b06f2be046f794d7dd366d3076f7697e24ec32b9b49a620053ce089815e71185

Sharing

Copy URL Twitter E-mail

General

Target

b06f2be046f794d7dd366d3076f7697e24ec32b9b49a620053ce089815e71185
Size

1.6MB
MD5

6e6431113ef805299e2220d5fdbee97c
SHA1

6dd32a3a68103660e9db6457d8bea9d8930335c5
SHA256

b06f2be046f794d7dd366d3076f7697e24ec32b9b49a620053ce089815e71185
SHA512

9ace74cb5e79ed235cc554d12e5ce06d61c378f5a377b13f7b26ac514cf6932cacc96558f32b6f0acbb28b979667d890484cbd73d43cb4d0a007d44d1d8ef926
SSDEEP

24576:A6k87EmzJNlNw1xy7qa5NApyQhO05g9t:Dk87EmzJ/Nu8NApyQhOF9

Score

N/A

Malware Config

Signatures

Files

b06f2be046f794d7dd366d3076f7697e24ec32b9b49a620053ce089815e71185
.exe windows x86

cb986ed7f144d80b665d8b865bc6a366

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_onexit
_lock
__dllonexit
_unlock
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_endthread
_vsnprintf
_wtol
_beginthreadex
_vsnwprintf
towlower
memmove
wcsncmp
wcspbrk
bsearch
iswdigit
towupper
iswalpha
_strlwr
_stricmp
iswalnum
_wcsupr
memcpy
malloc
_itow
_wcsnicmp
wcstol
calloc
free
ceil
wcstok
swscanf
_wcslwr
wcsrchr
_wtof
wcschr
??3@YAXPAX@Z
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
wcsstr
memset
strrchr
strstr
_purecall
_wtoi
_wcsicmp
iswspace

advapi32

OpenProcessToken
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExA
QueryServiceStatus
EnumDependentServicesW
ControlService
StartServiceW
CreateServiceW
QueryServiceConfigW
FreeSid
OpenSCManagerW
GetTokenInformation
AllocateAndInitializeSid
EqualSid
RegOpenKeyExA
InitiateSystemShutdownExW
AdjustTokenPrivileges
LookupPrivilegeValueW
TraceMessage
OpenServiceW
CloseServiceHandle
DeleteService
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW

kernel32

ExpandEnvironmentStringsW
MoveFileExW
CreateDirectoryW
GetSystemWindowsDirectoryW
GetModuleFileNameA
CreateThread
ReleaseMutex
CreateMutexW
LoadLibraryExW
InitializeCriticalSection
WaitForSingleObject
CreateEventW
DeleteCriticalSection
ResetEvent
LeaveCriticalSection
EnterCriticalSection
SetEvent
GetModuleHandleA
GetModuleHandleW
InterlockedExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
DeleteFileW
GetStartupInfoA
RtlUnwind
GetWindowsDirectoryW
GetTempPathW
GetSystemDirectoryW
CreateFileW
MoveFileW
GetModuleFileNameW
GlobalFree
GetCurrentDirectoryW
FindFirstFileA
FindClose
CreateFileA
ReadFile
GetCommandLineW
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
CloseHandle
GetLastError
DeviceIoControl
GetVersion
QueryDosDeviceW
DebugBreak
GetDriveTypeW
lstrlenW
SetErrorMode
GetLocaleInfoW
GetUserDefaultLangID
GetProfileStringW
WriteProfileStringW
GlobalAlloc
GlobalLock
GlobalUnlock
DeleteFileA
InterlockedDecrement
InterlockedIncrement
GetLongPathNameW
OpenEventW
WritePrivateProfileStringW
CreateProcessW
WaitForMultipleObjects
GetExitCodeProcess
CopyFileW
FindFirstFileW
FindNextFileW
GetShortPathNameW
GetDiskFreeSpaceExW
SetFileAttributesW
GetFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetVersionExA
GetFileAttributesW
GetFileAttributesA
LocalAlloc
LocalFree
GetWindowsDirectoryA
SetFilePointer
GetLocalTime
GetSystemDefaultLangID
SetCurrentDirectoryW
GetUserDefaultLCID
GetUserGeoID
GetPrivateProfileStringW
GetTempPathA
SetLastError
RemoveDirectoryW
GetVersionExW
GetFileSize
WriteFile
MultiByteToWideChar
GetExitCodeThread
CompareStringW
lstrlenA
InterlockedCompareExchange

gdi32

ExtTextOutW
GetTextFaceA
CreateFontA
GetTextMetricsW
CreateSolidBrush
CreatePen
PatBlt
CreateFontIndirectW
SetBkMode
SetTextColor
DeleteObject
GetDeviceCaps
GetStockObject
CreateCompatibleDC
SetMapMode
SelectObject
GetObjectW
DeleteDC
SetBkColor

user32

SetWindowPos
ScreenToClient
FindWindowExW
IsDlgButtonChecked
SendDlgItemMessageW
CheckRadioButton
EnableWindow
GetDesktopWindow
IsCharAlphaW
CharNextA
LoadStringA
IsWindow
GetSysColor
LoadImageW
MessageBoxW
LoadStringW
PostMessageW
SetWindowTextA
FindWindowW
SendMessageW
SetFocus
MoveWindow
MapWindowPoints
InvalidateRect
SetWindowTextW
ShowWindow
GetDC
DrawFocusRect
ReleaseDC
GetParent
GetWindowRect
GetDlgItem
PeekMessageW
PostThreadMessageW
SetCursor
CallWindowProcW
DrawTextW
LoadCursorW
DestroyCursor
GetActiveWindow
GetScrollInfo
SetScrollInfo
ScrollWindow
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
LoadIconW
SetForegroundWindow
UpdateWindow
GetClientRect
PostQuitMessage
BeginPaint
CreateDialogParamW
GetWindowLongW
SetWindowLongW
EndPaint
GetSystemMetrics
CreateWindowExW
DestroyWindow
SetTimer
KillTimer
GetSystemMenu
EnableMenuItem
DefWindowProcW

pdh

PdhOpenQueryW
PdhGetFormattedCounterValue
PdhCollectQueryData
PdhAddCounterW
PdhCloseQuery

ole32

CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CLSIDFromString
CoCreateInstance

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SysStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString
SysAllocStringLen

comctl32

InitCommonControlsEx

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetPathFromIDListW
SHChangeNotify
ShellExecuteW
SHGetFolderPathW
SHGetFolderLocation
SHGetMalloc
SHGetSpecialFolderLocation

gdiplus

GdipFree
GdipAlloc
GdipDisposeImage
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdiplusShutdown
GdiplusStartup
GdipCloneImage
GdipCreateHBITMAPFromBitmap

wininet

InternetCrackUrlW

setupapi

SetupGetLineCountW
SetupFindFirstLineW
SetupGetLineTextW
SetupFindNextLine
SetupIterateCabinetA
SetupCloseInfFile
SetupInstallFromInfSectionW
SetupGetBinaryField
SetupGetStringFieldW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain

urlmon

UrlMkSetSessionOption
ObtainUserAgentString

shlwapi

PathGetCharTypeA
PathRemoveBlanksW
SHDeleteKeyW
PathFindFileNameW
PathFindExtensionW
PathAddBackslashA
PathAddBackslashW
PathGetCharTypeW

crypt32

CertVerifyCertificateChainPolicy

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

mpr

WNetGetConnectionW
WNetCancelConnection2W
WNetAddConnection2W

Sections

.text
Size: 468KB - Virtual size: 467KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.3data
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cb986ed7f144d80b665d8b865bc6a366

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

gdi32

user32

pdh

ole32

oleaut32

comctl32

shell32

gdiplus

wininet

setupapi

wintrust

urlmon

shlwapi

crypt32

version

mpr

Sections

.text Size: 468KB - Virtual size: 467KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.3data Size: 72KB - Virtual size: 72KB

.text
Size: 468KB - Virtual size: 467KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.3data
Size: 72KB - Virtual size: 72KB