35f0be6505f58c7720a6defd2e873d45334b64ce098b15bc4d66e76918875cbb

Sharing

Copy URL Twitter E-mail

General

Target

35f0be6505f58c7720a6defd2e873d45334b64ce098b15bc4d66e76918875cbb
Size

734KB
MD5

d9b9fdd2970e7831acca1944aebcc87a
SHA1

6783a19af590ccf32a5b8bbb79a3a29dfb77be15
SHA256

35f0be6505f58c7720a6defd2e873d45334b64ce098b15bc4d66e76918875cbb
SHA512

e2e44d77366888992452bd5252ee039ca9ef7b12137c61815f79e27906c5633638b023544076df5ee38a06c4646d2be71a00cc2e03b34993f2ceb7a9de2d34c4
SSDEEP

12288:YpzMysLA6C747zsPJT14P5QnJe6BKRcVowpiHOizwFMqPks4+5p8GpKeVrwulSbW:dLhTiB14P5QnJenRcuwMHJz6Mzsd5KGz

Score

N/A

Malware Config

Signatures

Files

35f0be6505f58c7720a6defd2e873d45334b64ce098b15bc4d66e76918875cbb
.exe windows x86

4237c14906c9d06eb0369ec5833058b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

CreateFileW
SetEnvironmentVariableA
CompareStringW
SetStdHandle
SetFilePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
MultiByteToWideChar
LCMapStringW
RtlUnwind
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
HeapFree
HeapQueryInformation
HeapSize
HeapReAlloc
GetTimeZoneInformation
RaiseException
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteFileA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
EncodePointer
SuspendThread
LocalFree
CloseHandle
FindFirstChangeNotificationA
GetModuleHandleA
GetSystemInfo
GlobalMemoryStatusEx
LockResource
LocalAlloc
GetConsoleScreenBufferInfo
LoadLibraryA
GetTempFileNameA
SetFileAttributesA
GetProcAddress
GetLastError
GetStdHandle
lstrcatA
SizeofResource
Sleep
LoadLibraryW
ExitProcess
FindResourceExA
OpenProcess
FormatMessageA
ExpandEnvironmentStringsA
GetComputerNameW
FindCloseChangeNotification
WaitForSingleObject
GetCurrentProcess
HeapAlloc
LoadResource
lstrlenA
CreateFileA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsBadReadPtr
HeapValidate
IsProcessorFeaturePresent
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetModuleHandleW
DecodePointer
InterlockedDecrement
InterlockedIncrement
DeleteFileW
FillConsoleOutputCharacterA
GetExitCodeProcess

user32

SendMessageA
MoveWindow
GetWindow
CheckMenuItem
RegisterHotKey
EnumDisplayDevicesA
DialogBoxParamA
GetDlgItemTextA
LoadCursorA
SetClipboardData
LoadImageA
EndPaint
ClientToScreen
DestroyWindow
GetMessageA
CloseClipboard
GetSystemMenu
SetTimer
GetWindowRect
InsertMenuItemA
RegisterClassExA
PostQuitMessage
GetWindowDC
GetMenuItemID
KillTimer
DrawTextA
GetSubMenu
SetWindowTextA
IsClipboardFormatAvailable
GetParent
LoadIconA
wsprintfA
GetClientRect
LoadStringA
BeginPaint
GetClassInfoW
GetDC
TranslateMessage
GetMenu
MessageBoxA
InvalidateRect
GetWindowLongA
CreateWindowExA
EmptyClipboard
GetDlgItem
EndDialog
DefWindowProcA
SendDlgItemMessageW
GetMenuItemInfoA
LoadAcceleratorsA
IsDlgButtonChecked
IsWindow
DispatchMessageA
CheckRadioButton
MessageBoxW
RegisterClassW

gdi32

BitBlt
SetTextColor
DeleteDC
GetDeviceCaps
CreateFontIndirectA
CreateDCA
CreateDCW
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
EnumFontFamiliesA
CreateRectRgn
GetFontData
GetObjectA
GetStockObject
GetTextColor

comdlg32

GetFileTitleA
FindTextW
ChooseFontA
FindTextA
ReplaceTextA

advapi32

CryptEnumProviderTypesA
ReadEventLogA
CredEnumerateA
GetOldestEventLogRecord
OpenEventLogW

shell32

SHGetFolderPathA
SHGetFolderPathW
DragQueryFileA
DragFinish

psapi

GetModuleFileNameExA
EnumProcessModules
GetModuleBaseNameA
GetProcessMemoryInfo

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

shlwapi

PathAppendA
StrStrW

comctl32

ord17

uxtheme

DrawThemeBackground

msi

ord64
ord121
ord124
ord17
ord103
ord8

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tada
Size: 391KB - Virtual size: 390KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hot
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4237c14906c9d06eb0369ec5833058b9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

psapi

version

shlwapi

comctl32

uxtheme

msi

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 5KB - Virtual size: 13KB

.tada Size: 391KB - Virtual size: 390KB

.hot Size: 8KB - Virtual size: 8KB

.rsrc Size: 108KB - Virtual size: 107KB

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 5KB - Virtual size: 13KB

.tada
Size: 391KB - Virtual size: 390KB

.hot
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 108KB - Virtual size: 107KB