26e84519f3875d3c579c95ec1694eff8224f75eaec63ae8970bc85ff1479f392_unpacked

Sharing

Copy URL Twitter E-mail

General

Target

26e84519f3875d3c579c95ec1694eff8224f75eaec63ae8970bc85ff1479f392_unpacked
Size

92KB
MD5

fee57a9ab782bba336d36748f3a2e38d
SHA1

3f1a24eb3a72a8bfe6cbae09d811e7acec0744e3
SHA256

4fea4606005e9aae55c2b0aaca7558e3e9a34ba412d7cb5182dba868cfb1eb7c
SHA512

34f2cbeca546a821f24cad8d114beae7869cad5d666ebd4014932f70e903253c253c26e4f6b1f55a5a7cbb71f3150f4a5ce09d4673f558762c3ba1b76700760c
SSDEEP

1536:3U+miFvWiYU4BZjbgcRyQo8lJHASYbY+2QSI5Sn/X8py7xpzW48iFjR5Hk36KL:k+mmYbZj/lJHV8JiR9pwC7kqK

Score

N/A

Malware Config

Signatures

Files

26e84519f3875d3c579c95ec1694eff8224f75eaec63ae8970bc85ff1479f392_unpacked
.exe windows x86

8f4bcf9bdbcf43d4b5cb5c0eb6055dfa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
LoadLibraryA
DeleteFileW
HeapReAlloc
GetNativeSystemInfo
CreateThread
HeapAlloc
HeapDestroy
VirtualAllocEx
LocalFree
DeleteCriticalSection
GetComputerNameW
GetProcessHeap
SystemTimeToFileTime
GlobalMemoryStatusEx
CreateProcessW
WideCharToMultiByte
InterlockedIncrement
GetSystemTime
VirtualFreeEx
IsBadReadPtr
lstrcmpiW
OpenMutexW
SetEndOfFile
GetCurrentThread
FlushFileBuffers
RemoveVectoredExceptionHandler
GetCurrentProcess
SetErrorMode
GetVersionExW
DuplicateHandle
GetModuleHandleA
AddVectoredExceptionHandler
ExitProcess
GetCurrentProcessId
CopyFileW
lstrcmpiA
IsWow64Process
FindFirstChangeNotificationW
FindNextChangeNotification
IsProcessInJob
CreateRemoteThread
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
GetLogicalDrives
GetDriveTypeW
GetUserDefaultUILanguage
CopyFileExW
GetEnvironmentVariableW
SetFilePointer
InitializeCriticalSection
GetTimeZoneInformation
MultiByteToWideChar
SetFileAttributesW
GetVolumeNameForVolumeMountPointW
OpenProcess
GetFileTime
ReleaseMutex
LeaveCriticalSection
GetModuleFileNameW
SetFileTime
RemoveDirectoryW
VirtualAlloc
ExpandEnvironmentStringsW
WriteFile
FindNextFileW
EnterCriticalSection
GetFileAttributesW
FindClose
OpenEventW
GetTempPathW
SetLastError
HeapFree
HeapCreate
WriteProcessMemory
GetFileSizeEx
FindFirstFileW
InterlockedExchange
GetVolumeInformationW
ReadFile
CreateDirectoryW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
Process32FirstW
Process32NextW
GetLastError
CreateToolhelp32Snapshot
CreateFileW
CreateMutexW
ResetEvent
CloseHandle
SetEvent
Sleep
CreateEventW
WaitForSingleObject
WaitForMultipleObjects
GetTickCount
VirtualFree

user32

GetIconInfo
DrawIcon
LoadImageW
GetCursorPos
DefWindowProcW
CreateWindowExW
UnregisterClassW
GetKeyboardLayoutList
CharLowerA
CharToOemW
TranslateMessage
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjects
RegisterClassExW
SetWindowLongA
GetWindowLongA
CharUpperW
DestroyWindow

crypt32

CryptImportPublicKeyInfo
CryptDecodeObjectEx

advapi32

RegCloseKey
GetAce
CryptEncrypt
GetSidSubAuthorityCount
AllocateAndInitializeSid
GetSidSubAuthority
SetEntriesInAclW
RegCreateKeyExW
CryptVerifySignatureW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CryptCreateHash
CryptHashData
SetSecurityDescriptorSacl
RegSetValueExW
CryptDestroyHash
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
RegOpenKeyExW
CryptImportKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
RegQueryValueExW
CryptReleaseContext
GetTokenInformation
CryptDestroyKey
AdjustTokenPrivileges
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
LookupPrivilegeValueW
GetLengthSid
RegDeleteValueW
RegFlushKey
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumKeyW
InitiateSystemShutdownExW
CryptAcquireContextW

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW

shlwapi

PathFileExistsW
PathIsURLW
PathIsDirectoryEmptyW
StrCmpNIW
PathRenameExtensionW
StrStrIW
PathMatchSpecW
PathCombineW
PathRemoveFileSpecW
PathAddBackslashW
wvnsprintfW
PathUnquoteSpacesW
PathSkipRootW
PathFindExtensionW
SHDeleteValueW
wvnsprintfA
PathIsDirectoryW
PathRemoveBackslashW
UrlUnescapeA
PathQuoteSpacesW

psapi

GetModuleFileNameExW

ole32

CLSIDFromString
CoInitializeEx
CreateStreamOnHGlobal
CoSetProxyBlanket
CoCreateInstance
CoUninitialize

gdi32

DeleteObject
GetDeviceCaps
CreateDCW
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteDC

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

InternetConnectA
InternetReadFile
HttpQueryInfoA
InternetQueryOptionA
HttpOpenRequestA
InternetCrackUrlA
InternetSetOptionA
InternetOpenA
InternetCloseHandle
HttpSendRequestA

urlmon

ObtainUserAgentString

oleaut32

VariantClear

secur32

GetUserNameExW

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f4bcf9bdbcf43d4b5cb5c0eb6055dfa

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

crypt32

advapi32

shell32

shlwapi

psapi

ole32

gdi32

version

wininet

urlmon

oleaut32

secur32

Sections

.text Size: 62KB - Virtual size: 61KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 2KB - Virtual size: 15KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 62KB - Virtual size: 61KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 2KB - Virtual size: 15KB

.reloc
Size: 3KB - Virtual size: 3KB