256b1ea3c6f8d8b4442e8a9dc5c0d5ddf3f026d70f88c090bf490147ae0fc1ff

Sharing

Copy URL Twitter E-mail

General

Target

256b1ea3c6f8d8b4442e8a9dc5c0d5ddf3f026d70f88c090bf490147ae0fc1ff
Size

223KB
MD5

96eed5a243e6cc01ddf5bdb7755b0ba0
SHA1

2a311e947e1abfe72863efbcba6e1d535e11039c
SHA256

256b1ea3c6f8d8b4442e8a9dc5c0d5ddf3f026d70f88c090bf490147ae0fc1ff
SHA512

306a1f374aa6c96498bce523501030610285f2e60c15d24743746d014c685e8ea0f07ad94ced71a4b1b91d23acfb6285e84a714d07eecd72287d8a5f930e0ea5
SSDEEP

3072:jZT25+ANZei1pAW/mu9Hcz0dKdr8pO8EkgUYrq0hUk7WciXrxOxwFqZ65c6:jK+sZVg/88z0dqrsbEecq0HTYd5

Score

N/A

Malware Config

Signatures

Files

256b1ea3c6f8d8b4442e8a9dc5c0d5ddf3f026d70f88c090bf490147ae0fc1ff
.exe windows x86

a63af57cc2380a3240e96129b222b5fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
EventRegister
EventUnregister
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegNotifyChangeKeyValue
EventWrite
RegGetValueW
RegQueryValueExW

kernel32

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
SetLastError
GetTickCount
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
EnterCriticalSection
GetModuleFileNameW
CreateMutexW
Sleep
CreateEventW
CreateThread
GetCurrentThreadId
SetEvent
GetCommandLineW
GetSystemTimeAsFileTime
CloseThreadpoolTimer
SetThreadpoolTimer
ResetEvent
CreateThreadpoolTimer
FlushInstructionCache
GetCurrentProcess
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
InitializeCriticalSectionAndSpinCount
RaiseException
lstrlenW
FindFirstFileW
CompareStringOrdinal
CreateFileW
CloseHandle
GetLastError
LoadLibraryExW
SetFileAttributesW
FindClose
FindNextFileW
MoveFileW
GetVersionExA
CopyFileExW
SetFilePointer
GetFileMUIPath
GetFileAttributesW
CompareFileTime
GetSystemInfo
GetSystemDefaultLCID
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
LCMapStringW
SystemTimeToFileTime
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
VirtualAlloc
VirtualFree
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange

gdi32

DeleteObject
CreateCompatibleDC
SelectObject
SetLayout
DeleteDC
CreateCompatibleBitmap
CreateDIBSection
CreateRectRgn

user32

GetMenuState
RegisterWindowMessageW
CreateWindowExW
RegisterClassExW
UnregisterClassA
LoadStringW
InsertMenuW
CharNextW
PostThreadMessageW
CharUpperW
GetMessageW
MsgWaitForMultipleObjects
EnumWindows
DispatchMessageW
TranslateMessage
PeekMessageW
DispatchMessageA
GetMessageA
IsWindowUnicode
CreateIconIndirect
DrawIconEx
GetIconInfo
SetWindowLongW
GetWindowLongW
PostMessageW
IsIconic
ShowWindow
SendMessageW
SetWindowRgn
GetClassInfoExW
LoadCursorW
LoadImageW
GetSystemMetrics
DestroyIcon
PostQuitMessage
CheckMenuItem
GetSystemMenu
SetWindowTextW
ModifyMenuW
DeleteMenu
CallWindowProcW
DefWindowProcW

msvcrt

??3@YAXPAX@Z
??_V@YAXPAX@Z
_vsnwprintf
??_U@YAPAXI@Z
memset
free
malloc
memcpy_s
memmove_s
wcsncpy_s
_purecall
??2@YAPAXI@Z
wcscpy_s
wcscat_s
swprintf_s
_ftol2
bsearch
qsort
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
realloc
_errno
_unlock
__dllonexit
wcstoul
swscanf_s
iswspace
_lock
_onexit
?terminate@@YAXXZ
_controlfp
exit

ole32

PropVariantCopy
CoFreeUnusedLibrariesEx
PropVariantClear
CoDisconnectObject
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CoResumeClassObjects

oleaut32

VariantInit
VariantClear
SysFreeString
VarUI4FromStr
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VariantChangeType

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW
ord615
ord487
ord16
SHStrDupW
UrlEscapeW
SHCreateStreamOnFileW
PathParseIconLocationW
SHCreateStreamOnFileEx
UrlUnescapeW

propsys

PropVariantCompareEx
PSGetPropertyKeyFromName
StgDeserializePropVariant
PropVariantToStringAlloc
PropVariantChangeType
PSCreateMemoryPropertyStore
PSGetPropertyDescriptionListFromString
PSGetPropertyDescriptionByName
PropVariantToGUID

shell32

ShellExecuteExW
ord155
SHCreateShellItemArrayFromIDLists
ord6
SHGetPropertyStoreForWindow
Shell_NotifyIconW
SHParseDisplayName
SHQueryUserNotificationState
ord165

dwmapi

DwmSetWindowAttribute
DwmSetIconicThumbnail

gdiplus

GdipSetSmoothingMode
GdipFree
GdipAlloc
GdiplusStartup
GdipCreateFromHDC
GdipCreateBitmapFromFileICM
GdipCloneImage
GdiplusShutdown
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipDrawImageRectI

ntdll

WinSqmSetString
WinSqmAddToStreamEx
WinSqmEndSession
WinSqmIsOptedIn
WinSqmStartSession
WinSqmIncrementDWORD
WinSqmSetDWORD
RtlGetNativeSystemInformation

xmllite

CreateXmlReader

rpcrt4

UuidFromStringW

msi

ord113

crypt32

CertVerifyCertificateChainPolicy

wintrust

CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a63af57cc2380a3240e96129b222b5fd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shlwapi

propsys

shell32

dwmapi

gdiplus

ntdll

xmllite

rpcrt4

msi

crypt32

wintrust

Sections

.text Size: 151KB - Virtual size: 151KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 30KB - Virtual size: 30KB

.text
Size: 151KB - Virtual size: 151KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 30KB - Virtual size: 30KB