039c42b2c98ad7c5dc2836bd1edb73a5ec776ee993ff9c9c5559e2253eab6f84

Sharing

Copy URL Twitter E-mail

General

Target

039c42b2c98ad7c5dc2836bd1edb73a5ec776ee993ff9c9c5559e2253eab6f84
Size

1.4MB
MD5

905e1cf4320d471e84b72d2e124ba4c2
SHA1

b603a49416db95667e9227fb179db86ee4126b16
SHA256

039c42b2c98ad7c5dc2836bd1edb73a5ec776ee993ff9c9c5559e2253eab6f84
SHA512

2a807870e4829ac79f2d9905eec8fafcee1e65fb06a812992e6a0379f70515cb15ba0f076144dcafcd416be7312a133470c7bfd220cc2d0cb01bec1c49bfc1ac
SSDEEP

24576:3j3Pw75gNGjkp83LUFBX5LHgZpJEMwV4j/7hw1sCUB:z3Pw75gNGjkp8bUFBX5LHkJEpktkU

Score

N/A

Malware Config

Signatures

Files

039c42b2c98ad7c5dc2836bd1edb73a5ec776ee993ff9c9c5559e2253eab6f84
.exe windows x86

a8a185662c53675de74a33e3a836899e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
wcscat_s
_vsnprintf
_CIsqrt
memmove
_snwprintf_s
wcsncat_s
_vsnprintf_s
bsearch
memcpy
_wtoi
_ftime64_s
_localtime64_s
_snprintf_s
_beginthreadex
_endthreadex
strncpy_s
vswprintf_s
_set_invalid_parameter_handler
swscanf_s
wcstok_s
_vsnwprintf_s
wcscpy_s
wcsstr
_ultow_s
wcstod
localeconv
wcsncmp
_wcsnicmp
calloc
wcstoul
wcstol
_set_errno
_get_errno
_ltow_s
wcspbrk
wcsrchr
_HUGE
wcschr
realloc
malloc
_beginthread
_recalloc
wcsncpy_s
memmove_s
memset
_wcslwr_s
swprintf_s
free
memcpy_s
_CxxThrowException
__CxxFrameHandler3
_wcsicmp

atl90

ord64
ord15
ord31
ord61
ord23
ord30
ord58
ord24
ord43
ord44
ord10
ord32
ord11

advapi32

FreeSid
TraceEvent
CryptAcquireContextA
RegEnumKeyW
RegQueryInfoKeyW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
RegQueryValueExA
RegisterTraceGuidsA
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
CryptDestroyHash
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
CryptGenRandom
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
DeregisterEventSource
ReportEventW
OpenThreadToken
UnregisterTraceGuids
RegOpenKeyExA
ConvertSidToStringSidA
CreateWellKnownSid
IsValidSid
EqualSid
CheckTokenMembership
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
CopySid
AllocateAndInitializeSid
RegisterEventSourceW

gdi32

CreateSolidBrush
DeleteObject
DeleteDC
GetDeviceCaps
CreateDCA

kernel32

GetTickCount
CreateFileW
GetSystemTime
OutputDebugStringW
CreateProcessW
IsDebuggerPresent
GetTimeFormatW
DebugBreak
GetUserDefaultUILanguage
GetTempPathW
GetTimeZoneInformation
IsWow64Process
GetVersionExW
TerminateProcess
GetFileSize
ReadFile
FlushFileBuffers
CopyFileW
SetFilePointer
GetStringTypeW
FileTimeToSystemTime
GetNumberFormatW
GetCurrencyFormatW
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SetEndOfFile
EnumSystemLocalesW
QueryPerformanceFrequency
GetSystemInfo
GetDateFormatW
SetUnhandledExceptionFilter
SleepEx
CancelIo
ReadDirectoryChangesW
SetProcessShutdownParameters
LoadLibraryA
GetProcessHeap
VirtualAlloc
HeapSetInformation
HeapUnlock
HeapLock
ExpandEnvironmentStringsW
GetProcessTimes
CreateEventA
GlobalFree
CreateMutexA
OpenMutexA
CreateSemaphoreA
CreateFileMappingA
GetShortPathNameA
GetModuleFileNameA
GlobalAlloc
VirtualFree
GetSystemDefaultLCID
GetModuleHandleExW
RtlCaptureStackBackTrace
GetSystemTimeAsFileTime
GetLocalTime
SetFileAttributesW
GetSystemDirectoryW
IsValidLocale
GetDiskFreeSpaceExW
CreateProcessA
IsDBCSLeadByte
GetStringTypeExW
IsValidCodePage
GetFileType
LoadLibraryExW
GetCurrentThread
GetUserDefaultLangID
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
EnumUILanguagesW
GetCalendarInfoW
VirtualProtect
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
UnhandledExceptionFilter
GetCommandLineW
VirtualQuery
FlushInstructionCache
GetCurrentProcess
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
CloseHandle
FindClose
FreeLibrary
GlobalDeleteAtom
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalFree
MultiByteToWideChar
GetDriveTypeW
lstrlenW
FormatMessageW
LocalAlloc
UnmapViewOfFile
WaitForSingleObject
GlobalGetAtomNameW
OpenEventW
GlobalAddAtomW
FindFirstFileW
FindNextFileW
FindAtomW
DuplicateHandle
CreateMutexW
lstrlenA
ReleaseMutex
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCurrentProcessId
OpenProcess
OpenMutexW
SetEvent
CreateEventW
WaitForMultipleObjects
DeleteFileW
Sleep
TerminateThread
ResetEvent
CreateThread
GetCurrentThreadId
WideCharToMultiByte
CompareStringW
GetUserDefaultLCID
CreateSemaphoreW
GetVersionExA
TlsSetValue
TlsGetValue
InitializeCriticalSection
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
QueryPerformanceCounter
CreateDirectoryW
WriteFile
SystemTimeToFileTime
GetLocaleInfoW
RaiseException
TlsFree
TlsAlloc

ole32

StringFromGUID2
CoCreateInstance
IIDFromString
CoInitializeEx
OleUninitialize
OleInitialize
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
StringFromCLSID
CoCreateFreeThreadedMarshaler
StringFromIID
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoCreateGuid

oleaut32

SafeArrayCreateVector
LoadTypeLibEx
LoadRegTypeLi
VariantCopyInd
VariantCopy
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SafeArrayGetVartype
SafeArrayAccessData
SetErrorInfo
GetErrorInfo
SafeArrayUnaccessData
VariantClear
SysAllocString
VariantInit
SysFreeString
SysReAllocStringLen
SysStringLen
SysAllocStringLen

shell32

SHGetFileInfoW
SHChangeNotify
SHGetPathFromIDListW
SHGetDataFromIDListW
SHGetMalloc
SHGetDesktopFolder
ShellExecuteW
SHGetFolderPathW
SHGetFolderLocation
SHGetSpecialFolderPathW
ShellExecuteExW

shlwapi

PathIsRootW
PathFileExistsW
UrlGetPartW
PathRemoveBackslashW
PathIsUNCW
PathCreateFromUrlW
PathIsDirectoryW
StrCmpIW
PathIsUNCServerW
PathIsUNCServerShareW
PathFindFileNameW
PathCombineW
PathFindExtensionW
PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathRemoveExtensionW
PathSearchAndQualifyW

user32

UnregisterClassA
EnumDisplayMonitors
GetMonitorInfoA
GetSysColor
GetKeyboardLayoutList
GetMenuCheckMarkDimensions
MsgWaitForMultipleObjectsEx
MessageBoxW
RegisterClassExW
GetClassInfoExW
GetWindowLongW
SetWindowLongW
SetCursor
LoadCursorW
SendMessageW
GetClassNameW
GetWindowThreadProcessId
PostMessageW
SetTimer
KillTimer
DestroyWindow
CreateWindowExW
RegisterWindowMessageW
DefWindowProcW
CallWindowProcW
DispatchMessageW
PeekMessageW
SetForegroundWindow
ShowWindowAsync
IsIconic
IsWindow
EnumWindows
CharLowerW
CharUpperW
GetSystemMetrics
SystemParametersInfoA
GetCursor
GetKeyboardLayout
ReleaseDC
GetDC
LoadStringW

rpcrt4

UuidCreate

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 668KB - Virtual size: 667KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 211KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp1
Size: 540KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a8a185662c53675de74a33e3a836899e

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

atl90

advapi32

gdi32

kernel32

ole32

oleaut32

shell32

shlwapi

user32

rpcrt4

Exports

Exports

Sections

.text Size: 668KB - Virtual size: 667KB

.data Size: 211KB - Virtual size: 252KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 34KB - Virtual size: 33KB

.vmp1 Size: 540KB - Virtual size: 1.6MB

.text
Size: 668KB - Virtual size: 667KB

.data
Size: 211KB - Virtual size: 252KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 34KB - Virtual size: 33KB

.vmp1
Size: 540KB - Virtual size: 1.6MB