289d50e02b9e94a245090df2132f61091c8b596ee8c795cce26f1c1d75a095f0

Sharing

Copy URL Twitter E-mail

General

Target

289d50e02b9e94a245090df2132f61091c8b596ee8c795cce26f1c1d75a095f0
Size

105KB
MD5

6c7c1d5dddd8fc8746b286e2f8b3b346
SHA1

5c9b16e1b2cd976b30ec56136f1a73d79bab0868
SHA256

289d50e02b9e94a245090df2132f61091c8b596ee8c795cce26f1c1d75a095f0
SHA512

c61f2ff5c53d325fc8610879af22d47614f91b60696d5d65c491926fedd6eb8be5464c67586009f855d6856fe0aa61c3d852de6eb3a3aaba78d210b24b14a6e2
SSDEEP

1536:pNBL8iOtpQOs/Kz1asH6cMYfs9DY+osZxSiZ67Q:SiOvW4asH6cV3+o45M7

Score

N/A

Malware Config

Signatures

Files

289d50e02b9e94a245090df2132f61091c8b596ee8c795cce26f1c1d75a095f0
.exe windows x86

98fe6e42e0bee01b076106d3c80c5881

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetFileAttributesW
GetLastError
HeapFree
GetSystemInfo
GetPrivateProfileStringW
GetTimeZoneInformation
EnterCriticalSection
CreateEventW
QueryPerformanceCounter
SetThreadPriority
GetSystemDefaultLangID
ReleaseSemaphore
GetDiskFreeSpaceW
GlobalAlloc
SetEvent
MultiByteToWideChar
IsBadWritePtr
IsBadCodePtr
lstrlenW
GetCurrentThread
InitializeCriticalSection
SetEndOfFile
GetTickCount
lstrcmpW
InterlockedIncrement
SetFilePointer
lstrcmpiW
WaitForMultipleObjects
SetUnhandledExceptionFilter
GlobalHandle
WideCharToMultiByte
lstrlenA
GetProcAddress
CloseHandle
GetModuleFileNameA
lstrcpynW
GlobalMemoryStatus
GetQueuedCompletionStatus
CreateSemaphoreW
HeapAlloc
GetCurrentProcessId
lstrcpyW
GetFileSize
IsBadReadPtr
WaitForSingleObject
DeleteCriticalSection
InterlockedDecrement
GlobalLock
ReadFile
GetSystemTimeAsFileTime
GetVersionExW
ResetEvent
VirtualFree
GetThreadPriority
MulDiv
CreateThread
GetFullPathNameW
GetProfileIntA
InterlockedExchange
lstrcpyA
LeaveCriticalSection
GetCurrentProcess
WriteFile
CreateFileW
GlobalUnlock
GlobalFree
FreeLibrary
LoadLibraryW
GetACP
DeleteFileW

user32

MoveWindow
CheckRadioButton
GetWindowLongW
IsWindow
DestroyWindow
SetWindowLongW
LoadStringW
GetClientRect
GetAsyncKeyState
ShowWindow
CheckDlgButton
GetDesktopWindow
SetDlgItemTextW
SetDlgItemInt
IsRectEmpty
GetDlgItem
GetDlgItemInt
IsWindowVisible
EnableWindow
DispatchMessageW
GetWindowRect
ReleaseDC
SendMessageW
InvalidateRect
TranslateMessage
ClientToScreen
LoadCursorW
CreateDialogParamW
PeekMessageW
SetCursor
GetDC
DefWindowProcW

ifsutil

?CheckAndAdd@NUMBER_SET@@QAEEVBIG_INT@@PAE@Z
?CheckAndRemove@NUMBER_SET@@QAEEVBIG_INT@@PAE@Z
?CheckAndAdd@SPARSE_SET@@QAEEVBIG_INT@@PAE@Z
?AddNext@NUMBER_SET@@QAEEVBIG_INT@@@Z
?AddEdge@DIGRAPH@@QAEEKK@Z
?AddVolumeName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?AddEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?AddStart@NUMBER_SET@@QAEEVBIG_INT@@@Z

cewmdm

DllGetClassObject
DllRegisterServer
DllCanUnloadNow
DllUnregisterServer

nddeapi

NDdeGetErrorStringA
NDdeIsValidAppTopicListA
NDdeGetTrustedShareA
NDdeIsValidAppTopicListW
NDdeGetShareSecurityW
NDdeGetShareSecurityA
NDdeGetTrustedShareW

cfgmgr32

CMP_WaitNoPendingInstallEvents
CMP_Report_LogOn
CMP_WaitServicesAvailable
CM_Add_Empty_Log_Conf
CMP_Init_Detection

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98fe6e42e0bee01b076106d3c80c5881

Headers

File Characteristics

Imports

kernel32

user32

ifsutil

cewmdm

nddeapi

cfgmgr32

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 20KB - Virtual size: 64KB

.rsrc Size: 24KB - Virtual size: 23KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 20KB - Virtual size: 64KB

.rsrc
Size: 24KB - Virtual size: 23KB