5bece4cfeaecc51964e12b60247d60996f7429ca28d3f858a60b549a34d3ae99

Sharing

Copy URL Twitter E-mail

General

Target

5bece4cfeaecc51964e12b60247d60996f7429ca28d3f858a60b549a34d3ae99
Size

252KB
MD5

53ed6028d8145095723f33d2efd79294
SHA1

d3ec5027cb1eb2ac78b53af1defa204f6b8710e1
SHA256

5bece4cfeaecc51964e12b60247d60996f7429ca28d3f858a60b549a34d3ae99
SHA512

e73ab3199ddecf69b09b7990428a3f4833b76ceeb4cc5c193841cbe0b5b1e1ceba2ed8685e7667167caee8c3439765241c0f3e1c15bf894e974158e668706ac5
SSDEEP

6144:i+cNKFqWe+wubqp81e8toF/Ae/8aBJF7ONYQi:i+cNfWeYbqpKtbOFBQi

Score

N/A

Malware Config

Signatures

Files

5bece4cfeaecc51964e12b60247d60996f7429ca28d3f858a60b549a34d3ae99
.dll windows x86

0b99e37005edf5b3e879de230903e9ba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetOpenW
InternetOpenUrlW

ws2_32

WSAStartup
WSACleanup

kernel32

lstrcatW
MoveFileW
WideCharToMultiByte
ReadFile
GetFileSize
SetFilePointer
CreateFileW
CreateThread
GetTickCount
SystemTimeToFileTime
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetModuleFileNameW
LocalFree
CreateEventW
SetEvent
Sleep
LeaveCriticalSection
EnterCriticalSection
ResetEvent
OpenEventW
UnmapViewOfFile
RaiseException
MapViewOfFile
CreateFileMappingW
lstrcpynA
lstrlenA
MultiByteToWideChar
SetWaitableTimer
CancelWaitableTimer
GetLastError
CreateWaitableTimerW
OpenWaitableTimerW
lstrcpynW
OpenMutexW
GetVolumeInformationW
ExitProcess
FreeLibraryAndExitThread
TerminateThread
GetVersionExW
GetCurrentThread
lstrcatA
GetSystemTimeAsFileTime
lstrcmpiW
lstrcmpW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OutputDebugStringW
CreateProcessW
OutputDebugStringA
InitializeCriticalSection
DeleteCriticalSection
SetEndOfFile
WriteFile
VirtualProtect
SetLastError
lstrcmpiA
lstrcpyA
GetSystemWindowsDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetSystemTime
GetCurrentProcessId
WaitForMultipleObjects
FlushFileBuffers
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
VirtualQuery
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
GetOEMCP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TlsFree
IsValidCodePage
TlsSetValue
TlsAlloc
TlsGetValue
GetLocalTime
lstrcpyW
lstrlenW
ReleaseMutex
CloseHandle
CreateMutexW
WaitForSingleObject
GetModuleHandleA
GetCurrentProcess
SetErrorMode
GetFileAttributesW
LoadLibraryA
GetProcAddress
FreeLibrary
GetLongPathNameA
OpenThread
ResumeThread
SuspendThread
Thread32First
Thread32Next
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetSystemInfo
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
HeapAlloc
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetConsoleCP
GetConsoleMode

user32

UnregisterClassA
AllowSetForegroundWindow
LockSetForegroundWindow
SetWindowsHookExW
PostMessageW
MsgWaitForMultipleObjects
CallNextHookEx
UnhookWindowsHookEx
BroadcastSystemMessageW
SetForegroundWindow
SetWindowTextW
EnumChildWindows
FindWindowExW
SendMessageW
UpdateWindow
IsCharAlphaNumericW
IsCharAlphaW
MsgWaitForMultipleObjectsEx
PeekMessageW
TranslateMessage
DispatchMessageW
wsprintfW

advapi32

RegDeleteValueW
SetNamedSecurityInfoW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegFlushKey
RegNotifyChangeKeyValue
OpenProcessToken
DuplicateTokenEx
GetLengthSid
SetTokenInformation
SetThreadToken
ImpersonateSelf
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
ord680
SHCreateDirectoryExW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
OleRun
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CoGetInterfaceAndReleaseStream

oleaut32

SysStringLen
DispCallFunc
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit
GetErrorInfo
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringLen
VariantCopy
SysStringByteLen
VariantClear

shlwapi

StrCmpNW
UrlUnescapeW
UrlEscapeW
StrStrIA
StrRStrIW
StrStrIW

ntdll

RtlZeroMemory
RtlUnwind

Exports

Exports

Startup
d
e
l
r

Sections

.text
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b99e37005edf5b3e879de230903e9ba

Headers

File Characteristics

Imports

wininet

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 169KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 12KB - Virtual size: 36KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 172KB - Virtual size: 169KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 12KB - Virtual size: 36KB

.reloc
Size: 16KB - Virtual size: 15KB