91e94ab4a05ec57c5a696235eb2f3984c04b4a39751452cf438f9dc905efefff

Sharing

Copy URL Twitter E-mail

General

Target

91e94ab4a05ec57c5a696235eb2f3984c04b4a39751452cf438f9dc905efefff
Size

1.1MB
MD5

0b15a26be5629b97e6e361e51de673f0
SHA1

a14e144cd5e83cc169d4bf0cad9b01f8086e0aaa
SHA256

91e94ab4a05ec57c5a696235eb2f3984c04b4a39751452cf438f9dc905efefff
SHA512

c20c1f5736595d1f8fa4be742cde91c6a00054c750b2a5990d410b2368115dc454fdb7cb8fd1679812609681cd471e61949eaf5618329be4d8f19481a1908ab3
SSDEEP

24576:Hy8uKeDT2e2vgR0qyksggi/ROvGxzQ4xlommo:HKKeD6nvVCsdi/ROUzQ4ommo

Score

N/A

Malware Config

Signatures

Files

91e94ab4a05ec57c5a696235eb2f3984c04b4a39751452cf438f9dc905efefff
.exe windows x86

e140c47a469520895ed928e8c0621582

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetModuleFileNameExW

kernel32

DeleteCriticalSection
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
IsWow64Process
MoveFileExW
WaitForSingleObject
SetEvent
OutputDebugStringW
TerminateThread
Sleep
GetModuleFileNameW
ExitThread
SetThreadPriority
InterlockedExchange
ResetEvent
GetLocalTime
CreateEventW
WaitForMultipleObjects
CreateThread
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
CreateMutexW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
LoadLibraryW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
GetProcAddress
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
InitializeCriticalSection
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
SetWaitableTimer
CancelWaitableTimer
OpenProcess
CopyFileW
EncodePointer
Process32NextW
CreateWaitableTimerW
CreateToolhelp32Snapshot
lstrlenA
GetModuleHandleW
FileTimeToSystemTime
GetPrivateProfileStringW
WritePrivateProfileStringW
FindNextFileW
RemoveDirectoryW
Process32FirstW
GlobalMemoryStatusEx
GetCommandLineW
HeapSetInformation
GetStartupInfoW
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
RaiseException
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetVersionExW
GetSystemDirectoryW
GetEnvironmentVariableW
SetLastError
lstrlenW
FormatMessageW
GetComputerNameW
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
LocalFree
DeleteFileW
CloseHandle
DuplicateHandle
GetFileType
FindClose
MoveFileW
GetLastError
FlushFileBuffers
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
LockFile
UnlockFile
CreateDirectoryW
GetCurrentProcess
SetEndOfFile
SetFilePointer
FindFirstFileW
GetFileSize
DecodePointer
CreateFileMappingA
TerminateProcess
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetTimeZoneInformation
GetLocaleInfoW
GetStdHandle
ExitProcess
TlsFree
TlsSetValue
GetCPInfo
RtlUnwind
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
IsProcessorFeaturePresent
IsDebuggerPresent

user32

wsprintfW
DefWindowProcW
LoadStringW
EndDialog
RegisterClassExW
LoadAcceleratorsW
BeginPaint
LoadCursorW
DialogBoxParamW
PostQuitMessage
DestroyWindow
EndPaint
GetSystemMetrics
LoadIconW

advapi32

StartServiceW
OpenServiceW
GetUserNameW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegEnumValueW
RegQueryValueW
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyW
IsValidSid
LookupAccountNameW
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathW

ole32

CoInitializeSecurity
CoInitializeEx
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

wininet

InternetWriteFile
InternetCloseHandle
HttpEndRequestW
InternetGetLastResponseInfoW
HttpOpenRequestW
InternetOpenW
HttpSendRequestExW
InternetQueryDataAvailable
InternetReadFile
InternetConnectW
HttpSendRequestW
InternetSetOptionW
HttpAddRequestHeadersW
HttpQueryInfoW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 851KB - Virtual size: 850KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e140c47a469520895ed928e8c0621582

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

version

Sections

.text Size: 851KB - Virtual size: 850KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 16KB - Virtual size: 27KB

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 40KB - Virtual size: 40KB

.rmnet Size: 11KB - Virtual size: 12KB

.text
Size: 851KB - Virtual size: 850KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 16KB - Virtual size: 27KB

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 40KB - Virtual size: 40KB

.rmnet
Size: 11KB - Virtual size: 12KB