a1c3190752c8a7c2e00d8ef80c70bb0300e2598178656c6979bf9a7d4bda2155

Sharing

Copy URL Twitter E-mail

General

Target

a1c3190752c8a7c2e00d8ef80c70bb0300e2598178656c6979bf9a7d4bda2155
Size

85KB
MD5

82103f452bfcd52580b3f0034883eb60
SHA1

cbfcc59e08cbf104e7d3630d9693b65e77878d9b
SHA256

a1c3190752c8a7c2e00d8ef80c70bb0300e2598178656c6979bf9a7d4bda2155
SHA512

1d4bf025439138afa1a1e512062f168882c7e2e723db63abf0fb7b46e48556e99d6e4379803a9553ef4606cb309f57e5c6a0f87893baad0bdfabaa09a5d090e7
SSDEEP

1536:WDRYLLN2V0lI1Mzn+FA4xGD60W2NllqwhHR6VeOzHtJ1lMIAOA9m:Ws8qkMzgA4xGD6KNXq4HR6Ve6VlMIAtm

Score

N/A

Malware Config

Signatures

Files

a1c3190752c8a7c2e00d8ef80c70bb0300e2598178656c6979bf9a7d4bda2155
.exe windows x86

eb845dc68a866c5dd6c94855badfad1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
SetFileAttributesW
SetFileTime
GetFileTime
CreateFileW
GetWindowsDirectoryW
ExitProcess
GetModuleFileNameW
GetLastError
CreateEventW
CopyFileW
GetFileAttributesW
CreateDirectoryW
GetLocalTime
GetVersion
WriteFile
SetFilePointer
GlobalUnlock
GlobalLock
WaitForMultipleObjects
GetFileSize
GetFullPathNameW
SetCurrentDirectoryW
lstrcmpW
VirtualQuery
CreateMutexW
GetCommandLineW
SetUnhandledExceptionFilter
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GlobalFree
GlobalAlloc
LocalAlloc
Module32NextW
Process32FirstW
FindFirstFileW
OpenProcess
IsDebuggerPresent
CheckRemoteDebuggerPresent
DeviceIoControl
IsBadReadPtr
WideCharToMultiByte
VirtualQueryEx
GetSystemInfo
GetVersionExA
MultiByteToWideChar
GetShortPathNameW
WinExec
GetModuleFileNameA
ResumeThread
SetPriorityClass
TerminateProcess
MoveFileExW
ExpandEnvironmentStringsW
LoadLibraryW
ReadFile
UnhandledExceptionFilter
GetStartupInfoA
SuspendThread
VirtualProtect
OpenThread
Thread32Next
HeapCreate
Thread32First
HeapFree
HeapAlloc
SetThreadContext
HeapReAlloc
GetThreadContext
Process32NextW
GetModuleHandleA
VirtualAllocEx
VirtualAlloc
WriteProcessMemory
VirtualFreeEx
VirtualFree
lstrcmpiA
DeleteFileW
GetLogicalDrives
SetErrorMode
GetDriveTypeW
lstrcpyW
Module32FirstW
lstrlenW
lstrcatW
FindNextFileW
FindClose
GetTickCount
lstrcmpiW
GetVersionExW
GetEnvironmentVariableW
GetProcAddress
CreateProcessW
GetCurrentThreadId
DeleteFileA
WaitForSingleObject
CloseHandle
Sleep
ExitThread
GetCurrentProcess
GetProcessId
GetCurrentProcessId
GetModuleHandleW
ReadProcessMemory

user32

GetMessageW
CreateWindowExW
RegisterClassW
LoadCursorW
ReleaseDC
DrawIcon
GetIconInfo
GetCursorInfo
GetCursorPos
wvsprintfA
TranslateMessage
MessageBoxW
wsprintfA
GetSystemMetrics
GetKeyboardLayout
GetWindowThreadProcessId
GetKeyNameTextW
MapVirtualKeyW
GetAsyncKeyState
DefWindowProcW
ChangeClipboardChain
PostMessageW
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
SetClipboardViewer
DispatchMessageW
GetKeyboardState
ToUnicodeEx
GetKeyState
GetForegroundWindow
GetWindowTextW
CharLowerBuffW
wsprintfW
FindWindowW

advapi32

RegSetValueExA
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
GetUserNameW
RegOpenKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
InitializeAcl
SetSecurityInfo
RegDeleteValueA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GetCurrentHwProfileW
RegEnumValueW
RegQueryValueExA

gdi32

CreateCompatibleBitmap
SelectObject
StretchBlt
DeleteObject
CreateDCW
CreateCompatibleDC
GetDIBits
GetObjectW

shell32

ord680
SHGetPathFromIDListW
SHGetSpecialFolderLocation
CommandLineToArgvW
ShellExecuteW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
CoInitialize
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

VariantClear

msvcrt

__setusermatherr
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_local_unwind2
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strstr
memmove
_wtoi
toupper
wcsncmp
wcstok
_endthread
_wcsupr
_wcslwr
wcscmp
wcsstr
tolower
strtok
strcat
_wcsicmp
strlen
memcpy
sscanf
memset
clock
rand
sprintf
_endthreadex
??3@YAXPAX@Z
_beginthreadex
atoi
getenv
strncpy
strcpy
wcscat
wcscpy
wcslen
_wgetenv

ntdll

NtOpenProcess
RtlAdjustPrivilege
RtlImageNtHeader
RtlCreateUserThread

urlmon

URLDownloadToFileW
URLDownloadToFileA

ws2_32

sendto
WSAStartup
inet_addr
getpeername
gethostbyaddr
inet_ntoa
htons
socket
setsockopt
connect
closesocket
send
recv
WSASend
gethostbyname

wininet

HttpOpenRequestA
InternetCloseHandle
InternetReadFile
HttpSendRequestA
InternetConnectA
InternetOpenA
HttpSendRequestW

shlwapi

PathRemoveFileSpecW
StrStrW
StrStrIW
PathFindExtensionW

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

crypt32

CryptStringToBinaryA
CryptBinaryToStringW
CryptStringToBinaryW
CryptUnprotectData
CryptBinaryToStringA

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb845dc68a866c5dd6c94855badfad1d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

gdi32

shell32

ole32

oleaut32

msvcrt

ntdll

urlmon

ws2_32

wininet

shlwapi

psapi

crypt32

Sections

.text Size: 59KB - Virtual size: 59KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 5KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 5KB

.reloc
Size: 3KB - Virtual size: 3KB