72a9925e57690e5d55db9ffd3529fca5

Sharing

Copy URL Twitter E-mail

General

Target

72a9925e57690e5d55db9ffd3529fca5
Size

64KB
MD5

9479ca2f842adbc948bf31979f8c3a74
SHA1

e9e56cfe52f4b2f0ac19e107dfc01d12c22c64df
SHA256

f53622c5c1f5445a7c16ffcccf7c39c87cd88d600ef1c9e8c47dcd84756ed957
SHA512

22fac80a2fa79d635e04da654df9f5c34fa7e41958c6e5c6b58aaa49d9ef8640010736e774c71c9af06aedfbb170c1d04daa7c76c44eed0cc91a1592e8b69c1d
SSDEEP

1536:xOx4nmrImfCe5H3JE/juUY5DFXH41iXM10qP50:xBnmcmvxZErU5DFPa0qW

Score

N/A

Malware Config

Signatures

Files

72a9925e57690e5d55db9ffd3529fca5
.zip

Password: infected
a404945e9aeef9430f2e2e6b5159ce734797a24f136ab43d5431fc3c57890d2a
.exe windows x86

Password: infected

979ee97e2a69ca8f0677eac5b302c407

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_invoke_watson
_lock
_controlfp_s
_strnicmp
_onexit
_decode_pointer
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_stricmp
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
calloc
_beginthreadex
realloc
strncat
_errno
strncmp
atoi
??_U@YAPAXI@Z
strncpy
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
strrchr
free
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
malloc
strchr
memmove
ceil
strstr
memcpy
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
??2@YAPAXI@Z
memset

shlwapi

SHDeleteKeyA

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
LoadLibraryA
WaitForSingleObject
SetEvent
GetProcAddress
CreateEventA
CloseHandle
TerminateThread
ResumeThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
CancelIo
lstrcpyA
ResetEvent
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
GetLastError
CreateDirectoryA
GetFileAttributesA
CreateProcessA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
DeleteFileA
GetFileSize
CreateFileA
WriteFile
ReadFile
GetModuleFileNameA
SetLastError
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
SetFileAttributesA
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
GlobalFree
GlobalAlloc
DisconnectNamedPipe
WaitForMultipleObjects
GetStartupInfoA
GetSystemInfo
OpenEventA
SetErrorMode
Process32Next
lstrcmpiA
GetCurrentThreadId
InterlockedCompareExchange
TerminateProcess

user32

SetProcessWindowStation
SetRect
GetDesktopWindow
GetDC
ReleaseDC
GetCursorInfo
SystemParametersInfoA
GetSystemMetrics
GetClipboardData
OpenClipboard
OpenWindowStationA
SetClipboardData
SetCursorPos
WindowFromPoint
MapVirtualKeyA
keybd_event
DestroyCursor
LoadCursorA
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
GetProcessWindowStation
ExitWindowsEx
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
SetThreadDesktop
PostMessageA
CloseWindow
SendMessageA
IsWindow
CreateWindowExA
EmptyClipboard
SetCapture
GetMessageA
wsprintfA
CharNextA

gdi32

DeleteDC
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject

advapi32

LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
LookupAccountSidA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
RegCloseKey
RegQueryValueA
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

winmm

waveInAddBuffer
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveOutGetNumDevs
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveOutOpen
waveOutPrepareHeader
waveInClose
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveInStart

ws2_32

WSACleanup
gethostname
listen
accept
getpeername
__WSAFDIsSet
recvfrom
sendto
bind
getsockname
ntohs
inet_addr
inet_ntoa
socket
gethostbyname
htons
connect
select
recv
send
setsockopt
closesocket
WSAStartup

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA

msvfw32

ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICSeqCompressFrame
ICClose
ICCompressorFree
ICSeqCompressFrameEnd

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

VV
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DDdan
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GGVB
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TTR
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

979ee97e2a69ca8f0677eac5b302c407

Headers

File Characteristics

Imports

msvcr80

shlwapi

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

msvcp80

wininet

msvfw32

psapi

wtsapi32

Sections

.text Size: 88KB - Virtual size: 84KB

VV Size: 4KB - Virtual size: 3KB

DDdan Size: 8KB - Virtual size: 4KB

GGVB Size: 8KB - Virtual size: 6KB

TTR Size: 4KB - Virtual size: 1KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 428B

.text
Size: 88KB - Virtual size: 84KB

VV
Size: 4KB - Virtual size: 3KB

DDdan
Size: 8KB - Virtual size: 4KB

GGVB
Size: 8KB - Virtual size: 6KB

TTR
Size: 4KB - Virtual size: 1KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 428B