015eb008b9d9d2c28d7ef0c402d911a9

Sharing

Copy URL

Twitter E-mail

General

Target

015eb008b9d9d2c28d7ef0c402d911a9
Size

40KB
MD5

eea695a05d0c699af89a4012c6e188d7
SHA1

2817674712b41cedea831c9a02e30c70c45bc350
SHA256

915c01ee992c3163953e4f990d7d10429d159c3d3a8a54ed133af73e62862702
SHA512

4e702790110ecb2722b04db575776af5a299738a58a1ea4d286d7bab89b1ade8e74f52ae8921f6ce9f914de5836f2f83a36ae65fd2ee70bcf6d29318ccca2772
SSDEEP

768:uCLtxrf6FNADqbAS84KFPogk+Q5gPR4T7elqY1Dc9D9FWell8K:fSpArS59+qiDc9D9Fb/8K

Score

N/A

Malware Config

Signatures

Files

015eb008b9d9d2c28d7ef0c402d911a9
.zip

Password: infected
24c382ac4c203ba5ec8641a73c24dafa22241e911f1ef4c267de4493c1ab15dc
.dll windows x86

3e36abb03c486cf95df68e5c19aefda0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
WriteFile
WideCharToMultiByte
CreateProcessW
ExpandEnvironmentStringsW
GetStartupInfoW
CreatePipe
ReadFile
PeekNamedPipe
DeleteFileW
CreateThread
CreateFileW
GetModuleFileNameW
FreeConsole
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetExitCodeProcess
SetEvent
MoveFileW
CreateEventW
GetLocalTime
WaitForSingleObject
GetComputerNameW
GlobalMemoryStatus
GetCurrentThreadId
GetVersionExW
HeapFree
HeapAlloc
GetTickCount
OutputDebugStringA
MultiByteToWideChar
lstrcpyW
lstrlenW
LocalFree
LocalAlloc
TerminateProcess
CloseHandle
GetCurrentProcess
GetLastError
OpenProcess
OutputDebugStringW
GetVolumeInformationW
GetDiskFreeSpaceExW
LoadLibraryW
GetProcAddress
GetDriveTypeW
GetProcessHeap
Sleep
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
SetFilePointer

user32

GetThreadDesktop
GetProcessWindowStation
CloseDesktop
CloseWindowStation
wsprintfW
SetWindowsHookExW
UnhookWindowsHookEx
GetWindowTextW
GetActiveWindow
GetKeyNameTextW
CallNextHookEx
OpenWindowStationW
ExitWindowsEx
mouse_event
keybd_event
MapVirtualKeyW
SetCapture
WindowFromPoint
SetCursorPos
SetProcessWindowStation
OpenDesktopW
SetThreadDesktop
GetClientRect
CreateWindowExW

gdi32

DeleteDC
GetDIBits
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
CreateDCW
DeleteObject

advapi32

OpenSCManagerW
EnumServicesStatusW
OpenServiceW
QueryServiceConfigW
QueryServiceConfig2W
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SetServiceStatus
RegisterServiceCtrlHandlerW
RegOpenKeyW
SetTokenInformation
CreateProcessAsUserW
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
CloseServiceHandle
StartServiceW
QueryServiceStatus
ControlService
DeleteService
UnlockServiceDatabase
ChangeServiceConfigW
LockServiceDatabase
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
GetUserNameW
DuplicateTokenEx
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce

shell32

ShellExecuteW
SHFileOperationW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree

oleaut32

SysFreeString

ws2_32

closesocket
WSAIoctl
gethostbyname
htons
connect
WSAStartup
socket
recv
WSAGetLastError
send
setsockopt

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW

userenv

CreateEnvironmentBlock

shlwapi

StrRChrW

msvcrt

wcscmp
wcslen
wcscat
wcscpy
??2@YAPAXI@Z
swprintf
printf
sprintf
__CxxFrameHandler
_ftol
_except_handler3
atoi
wprintf
fclose
fwprintf
_wfopen
fprintf
_strdate
_strtime
fseek
fopen
free
malloc
__dllonexit
_onexit
_initterm
_adjust_fdiv

Exports

Exports

Launch
LoadStartup
ServiceMain

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

3e36abb03c486cf95df68e5c19aefda0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

imm32

userenv

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 12KB - Virtual size: 9KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 12KB - Virtual size: 9KB

.reloc
Size: 8KB - Virtual size: 4KB