5e8dbc9504088719e4d500e61aeef626d39f5d745d1fe8358043f77e5d5a088c

Sharing

Copy URL Twitter E-mail

General

Target

5e8dbc9504088719e4d500e61aeef626d39f5d745d1fe8358043f77e5d5a088c
Size

264KB
MD5

a1b3809d70d478a10c28ea62358122f0
SHA1

bca8eb89880477987848c1990ecb127513475917
SHA256

5e8dbc9504088719e4d500e61aeef626d39f5d745d1fe8358043f77e5d5a088c
SHA512

4641819d0cbfbd86a75d04c83cf465b24be8ebc02ede7c46436e3802a0c1458ccd8a72efbee48b803ec890fa22789ad715d0aaa64c3f4d37370c2a6f43a86430
SSDEEP

3072:zs+9tJNwHgrbAImLV9yr0N3v5X9du350m9pGjdu/yc0l7QLsJyzLg:zsewArbnmL/yoN3v5XkpGhTcG7QLsV

Score

N/A

Malware Config

Signatures

Files

5e8dbc9504088719e4d500e61aeef626d39f5d745d1fe8358043f77e5d5a088c
.exe windows x86

d08ed30856f0afd015b2189ca97171b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
UnmapViewOfFile
VirtualFree
VirtualProtect
GetModuleHandleA
lstrcmpA
GetModuleFileNameA
CloseHandle
lstrcmpiA
EnterCriticalSection
LeaveCriticalSection
lstrcpynA
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
LoadLibraryA
MapViewOfFileEx
CreateFileMappingA
OpenFileMappingA
SearchPathA
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
GetSystemWindowsDirectoryA
ExitProcess
lstrlenA
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
HeapCreate
HeapReAlloc
GetModuleHandleW
Sleep
WriteFile
GetStdHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
ReadFile
SetHandleCount
GetFileType
SetFilePointer
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetStdHandle
FlushFileBuffers
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
SetEndOfFile
GetProcessHeap
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

gdi32

GetDeviceGammaRamp
EnumFontFamiliesA
SetWorldTransform
AnimatePalette
GdiGradientFill
Polyline
SetSystemPaletteUse
SetWindowExtEx
CreateRectRgn
GetTextExtentPointW
CreateDCA
GetCharWidthFloatA
GetObjectA
CreateICW
EnumFontFamiliesW
GetBkColor
GetTextMetricsA
GetTextCharset
GetEnhMetaFileW
GetMetaFileW
LPtoDP
LineTo
CancelDC
CloseFigure
AbortDoc
CreateColorSpaceA
GetCharABCWidthsA
SetTextColor
EnumFontsA
TranslateCharsetInfo
GetObjectW
GetStockObject
GetGraphicsMode
SetPaletteEntries
GetCharABCWidthsFloatA
RemoveFontResourceExA
DrawEscape
GetTextMetricsW
AddFontResourceExW
GetLogColorSpaceA
SetTextAlign
SelectPalette
SetGraphicsMode
Ellipse
GetCharWidthW
SelectClipPath
BitBlt
GetLogColorSpaceW
EnumFontsW
GetWinMetaFileBits
StrokeAndFillPath
GetDCOrgEx
EnumICMProfilesW
GetClipBox
FloodFill
GetEnhMetaFileHeader
CreateEllipticRgnIndirect
GetMapMode
Rectangle
SetMetaFileBitsEx
CreateICA
SetColorAdjustment
ArcTo
GetEnhMetaFilePixelFormat
DeleteMetaFile
OffsetViewportOrgEx
OffsetClipRgn
SetROP2
SetDeviceGammaRamp
SetBitmapBits
ExcludeClipRect
GetTextExtentPointI
MaskBlt
DescribePixelFormat
PlayEnhMetaFileRecord
GetViewportOrgEx
PaintRgn
GetDCPenColor
StartPage
GetColorAdjustment
CreateCompatibleBitmap
InvertRgn
GetBoundsRect
GetPaletteEntries
RemoveFontResourceExW
GetTextFaceA
SetWindowOrgEx
PlayMetaFileRecord
GetMiterLimit
StartDocA
GetSystemPaletteEntries
FixBrushOrgEx
Chord
CopyEnhMetaFileW
GetLayout
SetColorSpace
CheckColorsInGamut
GetCharWidthFloatW
FrameRgn
RestoreDC
UpdateColors
SetRectRgn
EndPath
GetICMProfileA
SetBkMode
GetViewportExtEx
GetEnhMetaFileBits
GetNearestColor
CreateSolidBrush
SetBkColor
CreateEnhMetaFileW
GetMetaRgn
GetCharWidth32A
DeleteColorSpace
EnumICMProfilesA
Escape
DeleteObject
GetGlyphIndicesA
CloseEnhMetaFile
CreateFontIndirectW
RoundRect
AddFontResourceExA
ChoosePixelFormat
CreatePalette
CreateBitmap
ExtFloodFill
AbortPath
GetTextExtentExPointI
ColorCorrectPalette
SaveDC
GetObjectType
SetWinMetaFileBits
SetMapMode
LineDDA
CreateFontIndirectExA
GetAspectRatioFilterEx
SetEnhMetaFileBits
PolylineTo
SetLayout
SetPixelV
SetBrushOrgEx
GetTextFaceW
GetStretchBltMode
SetTextJustification
PolyTextOutW
GetRgnBox
GetGlyphOutlineA
PolyBezier
CreateDIBPatternBrushPt
ExtCreatePen
GetKerningPairsW
CreateDIBSection
SetICMProfileA
GetNearestPaletteIndex
SetPolyFillMode
AddFontResourceW
GetTextExtentExPointA
GetCharWidthA
GetFontLanguageInfo
PtVisible
GetFontData
GetMetaFileA
CreateFontW
CreatePolyPolygonRgn
FlattenPath
GetPath
CreateMetaFileW
EnumObjects
EqualRgn
GetRegionData
GetTextExtentPoint32W
GetPixelFormat
SetBitmapDimensionEx
GetMetaFileBitsEx
CreateMetaFileA
GetArcDirection
GetBkMode
SetViewportOrgEx
GetCharABCWidthsW
FillRgn
StartDocW
CopyEnhMetaFileA

activeds

ord30
ord9
ord8
ord21
ord12
ord22

comsvcs

MTSCreateActivity
SafeRef
CoCreateActivity

crypt32

CertCreateCTLContext
CryptGetKeyIdentifierProperty
CertGetEnhancedKeyUsage
CertFindCertificateInCRL
CertDuplicateCTLContext
CryptFreeOIDFunctionAddress
CryptSignMessage
CertFindRDNAttr
CryptVerifyMessageHash
CryptHashCertificate
CertGetNameStringW
CryptMsgControl
CertVerifyCertificateChainPolicy
CertSetCertificateContextProperty
CryptImportPublicKeyInfo
CertEnumPhysicalStore
CertCreateCTLEntryFromCertificateContextProperties
CertRemoveStoreFromCollection
CertAddSerializedElementToStore
CryptVerifyDetachedMessageSignature
CryptExportPublicKeyInfoEx
CertGetIssuerCertificateFromStore
CryptFindOIDInfo
CertNameToStrW
CertFindCertificateInStore
CryptEnumOIDFunction
CertAddCertificateLinkToStore
CryptVerifyCertificateSignatureEx
CryptFindCertificateKeyProvInfo
CryptUnregisterDefaultOIDFunction
CertVerifyCRLRevocation
PFXIsPFXBlob
CertGetCRLContextProperty
CertOpenSystemStoreA
CryptRegisterOIDFunction
CertVerifyCTLUsage
CryptMsgCalculateEncodedLength
CertFindSubjectInCTL
CryptGetAsyncParam
CertSerializeCertificateStoreElement
CryptAcquireCertificatePrivateKey
CryptGetMessageCertificates
CryptExportPKCS8
CryptVerifyMessageSignatureWithKey
CertGetValidUsages
CertGetCertificateContextProperty
CryptUnregisterOIDFunction
CryptSignAndEncodeCertificate
CryptEncodeObjectEx
CryptSetOIDFunctionValue
CertDuplicateCertificateChain
CertDuplicateStore
CryptVerifyMessageSignature
CryptInitOIDFunctionSet
CryptUnregisterOIDInfo
CryptBinaryToStringA
CertOIDToAlgId
CertAddCertificateContextToStore
CryptMsgVerifyCountersignatureEncodedEx
CertEnumCTLsInStore
CryptStringToBinaryA
CryptMsgGetAndVerifySigner
CertAddCRLLinkToStore
CertControlStore
CryptEncodeObject
CertCloseStore
CryptUninstallDefaultContext
CryptStringToBinaryW
CertCreateContext
CryptFindLocalizedName
CertRDNValueToStrW
CertDeleteCRLFromStore
CryptVerifyCertificateSignature
CryptBinaryToStringW
CertVerifyTimeValidity
CertFindCTLInStore
CertCompareIntegerBlob
CertFreeCertificateContext
CertCompareCertificateName
CertFindSubjectInSortedCTL
CryptMsgEncodeAndSignCTL
CryptDecodeObject
CertEnumSubjectInSortedCTL
CertCreateCRLContext
CertAddCTLLinkToStore
CryptUnprotectData
CryptInstallOIDFunctionAddress
CryptInstallDefaultContext
CertEnumCRLsInStore
CertOpenStore

iphlpapi

SetTcpEntry
GetTcpStatistics
GetIpStatistics
GetUdpStatisticsEx
NotifyAddrChange
GetBestInterfaceEx
RestoreMediaSense
CreateProxyArpEntry
GetBestInterface
GetAdapterOrderMap
GetBestRoute
SetIpTTL
GetInterfaceInfo
CancelIPChangeNotify
FlushIpNetTable
GetIpAddrTable

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d08ed30856f0afd015b2189ca97171b3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

activeds

comsvcs

crypt32

iphlpapi

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 192KB - Virtual size: 199KB

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 192KB - Virtual size: 199KB