5329c0a23c952b1561ef728abb43022127108b32168cc39446ff6d7017c4dfc5

Sharing

Copy URL Twitter E-mail

General

Target

5329c0a23c952b1561ef728abb43022127108b32168cc39446ff6d7017c4dfc5
Size

460KB
MD5

a25c3933606ed4d57736efc490f5b4e0
SHA1

debf0ef4d9038c1ed8d35cd7768c9266021ec9f8
SHA256

5329c0a23c952b1561ef728abb43022127108b32168cc39446ff6d7017c4dfc5
SHA512

bcfbad34e397a03790057ccd07bab29a0589cf5f48d2fa4c9bf9345d59c279ae563ad2adbaf126021e4a67d228933bb86ccf4b21b4ace029eddd07668271a1b2
SSDEEP

6144:/tRWWe7nHVaJp1YmvKzJmZb61job7kW4VfaCvwUDp2SqYd7S9H4iceEuUGkZcVaf:1kBjuvmW4V3p2SqYdeSBKD

Score

N/A

Malware Config

Signatures

Files

5329c0a23c952b1561ef728abb43022127108b32168cc39446ff6d7017c4dfc5
.exe windows x86

57bac83e69d76ae0d93b2d47c69deb03

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

hphelp

OpenTopic

hpgreg32

ord5
ord3

mfc42

ord4234
ord6453
ord2379
ord641
ord922
ord5856
ord4299
ord6880
ord3092
ord4079
ord4698
ord2116
ord6375
ord5300
ord4683
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord2575
ord4396
ord3402
ord3574
ord2528
ord609
ord616
ord2302
ord4710
ord5710
ord4129
ord5683
ord536
ord2645
ord4989
ord4931
ord3272
ord3353
ord3579
ord729
ord430
ord2728
ord4926
ord1825
ord4238
ord4696
ord3058
ord3065
ord6336
ord2510
ord2542
ord5243
ord567
ord1746
ord5577
ord3172
ord5740
ord4420
ord4858
ord2399
ord4387
ord3454
ord3198
ord6080
ord6175
ord4623
ord4426
ord652
ord338
ord4823
ord790
ord2086
ord818
ord858
ord3499
ord3175
ord4202
ord2652
ord5583
ord5981
ord2629
ord2763
ord1669
ord6329
ord926
ord6401
ord3520
ord3663
ord2841
ord2107
ord5450
ord5440
ord6383
ord6394
ord1908
ord4715
ord1690
ord5288
ord4439
ord2054
ord4431
ord771
ord1008
ord496
ord768
ord4259
ord4275
ord6111
ord5653
ord3221
ord4317
ord4386
ord1920
ord4262
ord4589
ord4284
ord4899
ord4370
ord4892
ord5076
ord4341
ord4349
ord4889
ord4531
ord4545
ord4963
ord4960
ord4108
ord5240
ord3748
ord4432
ord736
ord809
ord784
ord439
ord556
ord517
ord5260
ord613
ord6131
ord6216
ord289
ord3223
ord2593
ord777
ord5495
ord1146
ord4464
ord1088
ord2122
ord4723
ord1109
ord1093
ord3911
ord2042
ord5926
ord3626
ord2414
ord5787
ord283
ord4220
ord2584
ord3654
ord2438
ord6270
ord2863
ord1644
ord5903
ord1705
ord2504
ord2386
ord1706
ord3692
ord2452
ord5791
ord1641
ord1725
ord3216
ord4042
ord763
ord2535
ord483
ord4786
ord4614
ord4613
ord1841
ord4241
ord4533
ord4340
ord4347
ord4543
ord4526
ord4529
ord4524
ord6054
ord2091
ord3721
ord3619
ord795
ord364
ord2860
ord1087
ord5802
ord4720
ord692
ord535
ord939
ord941
ord5037
ord6605
ord5281
ord815
ord3738
ord4365
ord4056
ord5471
ord4121
ord2389
ord5085
ord4588
ord2554
ord4404
ord5234
ord6369
ord5279
ord5258
ord2444
ord3722
ord3571
ord3698
ord765
ord796
ord529
ord324
ord5953
ord3482
ord6000
ord2117
ord4265
ord2108
ord6069
ord2585
ord640
ord2450
ord5785
ord1640
ord323
ord2564
ord3414
ord6267
ord6272
ord755
ord470
ord3706
ord1768
ord5794
ord2971
ord5161
ord5162
ord5160
ord4905
ord4742
ord4976
ord4948
ord4377
ord4854
ord5287
ord4835
ord3699
ord489
ord2358
ord4258
ord4358
ord6028
ord384
ord686
ord816
ord2096
ord5789
ord562
ord2859
ord2408
ord1871
ord2393
ord3719
ord793
ord2884
ord3610
ord5572
ord1834
ord4229
ord4635
ord4607
ord4716
ord4750
ord5016
ord4375
ord4852
ord355
ord4834
ord6403
ord538
ord5919
ord3184
ord3317
ord6197
ord4287
ord3138
ord2080
ord3797
ord6242
ord2515
ord3522
ord3295
ord4366
ord5086
ord1710
ord1715
ord5064
ord5248
ord3730
ord807
ord554
ord4268
ord6209
ord5882
ord2089
ord5871
ord2626
ord4163
ord4454
ord2152
ord1233
ord1799
ord614
ord1206
ord2623
ord290
ord1223
ord4226
ord2486
ord4003
ord446
ord743
ord665
ord3790
ord354
ord5788
ord472
ord4133
ord4297
ord3573
ord1979
ord6385
ord353
ord5442
ord3318
ord5186
ord4278
ord6222
ord539
ord3716
ord2301
ord6646
ord2370
ord6334
ord4448
ord4671
ord4676
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord5282
ord2649
ord1665
ord4436
ord674
ord366
ord2120
ord2800
ord2494
ord2627
ord4457
ord5252
ord4427
ord4413
ord5732
ord4590
ord3870
ord6195
ord975
ord4146
ord1176
ord656
ord2298
ord861
ord1783
ord6021
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord4224
ord2463
ord1651
ord2867
ord1105
ord3584
ord543
ord803
ord1907
ord2882
ord2646
ord3693
ord2764
ord4160
ord860
ord6282
ord6283
ord540
ord2614
ord800
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord5302
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord1147
ord2817
ord1151
ord6402
ord924
ord2725
ord2818
ord1193
ord1168
ord2864
ord6215
ord2621
ord6116
ord4159
ord1205
ord1199
ord520
ord986
ord1200
ord296
ord5214

msvcrt

strtod
strncpy
__CxxFrameHandler
_mbscmp
_ftol
_splitpath
memmove
_mbsicmp
_strdup
free
_purecall
_mbschr
_mbsinc
_setmbcp
_XcptFilter
ceil
wcsncpy
wcslen
atoi
__getmainargs
_acmdln
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
__setusermatherr
exit
_controlfp
_initterm
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3

kernel32

GetModuleHandleA
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
DuplicateHandle
ResumeThread
EnterCriticalSection
SetEvent
GetLocaleInfoW
GetEnvironmentVariableA
WritePrivateProfileStringA
GetPrivateProfileStringA
OpenFileMappingA
GetShortPathNameA
GetCurrentThread
GetCurrentProcess
OutputDebugStringA
GetNumberFormatA
GlobalLock
GlobalUnlock
GetLocaleInfoA
GetWindowsDirectoryA
GetProfileIntA
SearchPathA
LoadLibraryA
GetProcAddress
FreeLibrary
SetLastError
GetTempFileNameA
lstrcpynA
GlobalSize
SetFilePointer
ReadFile
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
GlobalAlloc
GlobalFree
UnmapViewOfFile
GetTempPathA
GetSystemTimeAsFileTime
DeleteFileA
FindNextFileA
FindClose
GetVersionExA
CreateMutexA
GetLastError
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
OpenProcess
CreateProcessA
Sleep
GetProfileStringA
lstrcatA
FindFirstFileA
CloseHandle
LocalAlloc
LocalFree
lstrcpyA
lstrlenA
GetStartupInfoA
lstrcmpA

user32

LoadIconA
DestroyIcon
CheckMenuItem
WinHelpA
LoadImageA
CopyRect
InflateRect
GetMenu
CopyIcon
FillRect
ReleaseDC
GetDC
GetSystemMetrics
IsChild
ClientToScreen
DrawTextA
SetWindowLongA
GetCapture
IsCharAlphaA
SetWindowRgn
IsCharAlphaNumericA
GetSubMenu
PostQuitMessage
DispatchMessageA
PeekMessageA
MsgWaitForMultipleObjects
GetWindow
GetParent
FindWindowA
InvalidateRect
FindWindowExA
GetWindowPlacement
ShowWindow
SetWindowPos
WaitForInputIdle
GetWindowTextA
EnumWindows
GetWindowThreadProcessId
SetRectEmpty
OffsetRect
GetClassNameA
SendMessageA
GetSysColor
GetActiveWindow
GetCursorPos
ScreenToClient
SetCursor
SetRect
GetKeyState
IntersectRect
IsWindowVisible
LoadCursorA
GetClassLongA
SetClassLongA
IsRectEmpty
EqualRect
UpdateWindow
SetCapture
ReleaseCapture
SetActiveWindow
SetFocus
OpenDesktopA
CloseDesktop
SystemParametersInfoA
RegisterClipboardFormatA
GetWindowRect
PtInRect
GetClientRect
wsprintfA
IsWindow
KillTimer
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
EnableWindow
IsIconic
GetLastActivePopup
BringWindowToTop
SetTimer
PostMessageA
GetFocus
DrawFocusRect
EnumThreadWindows
LoadMenuA
EnumChildWindows
DrawIcon
DefWindowProcA
MessageBoxA

gdi32

DeleteObject
SelectPalette
CreatePalette
LPtoDP
DPtoLP
PatBlt
CreateFontIndirectA
GetObjectA
DeleteDC
CreateDCA
BitBlt
CreateCompatibleDC
CreateEllipticRgnIndirect
SaveDC
GetDeviceCaps
Ellipse
GetRgnBox
PtInRegion
GetBkColor
GetTextMetricsA
ExtTextOutA
SelectObject
GetClipBox
CreateDIBSection
RestoreDC
SetBkMode
SetTextColor
RealizePalette
GetTextExtentPoint32A
SetPixel
GetStockObject
CreateICA
RectVisible
CreateCompatibleBitmap
CreatePolygonRgn
CreatePen
FillRgn
SetMetaFileBitsEx

winspool.drv

EnumPrinterDriversA

advapi32

RegOpenKeyExA
FreeSid
RegCreateKeyA
RegSetValueExA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
OpenProcessToken
OpenThreadToken
EqualSid
AllocateAndInitializeSid
GetTokenInformation

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHGetDesktopFolder
ShellExecuteA
SHGetFileInfoA

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Draw

ole32

CoTaskMemAlloc
CoInitialize
CoTaskMemFree
OleUninitialize
CoCreateInstance
CoUninitialize
OleInitialize

oleaut32

SysFreeString
SysAllocStringLen

Sections

.text
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rmnet
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

57bac83e69d76ae0d93b2d47c69deb03

Headers

File Characteristics

Imports

version

hphelp

hpgreg32

mfc42

msvcrt

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

Sections

.text Size: 264KB - Virtual size: 263KB

.rdata Size: 100KB - Virtual size: 96KB

.data Size: 16KB - Virtual size: 14KB

.rsrc Size: 8KB - Virtual size: 20KB

.rmnet Size: 68KB - Virtual size: 68KB

.text
Size: 264KB - Virtual size: 263KB

.rdata
Size: 100KB - Virtual size: 96KB

.data
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 8KB - Virtual size: 20KB

.rmnet
Size: 68KB - Virtual size: 68KB