6db3673f95417277639c5a070dc2eaa844eba2a3341e957402c2966ffac96aac

Sharing

Copy URL Twitter E-mail

General

Target

6db3673f95417277639c5a070dc2eaa844eba2a3341e957402c2966ffac96aac
Size

1.1MB
MD5

5c17c1c3d787172ea55ec2c13ef9e507
SHA1

54ce9b1db4f6d719bac1d0c6f38dd0708b3fcfb7
SHA256

6db3673f95417277639c5a070dc2eaa844eba2a3341e957402c2966ffac96aac
SHA512

b4b5643fd1255853121b648f54f57e5c0ecab0bbf26fe9a67d278286f3d66f09312089f4e60e72d934bd80ee1e1668647e062da84a4e71f4399d828171dac760
SSDEEP

12288:g8HXTO4xArYkyPN3sFtSk2L8L9ldgcku0cOrvrXx/oFy6pSIayuMHR9xScEPPY+Y:g8HjR9adgcMtm1N7ocEVFNMT

Score

N/A

Malware Config

Signatures

Files

6db3673f95417277639c5a070dc2eaa844eba2a3341e957402c2966ffac96aac
.exe windows x86

69c7697bc620fb1fa2832628f9db8f38

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiGetDeviceInstanceIdA
SetupDiSetClassInstallParamsA
SetupDiChangeState
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiOpenDevRegKey
CM_Connect_MachineA
CM_Get_DevNode_Status_Ex
CM_Disconnect_Machine

traceapi

RegisterEvTrace
UnRegisterEvTrace
EvTraceDebugString
EvTraceString
EvTraceDebugCString

iphlpapi

GetNetworkParams
IpRenewAddress
GetPerAdapterInfo
GetInterfaceInfo
GetAdaptersInfo
IpReleaseAddress

netapi32

DsGetDcNameA
NetApiBufferFree

libeay32

ord464
ord201
ord3654
ord227
ord223
ord203
ord120
ord202
ord205
ord265
ord266
ord264
ord3315
ord2927
ord275
ord276
ord274
ord479
ord477
ord3106
ord3171
ord2206
ord3024
ord268
ord269
ord267
ord3216
ord3165
ord333
ord118
ord962
ord469
ord486
ord493

intstngs

??0CIntelSettings@@QAE@W4IT_SETTING_LOC@@KH@Z
??1CIntelSettings@@QAE@XZ
?GetSetting@CIntelSettings@@QAEJW4INTEL_SETTING@@PAH@Z

ws2_32

listen
accept
send
getsockname
WSAGetLastError
connect
shutdown
ioctlsocket
sendto
__WSAFDIsSet
recvfrom
bind
select
socket
WSASocketA
WSAIoctl
htons
htonl
WSACleanup
WSAAddressToStringA
WSAStartup
ntohs
ntohl
inet_ntoa
inet_addr
closesocket
setsockopt

iwmsprov

PulseIntelEvent

rpcrt4

UuidFromStringA

psregapi

?GetBinaryData@CRegistryEx@@QAEKPBDPAEK@Z
??1CRegistryEx@@UAE@XZ
?ChangeServiceConfigA@CRegApi@@QAEJPBDW4SERVICE_CONFIG@@@Z
?GetValue@CRegistryEx@@UAEJPBDJK@Z
?Open@CRegistryEx@@UAEHPAUHKEY__@@PBDKK@Z
??0CRegistryEx@@QAE@XZ
?EnumValue@CRegApi@@QAEJKPADAAK1PAE1@Z
?SetValue@CRegistryEx@@UAEHPBDJ@Z
?Close@CRegistryEx@@UAEXXZ
?GetValue@CRegistryEx@@UAEPBDPBD0K@Z
?QueryService@CRegApi@@QAEJPBDAAU_SERVICE_STATUS@@@Z
?ControlService@CRegApi@@QAEJPBDH@Z
??0CRegApi@@QAE@XZ
?OpenKey@CRegApi@@QAEJPAUHKEY__@@PBDK@Z
?QueryValue@CRegApi@@QAEJPBDPADAAK@Z
?CloseKey@CRegApi@@QAEJXZ
??1CRegApi@@UAE@XZ

wintrust

WinVerifyTrust

kernel32

GetExitCodeThread
ReadFile
GetFileSize
CreateFileA
WriteFile
TerminateThread
GetSystemPowerStatus
CreateThread
DebugBreak
GetModuleFileNameA
CreateProcessA
GetTickCount
GetCurrentThreadId
CancelIo
WaitForMultipleObjectsEx
CreateWaitableTimerA
CreateSemaphoreA
SetWaitableTimer
CancelWaitableTimer
OpenProcess
GetComputerNameA
FreeLibrary
GetProcAddress
LoadLibraryA
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
FindClose
FindNextFileA
FindFirstFileA
InterlockedDecrement
OpenMutexA
OpenFileMappingA
ReleaseMutex
CreateMutexA
GetVersionExA
ReleaseSemaphore
GlobalFree
GlobalHandle
GlobalUnlock
WaitForMultipleObjects
DefineDosDeviceA
GlobalLock
GlobalAlloc
PeekNamedPipe
GetExitCodeProcess
DuplicateHandle
GetCurrentProcess
FormatMessageA
GetStdHandle
SetStdHandle
GetDriveTypeA
GetLogicalDrives
CreateDirectoryA
DeleteFileA
LoadResource
LockResource
SizeofResource
ResetEvent
WaitForSingleObject
DeviceIoControl
GetOverlappedResult
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
CreateEventA
PulseEvent
CloseHandle
LocalFree
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
lstrcmpiW
lstrcmpiA
CompareStringW
CompareStringA
lstrlenW
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
Sleep
SetEvent
GetDateFormatA
GetTimeFormatA
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitThread
ResumeThread
CreatePipe
FindResourceA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsValidCodePage
GetACP
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
HeapSize
GetTimeZoneInformation
GetStartupInfoA
GetProcessHeap
GetCommandLineA
GetSystemTimeAsFileTime
GetLocalTime
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SystemTimeToFileTime
TerminateProcess
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RaiseException
HeapReAlloc
HeapFree
HeapAlloc
GetCurrentDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetFileTime
GetFileAttributesA
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SetErrorMode
GetOEMCP
GetCPInfo
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GlobalFlags
FileTimeToSystemTime
GetAtomNameA
InterlockedIncrement
LocalReAlloc
GlobalReAlloc
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
SetLastError
MulDiv
GlobalSize
CopyFileA
SetThreadPriority
SuspendThread
GetCurrentProcessId
GetModuleHandleA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
FreeResource
GetModuleFileNameW
lstrcmpA
MoveFileA
GetThreadLocale
SetFilePointer
FlushFileBuffers
LockFile

user32

TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
GetDlgItem
EndDeferWindowPos
BeginDeferWindowPos
SetActiveWindow
GetForegroundWindow
GetWindowTextLengthA
SetFocus
IsWindow
GetFocus
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetCapture
IsChild
WinHelpA
SendDlgItemMessageA
GetSysColorBrush
ReleaseDC
GetDC
CheckMenuItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextA
SetDlgItemInt
SetDlgItemTextA
SetScrollRange
UpdateWindow
SetWindowTextA
GetSysColor
ShowWindow
ScrollWindowEx
ClientToScreen
GetDesktopWindow
InflateRect
GetMenuItemInfoA
SetScrollInfo
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
UnregisterClassA
SetCursor
ShowOwnedPopups
DeleteMenu
DestroyIcon
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
GetDialogBaseUnits
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
PtInRect
SetWindowPlacement
GetDlgCtrlID
CallWindowProcA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetScrollRange
GetMenuItemID
SetScrollPos
GetScrollPos
SetForegroundWindow
IsDlgButtonChecked
ShowScrollBar
GetWindowRect
GetSystemMetrics
GetWindow
GetClientRect
GetMenu
GetClassInfoExA
GetClassInfoA
IsDialogMessageA
RegisterClassA
GetWindowThreadProcessId
GetParent
GetLastActivePopup
IsWindowEnabled
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
CopyRect
MoveWindow
GetScrollInfo
EnumWindows
GetWindowInfo
GetWindowTextA
LoadStringA
RegisterDeviceNotificationA
LoadIconA
LoadCursorA
RegisterClassExA
UnregisterDeviceNotification
PeekMessageA
wsprintfA
InvalidateRect
SetProcessDefaultLayout
GetWindowLongA
SendMessageA
CreateWindowExA
TranslateMessage
DispatchMessageA
PostQuitMessage
DefWindowProcA
SetWindowLongA
RegisterWindowMessageA
KillTimer
GetMessageA
PostThreadMessageA
PostMessageA
CharUpperW
CharUpperA
CharLowerW
CharLowerA
EnableWindow
MessageBoxA
SetWindowsHookExA
CallNextHookEx
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
GetMenuState
GetMenuStringA
AppendMenuA
DestroyMenu

gdi32

GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetTextExtentPoint32A
ExtTextOutA
BitBlt
CreateCompatibleDC
CreateFontIndirectA
DeleteObject
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetStockObject
GetClipBox
GetDCOrgEx
CreateDCA
CopyMetaFileA
ArcTo
GetTextMetricsA
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
GetDeviceCaps
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen

advapi32

StartServiceCtrlDispatcherA
RegOpenKeyA
RegDeleteKeyA
RegQueryValueA
RegCreateKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptDeriveKey
CryptHashData
CryptCreateHash
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RevertToSelf
ImpersonateLoggedOnUser
RegEnumKeyExA
RegDeleteValueA
CloseServiceHandle
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
OpenSCManagerA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegEnumKeyA
SetServiceStatus
ChangeServiceConfig2A
CreateServiceA
StartServiceA
RegisterServiceCtrlHandlerA
RegNotifyChangeKeyValue
GetUserNameA
RegSetValueA

shell32

SHGetMalloc
ShellExecuteExA
SHGetSpecialFolderLocation
SHGetFileInfoA
ExtractIconA
SHChangeNotify

ole32

CoDisconnectObject
StringFromGUID2
CLSIDFromString
CoCreateInstance
OleDuplicateData
CoInitializeEx
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateGuid
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
CreateErrorInfo
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysStringLen
VarBstrFromDate
GetErrorInfo
SetErrorInfo
VarCyFromStr

shlwapi

PathStripToRootA
PathFindExtensionA
PathFindFileNameA
PathRemoveExtensionA
PathIsUNCA

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

comdlg32

GetFileTitleA

Sections

.text
Size: 948KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69c7697bc620fb1fa2832628f9db8f38

Headers

File Characteristics

Imports

setupapi

traceapi

iphlpapi

netapi32

libeay32

intstngs

ws2_32

iwmsprov

rpcrt4

psregapi

wintrust

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

oleacc

winspool.drv

comdlg32

Sections

.text Size: 948KB - Virtual size: 947KB

.rdata Size: 176KB - Virtual size: 175KB

.data Size: 24KB - Virtual size: 142KB

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: 948KB - Virtual size: 947KB

.rdata
Size: 176KB - Virtual size: 175KB

.data
Size: 24KB - Virtual size: 142KB

.rsrc
Size: 8KB - Virtual size: 6KB