b412fad8476375fe859a2a9daf81276403526ea118ba4bff34c6260f2249a79a

Sharing

Copy URL Twitter E-mail

General

Target

b412fad8476375fe859a2a9daf81276403526ea118ba4bff34c6260f2249a79a
Size

295KB
MD5

915eea26082a2c90450625450448f888
SHA1

40f5fb202afb2913b3dee3efe71ae08083579824
SHA256

b412fad8476375fe859a2a9daf81276403526ea118ba4bff34c6260f2249a79a
SHA512

e80d0f645c5f7a3fde3e6cb66792ae2ee25812a6b5d6f66b8e1afa23a4fb06c728b67650ba9451c877ca19f130daa7f85e33a55653639ec38290dbf13391737c
SSDEEP

6144:T/x18tNpRLpy/gbsWy5lZ85ssJ62HHYwzpUtZCNohaXF:stNpryqy5QsZ2nZoR+F

Score

N/A

Malware Config

Signatures

Files

b412fad8476375fe859a2a9daf81276403526ea118ba4bff34c6260f2249a79a
.exe windows x86

cf20d2de5ef33db74b557bd59ed805bb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfW
UnregisterClassA

shlwapi

PathRemoveFileSpecW
StrStrIW
SHGetValueA

oleaut32

SafeArrayLock
SafeArrayCopy
VariantChangeType
GetErrorInfo
SafeArrayDestroy
SafeArrayUnlock
SysStringByteLen
VariantCopy
SafeArrayDestroyDescriptor
VariantInit
SafeArrayGetUBound
GetRecordInfoFromGuids
SafeArrayUnaccessData
SafeArrayDestroyData
LoadTypeLi
SysAllocStringByteLen
SysAllocStringLen
VariantCopyInd
SafeArrayCreate
SafeArrayCreateVectorEx
SafeArrayGetLBound
LoadRegTypeLi
VarBstrCmp
SafeArrayGetVartype
SafeArrayAccessData
SysAllocString
VarBstrCat
SysFreeString
SysStringLen
VariantClear
SafeArrayRedim

userenv

ExpandEnvironmentStringsForUserW
UnloadUserProfile

ws2_32

sendto
socket
htons
WSACleanup
inet_addr
WSAStartup
closesocket

kernel32

GetFileInformationByHandle
FindClose
IsDebuggerPresent
GetCurrentThreadId
ConnectNamedPipe
GetProcessHeap
GetShortPathNameW
SetThreadLocale
HeapReAlloc
WideCharToMultiByte
OpenEventW
GetDriveTypeW
SizeofResource
CreateFileW
FindResourceExW
HeapFree
LCMapStringW
HeapSize
GetModuleHandleA
HeapDestroy
CreateThread
CancelIo
FormatMessageA
MoveFileExW
LeaveCriticalSection
GetSystemTimeAsFileTime
VerSetConditionMask
GetLongPathNameW
ExpandEnvironmentStringsW
GetACP
LocalFree
WaitForSingleObject
ReadFile
GetOverlappedResult
GetThreadLocale
RaiseException
HeapAlloc
OpenProcess
FindResourceW
GetFileSize
WriteFile
FindFirstFileW
LockResource
OutputDebugStringA
CreateEventW
UnhandledExceptionFilter
ResetEvent
CloseHandle
WaitForMultipleObjects
CreateNamedPipeW
VerifyVersionInfoW
DisconnectNamedPipe
lstrlenA
FreeLibrary
LoadResource
QueryPerformanceFrequency
OutputDebugStringW
DeleteCriticalSection
lstrlenW
FormatMessageW
GetModuleHandleW
EnterCriticalSection
GetVolumePathNameW
SetLastError
SetUnhandledExceptionFilter
QueryDosDeviceW
GetStartupInfoW
VirtualAllocEx

ole32

CoInitializeEx
CoCreateInstance
CoUnmarshalInterface
CoImpersonateClient
CoUninitialize
CoRevertToSelf
CoMarshalInterThreadInterfaceInStream
OleRun

advapi32

CopySid
GetSecurityDescriptorControl
SetThreadToken
SetSecurityDescriptorDacl
OpenProcessToken
GetSecurityDescriptorDacl
RevertToSelf
GetTokenInformation
InitializeSecurityDescriptor
GetSidLengthRequired
OpenThreadToken
EqualSid
ImpersonateNamedPipeClient
GetSecurityDescriptorOwner
RegCloseKey
ConvertSidToStringSidW
RegOpenKeyExW
InitializeSid
GetAclInformation
AddAce
GetSecurityDescriptorLength
SetSecurityDescriptorOwner
GetSidSubAuthority
InitializeAcl
GetLengthSid
ConvertStringSidToSidW
MakeAbsoluteSD
RegOpenKeyW
GetSecurityDescriptorGroup
RegQueryValueExW
GetSecurityDescriptorSacl
IsValidSid
MakeSelfRelativeSD

psapi

GetModuleFileNameExW

shell32

SHGetFolderPathW

comctl32

ImageList_LoadImageW
ImageList_SetBkColor
DrawInsert
ImageList_DragShowNolock
DestroyPropertySheetPage
CreatePropertySheetPageA
FlatSB_GetScrollInfo

kbdit

KbdLayerDescriptor

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 265KB - Virtual size: 889KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cf20d2de5ef33db74b557bd59ed805bb

Headers

File Characteristics

Imports

user32

shlwapi

oleaut32

userenv

ws2_32

kernel32

ole32

advapi32

psapi

shell32

comctl32

kbdit

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 265KB - Virtual size: 889KB

.rsrc Size: 6KB - Virtual size: 6KB

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 265KB - Virtual size: 889KB

.rsrc
Size: 6KB - Virtual size: 6KB