA
CertGetCertificateContextProperty
CertEnumCertificatesInStore

urlmon

CreateIUriBuilder
CreateUri
ord410
ord414
CoInternetCreateSecurityManager

wininet

InternetReadFile
HttpSendRequestW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetCloseHandle
HttpQueryInfoW

slc

SLGetWindowsInformation

netapi32

NetApiBufferFree
NetGetJoinInformation

version

VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW

mlang

ord123

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 511KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

thtxyvd
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7d2dbc8c81fc75a012f01cf4d8c3f431

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

ieadvpack

shlwapi

iertutil

oleaut32

ole32

iedkcs32

crypt32

urlmon

wininet

slc

netapi32

version

mlang

Sections

.text Size: 140KB - Virtual size: 140KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 9KB - Virtual size: 8KB

.rsrc Size: 511KB - Virtual size: 511KB

.reloc Size: 34KB - Virtual size: 35KB

thtxyvd Size: - Virtual size: 4KB

.text
Size: 140KB - Virtual size: 140KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 511KB - Virtual size: 511KB

.reloc
Size: 34KB - Virtual size: 35KB

thtxyvd
Size: - Virtual size: 4KB