1001e9b098ea8374acf0db808e332a72e66d781ed752e595c1e39624b88d4f53

Sharing

Copy URL Twitter E-mail

General

Target

1001e9b098ea8374acf0db808e332a72e66d781ed752e595c1e39624b88d4f53
Size

85KB
MD5

0b9cddd5dd2c1790ad6f9fa9ad007e60
SHA1

6a127d4d1138c2d74367cd779478a145d792ebe1
SHA256

1001e9b098ea8374acf0db808e332a72e66d781ed752e595c1e39624b88d4f53
SHA512

5f9fcd15a6734090044a22bb1185eb8e1ba3668bda4f717ba848473cdbde3219978fd6499fc9e61e9922522ccaa580f79395d9999ac220b6aae3ed0e4133ec66
SSDEEP

1536:E+thNtw9vtslJcbIMRHZnfXEHbJASFWuJd44w+jj/3+WOQ/N:EOhNtw9lslJccMFRs04Rv/N

Score

N/A

Malware Config

Signatures

Files

1001e9b098ea8374acf0db808e332a72e66d781ed752e595c1e39624b88d4f53
.exe windows x86

0547628d2f08101a1faf09f5e41cd716

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
SetServiceStatus
DeregisterEventSource
RegNotifyChangeKeyValue
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegisterEventSourceA
ReportEventA
RegDeleteValueW
RegOpenCurrentUser
RegQueryInfoKeyA
RegEnumValueW
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
CloseServiceHandle
RegisterServiceCtrlHandlerA
RevertToSelf

kernel32

LocalAlloc
LocalFree
FormatMessageA
ReadFile
WriteFile
SetConsoleMode
GetConsoleMode
CreateFileA
ExpandEnvironmentStringsA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DelayLoadFailureHook
GetComputerNameExA
WriteProcessMemory
GetCurrentThreadId
IsBadWritePtr
IsBadCodePtr
ResetEvent
SwitchToThread
HeapCreate
HeapAlloc
CreateFileMappingA
MapViewOfFile
GetProcessHeap
HeapDestroy
HeapFree
UnmapViewOfFile
VirtualFree
GetSystemInfo
FormatMessageW
lstrcmpW
TerminateThread
CreateEventW
ResumeThread
SetEvent
lstrlenW
lstrcpyW
VirtualAlloc
CreateEventA
WaitForMultipleObjects
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetOverlappedResult
OpenProcess
GetCurrentProcess
DuplicateHandle
IsBadReadPtr
WaitForSingleObject
GetTickCount
InterlockedExchange
CreateThread
InterlockedExchangeAdd
GetCurrentThread
SetThreadPriority
GetCurrentProcessId
FreeLibraryAndExitThread
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
GetLastError
Sleep
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
LoadLibraryW
ExpandEnvironmentStringsW
InterlockedDecrement
GetEnvironmentVariableA
CloseHandle
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
PostQueuedCompletionStatus
CreateIoCompletionPort
InterlockedIncrement
SleepEx
OutputDebugStringA
EndUpdateResourceW
FindFirstFileExW
HeapSetInformation
GetLargestConsoleWindowSize
GetTempFileNameA
MoveFileW
WriteFileGather
LocalCompact
RtlFillMemory
InterlockedPopEntrySList
BuildCommDCBAndTimeoutsW
SetConsoleInputExeNameA
FindVolumeClose
RestoreLastError
ReleaseActCtx
AddAtomA
SetCurrentDirectoryW
GetUserGeoID
LockFileEx
GetSystemDirectoryA
SetSystemTime
GetStringTypeW
Module32FirstW
GetPrivateProfileStringW
CompareStringA
GetConsoleCursorInfo
SetConsoleMenuClose
SetTimerQueueTimer
GetNativeSystemInfo
GetFileType
GetConsoleInputExeNameA
GetLocaleInfoW
VerifyConsoleIoHandle
SetConsoleIcon
ExpungeConsoleCommandHistoryA
ChangeTimerQueueTimer
DeleteAtom
Process32NextW
ScrollConsoleScreenBufferA
FindFirstFileW
SetCalendarInfoW
GetFileAttributesA
BuildCommDCBA
HeapQueryInformation
PrivCopyFileExW
OpenMutexW
QueryActCtxW
GetWindowsDirectoryA
FatalAppExitW
GetConsoleCommandHistoryW
VirtualFreeEx
SetVolumeLabelA
FindClose
CompareFileTime
LocalFlags
MapUserPhysicalPages
RequestWakeupLatency
SetConsoleMaximumWindowSize
CreateDirectoryExA
GlobalAlloc
ExitThread
GlobalUnWire
GetUserDefaultLCID
GlobalFindAtomA
FatalExit
ScrollConsoleScreenBufferW
CreateDirectoryW
CreateJobObjectA
SetConsoleCursorInfo
DeleteFileA

msvcrt

wcscmp
wcscpy
strtoul
malloc
exit
getc
fopen
_initterm
free
strncmp
wcsncmp
wcsncpy
wcstol
_wcsnicmp
swprintf
strcpy
strlen
strpbrk
_strnicmp
wcschr
atoi
_stricmp
_wcsicmp
wcslen
wcscat
isspace
fgets
fclose
rewind
_errno
sprintf
_write
_iob
fprintf
isdigit
isxdigit
islower
memmove

ntdll

NtSetIoCompletion
NtRemoveIoCompletion
NtClose
NtSetInformationFile
NtCreateEvent
NtSetInformationObject
NtCreateIoCompletion
RtlFreeHeap
RtlRegisterSecureMemoryCacheCallback
RtlAllocateHeap
DbgPrint
NtOpenKey
RtlInitUnicodeString
RtlQueryRegistryValues
RtlGetNtProductType
NtDeviceIoControlFile
NtCreateFile
NtCancelIoFile
RtlInitializeCriticalSectionAndSpinCount
RtlDeleteCriticalSection
NtSetEvent
RtlRaiseStatus
NtWaitForSingleObject
NtDelayExecution
NtLoadDriver
RtlAdjustPrivilege
RtlImpersonateSelf
NtQuerySystemTime
NtAlertThread
NtQueueApcThread
NtClearEvent
NtReadFile
NtWaitForMultipleObjects
RtlNtStatusToDosError
NtQueryEvent
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeAnsiString
RtlDestroyHeap
RtlCreateHeap
RtlDeregisterWaitEx
RtlQueueWorkItem
RtlRegisterWait
NtCreateWaitablePort
NtRequestWaitReplyPort
NtConnectPort
NtReplyPort
RtlIpv6StringToAddressA
RtlIpv6StringToAddressW
RtlInitString
NtQueryValueKey
NtDuplicateObject
NtResetEvent
NtAcceptConnectPort
NtReplyWaitReceivePortEx
NtCompleteConnectPort

rpcrt4

UuidFromStringW
UuidCreate
UuidToStringW
RpcStringFreeW

ws2_32

WSAProviderConfigChange
WSARecv
WSCInstallProvider
WSCUpdateProvider
WSCDeinstallProvider
WSAEnumProtocolsW
WSAIoctl
WSCEnumProtocols
WSCGetProviderPath
WSASocketW

ws2help

WahEnumerateHandleContexts
WahRemoveHandleContext
WahReferenceContextByHandle
WahInsertHandleContext
WahDestroyHandleContextTable
WahCreateHandleContextTable

comctl32

InitCommonControls
CreatePropertySheetPageW
CreateStatusWindowW
MakeDragList
DrawStatusText
GetMUILanguage
ImageList_GetIcon
FlatSB_GetScrollInfo
ImageList_DrawEx
ImageList_Draw
ImageList_SetDragCursorImage

user32

CreateDialogParamA
GetClassWord
GetWindowModuleFileNameW
CountClipboardFormats
AttachThreadInput
CallMsgFilterA
GetPropA
SendDlgItemMessageW
IsClipboardFormatAvailable
PostThreadMessageW
SetClipboardData
CallMsgFilter
SetForegroundWindow
PostThreadMessageA
IsDialogMessageA
SetTaskmanWindow
CliImmSetHotKey
DdeInitializeA
GetWindowDC
GetKeyState
DefWindowProcA
UnregisterMessagePumpHook
GetMessageA
CharPrevA
FillRect
ShowWindowAsync
MapVirtualKeyExA
IsCharUpperW
GetWindowPlacement
ReleaseCapture
DdeUninitialize
SetWindowTextW
BroadcastSystemMessageExA
SetUserObjectInformationW
ResolveDesktopForWOW
GetDlgItemTextA
GetRawInputData
UnhookWindowsHook
MessageBoxIndirectA
DisplayExitWindowsWarnings
ShowStartGlass
SetDeskWallpaper
SendMessageCallbackW
ImpersonateDdeClientWindow
WINNLSEnableIME
KillTimer
TabbedTextOutA
GetKeyboardLayout
OpenWindowStationW
OemToCharW
GetWindowModuleFileName
UnloadKeyboardLayout
CharUpperBuffW
PrivateExtractIconExA
CascadeWindows
ShowScrollBar
DdeConnect
GetWindowContextHelpId
TileChildWindows
InflateRect
RemovePropA
GetRawInputBuffer
GetGuiResources
EnumPropsExW
GetWindowTextLengthA
LoadRemoteFonts

shlwapi

PathAppendA
PathCompactPathExA
StrCatBuffA
SHRegCreateUSKeyA
StrFormatByteSizeA
StrCmpNIW
SHSkipJunction
PathCombineW
PathFindOnPathA
PathRemoveBackslashA
SHRegQueryUSValueA
StrToIntExA
StrCSpnW
IntlStrEqWorkerA
PathIsRootA
StrRetToStrA
ColorAdjustLuma
UrlGetLocationW
SHRegEnumUSKeyW
SHRegOpenUSKeyA
StrCSpnA
SHRegDeleteEmptyUSKeyW
PathFindSuffixArrayW
AssocQueryKeyA
SHAutoComplete
PathRemoveArgsW
StrCatChainW
SHSetThreadRef
PathMakeSystemFolderW
StrRChrW
SHRegCreateUSKeyW
StrRetToBufA
SHLoadIndirectString

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.icode
Size: 4KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dat�
Size: 30KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0547628d2f08101a1faf09f5e41cd716

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

rpcrt4

ws2_32

ws2help

comctl32

user32

shlwapi

Sections

.text Size: 27KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 11KB

DATA Size: 7KB - Virtual size: 16KB

.icode Size: 4KB - Virtual size: 1.7MB

.dat� Size: 30KB - Virtual size: 137KB

.rsrc Size: 1024B - Virtual size: 736B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 11KB

DATA
Size: 7KB - Virtual size: 16KB

.icode
Size: 4KB - Virtual size: 1.7MB

.dat�
Size: 30KB - Virtual size: 137KB

.rsrc
Size: 1024B - Virtual size: 736B

.reloc
Size: 3KB - Virtual size: 2KB