c0540e2e9fdb19b6098dd9e690af88dfa401f77d4ced21e7808329445f9c4900

Sharing

Copy URL Twitter E-mail

General

Target

c0540e2e9fdb19b6098dd9e690af88dfa401f77d4ced21e7808329445f9c4900
Size

205KB
MD5

4b145eb8672adc9880d1f4c0f34e5960
SHA1

a07397d87ab392720d1f630dc824c8a971417601
SHA256

c0540e2e9fdb19b6098dd9e690af88dfa401f77d4ced21e7808329445f9c4900
SHA512

c7f448ed6029491c5cd0a6bc476b73ab23e514f5430bbd18c58f45454ffd58ff01c0755c0854001bceb74dd87c0d16029791084e153daeecce165e9a8fc30f5d
SSDEEP

6144:rTanDs7XU8QgTI3QDyPemwFDyFO1Gk1Id2XNYwTmoDuez:rTanME8QgTmQDxDDIGN9CoiW

Score

N/A

Malware Config

Signatures

Files

c0540e2e9fdb19b6098dd9e690af88dfa401f77d4ced21e7808329445f9c4900
.dll windows x86

913b75c82b5797ac4adf911417aa25bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsSetValue
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
OutputDebugStringW
GetCurrentThreadId
GlobalLock
GlobalAlloc
FreeLibrary
ReleaseMutex
UnmapViewOfFile
FindCloseChangeNotification
CloseHandle
InterlockedDecrement
WaitForSingleObject
TlsFree
DeleteCriticalSection
InterlockedExchangeAdd
GetProcAddress
MultiByteToWideChar
GetCurrentProcessId
FindClose
FindNextFileW
DeleteFileW
GetLastError
FindFirstFileW
FlushFileBuffers
WriteFile
SetFilePointer
WritePrivateProfileStringW
GetTempPathA
CreateFileW
WritePrivateProfileStringA
GetPrivateProfileIntW
GetPrivateProfileStringA
GetPrivateProfileStringW
CopyFileW
MoveFileW
InitializeCriticalSection
MapViewOfFile
CreateFileMappingW
GetFileAttributesW
CreateMutexW
TerminateProcess
GetCurrentProcess
FindFirstChangeNotificationW
GetLocalTime
TlsGetValue
TlsAlloc
LoadLibraryW
GetSystemInfo
LocalFree
LocalAlloc
CreateThread
RaiseException
lstrlenW
InterlockedIncrement
GetModuleHandleW
lstrcmpiW
LoadLibraryExW
LoadLibraryA
SetCurrentDirectoryW
GetTempPathW
GetFileSizeEx
ExpandEnvironmentStringsW
GetCurrentDirectoryW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetTickCount
HeapDestroy
CreateDirectoryW
GetFileAttributesA
lstrlenA
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
CreateDirectoryA
GetModuleFileNameW
WideCharToMultiByte
VirtualQuery
GlobalUnlock
GlobalFree
LeaveCriticalSection
EnterCriticalSection
ExitProcess

user32

PostQuitMessage
UpdateWindow
ShowWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
DestroyWindow
PostMessageW
SetTimer
RegisterClassW
DefWindowProcW
KillTimer
MessageBoxW

advapi32

RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExW
RegQueryInfoKeyW

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHGetFolderPathA
ord165
SHGetSpecialFolderPathA

ole32

OleRun
CoCreateInstance
CoInitialize
CoTaskMemFree
StringFromIID
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize

oleaut32

VariantInit
VarBstrCat
SysStringLen
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString
SysFreeString
GetErrorInfo

msvcp90

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

PathRemoveBackslashA
PathRemoveFileSpecW
PathIsDirectoryA
PathFindFileNameW
PathCombineW
PathFileExistsA
PathAppendA
PathIsDirectoryW
PathAppendW
PathRemoveBackslashW
PathFileExistsW

msvcr90

memcmp
strtok
_snprintf
strncat
strlen
??2@YAPAXI@Z
memmove_s
wcstok
_wcsicmp
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_wstat64i32
_vsnwprintf
strncpy
_encode_pointer
_lock
??_V@YAXPAX@Z
__dllonexit
_unlock
_except_handler4_common
_swprintf
wcsrchr
_time64
wprintf
strcat
wcsncpy_s
malloc
wcsstr
free
_recalloc
??3@YAXPAX@Z
memcpy_s
strstr
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
memset
_snwprintf
_wsplitpath
wcsncpy
wcslen
memcpy
_wtoi
strncmp
strcmp
_CxxThrowException
_invalid_parameter_noinfo
wcsnlen
??0exception@std@@QAE@ABV01@@Z

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z
StartMon

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 86KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

913b75c82b5797ac4adf911417aa25bc

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp90

version

shlwapi

msvcr90

Exports

Exports

Sections

.text Size: 67KB - Virtual size: 67KB

.rdata Size: 40KB - Virtual size: 40KB

.data Size: 1024B - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

.rmnet Size: 86KB - Virtual size: 88KB

.text
Size: 67KB - Virtual size: 67KB

.rdata
Size: 40KB - Virtual size: 40KB

.data
Size: 1024B - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB

.rmnet
Size: 86KB - Virtual size: 88KB