51d8ee4fdf3de392d5e40ada4d42cbd63280ede8c236268de1db4a31aa00fb08

Sharing

Copy URL Twitter E-mail

General

Target

51d8ee4fdf3de392d5e40ada4d42cbd63280ede8c236268de1db4a31aa00fb08
Size

168KB
MD5

22ebdb835cfcde2f351d9312c7d36030
SHA1

befe7797018fb047176c25dd7e9e2c425f184b41
SHA256

51d8ee4fdf3de392d5e40ada4d42cbd63280ede8c236268de1db4a31aa00fb08
SHA512

182fc716aa6fea3b5e9e8cad1cab836a1145a89234ce00f1ad221e9121b970ac0e0d7b442e1948131e39f87fb974cfa42cde214b13a04d82dc24c08804bad19d
SSDEEP

3072:b4Bs5QWQ9e/jjmEIkpyLY36s2CiMgq5FJ8BvoAOqfxQxQxzJVwQ49L:h5QWDjjVmY3L3995FJ8loAOqfxQx2S

Score

N/A

Malware Config

Signatures

Files

51d8ee4fdf3de392d5e40ada4d42cbd63280ede8c236268de1db4a31aa00fb08
.exe windows x86

5ef9bdd5422bebba030c4815579980b4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

msvcrt

_strcmpi
__p__commode
_strnicmp
__set_app_type
_adjust_fdiv
__setusermatherr
_initterm
__p__fmode
??3@YAXPAX@Z
memcpy
memmove
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
calloc
_beginthreadex
sprintf
realloc
strchr
strncat
exit
printf
time
srand
atoi
rand
strncpy
strcat
strcpy
strcmp
strrchr
_except_handler3
malloc
free
memcmp
??2@YAPAXI@Z
memset
__CxxFrameHandler
strstr
strlen
_ftol
ceil
_controlfp

kernel32

RaiseException
GetStartupInfoA
GetModuleHandleA
lstrcmpiA
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetProcAddress
LoadLibraryA
CloseHandle
lstrcpyA
SetEvent
InterlockedExchange
CancelIo
Sleep
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
lstrlenA
CreateProcessA
lstrcatA
GetLogicalDriveStringsA
FindClose
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
SetLastError
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
FreeLibrary
OpenProcess
CreateThread
GetTickCount
TerminateThread
WinExec
OutputDebugStringA
GetModuleFileNameA
HeapFree
HeapAlloc
GetProcessHeap
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetSystemDirectoryA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
ReleaseMutex
OpenEventA
SetErrorMode
GetLocalTime
CopyFileA
lstrcmpA
ExitProcess
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot

user32

IsWindow
CloseWindow
CreateWindowExA
PostMessageA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CharNextA
wsprintfA
LoadCursorA
DestroyCursor
SendMessageA
SystemParametersInfoA
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
CloseClipboard
SetClipboardData
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorPos
GetCursorInfo
CloseDesktop
EnumWindows
GetWindowTextA
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
mouse_event

advapi32

RegEnumValueA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCreateKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
CreateServiceA
LookupAccountSidA
GetTokenInformation

shell32

SHGetSpecialFolderPathA

ws2_32

WSAGetLastError
inet_ntoa
htonl
sendto
inet_addr
send
select
closesocket
recv
ntohs
socket
gethostname
getsockname
gethostbyname
htons
connect
WSAStartup
WSACleanup
setsockopt

msvcp60

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

mfc42

ord540
ord800
ord6877
ord939
ord2818
ord4278
ord860
ord6663
ord858
ord535
ord537
ord6648
ord2764
ord4129
ord926
ord924
ord922

wininet

InternetOpenUrlA

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

iphlpapi

GetIfTable

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ef9bdd5422bebba030c4815579980b4

Headers

File Characteristics

Imports

shlwapi

msvcrt

kernel32

user32

advapi32

shell32

ws2_32

msvcp60

mfc42

wininet

avicap32

iphlpapi

wtsapi32

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 12KB - Virtual size: 15KB

.rsrc Size: 36KB - Virtual size: 34KB

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 12KB - Virtual size: 15KB

.rsrc
Size: 36KB - Virtual size: 34KB