25e35cb5326078bd7e4b3c116c6312791afe2e0b0d22f556faadf5fc77c47d94

Sharing

Copy URL Twitter E-mail

General

Target

25e35cb5326078bd7e4b3c116c6312791afe2e0b0d22f556faadf5fc77c47d94
Size

669KB
MD5

4f1160f6e5f1ef1f53a5cf4358517e1e
SHA1

5007a9398278d8294bf34527e09759c9c0e1c26f
SHA256

25e35cb5326078bd7e4b3c116c6312791afe2e0b0d22f556faadf5fc77c47d94
SHA512

9b3ff74680bee4f089364a0c296e7431ae0839cbf70c18d4481f94f01008e16305ee1bb71ced69b14cbc82eab118673b20de8b8f9de992a9b34f999ccedb1fb3
SSDEEP

12288:0C5vZoiPcbBpsUbINPWqSnqTl5T8iGBw:0YBoiEbYU89+qh5wi

Score

N/A

Malware Config

Signatures

Files

25e35cb5326078bd7e4b3c116c6312791afe2e0b0d22f556faadf5fc77c47d94
.exe windows x86

b1175d351785d74c698b5380f8ae156e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

setupapi

SetupDiSetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

wtsapi32

WTSEnumerateSessionsW
WTSEnumerateProcessesW
WTSFreeMemory

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

pccs_dbengine

sqlite3_column_name
sqlite3_column_table_name
sqlite3_column_database_name
sqlite3_column_count
sqlite3_finalize
sqlite3_column_text
sqlite3_column_text16
sqlite3_bind_text16
sqlite3_prepare
sqlite3_bind_int64
sqlite3_bind_blob
sqlite3_exec
sqlite3_close
sqlite3_errcode
sqlite3_table_column_metadata
sqlite3_db_handle
sqlite3_column_type
sqlite3_step
sqlite3_reset
sqlite3_prepare16
sqlite3_column_int64
sqlite3_column_double
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_open16
sqlite3_trace
sqlite3_progress_handler
sqlite3_update_hook
sqlite3_bind_int

kernel32

VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesW
IsBadCodePtr
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateFileW
GetProcessHeap
HeapAlloc
ReadFile
HeapFree
WriteFile
HeapSize
HeapValidate
SetFilePointer
SetEndOfFile
GetFileSize
DeleteFileW
GetLastError
MultiByteToWideChar
CloseHandle
LoadLibraryW
FindResourceW
LoadResource
LockResource
CreateProcessW
lstrlenW
SizeofResource
WaitForMultipleObjects
FreeLibrary
WaitForSingleObject
GetExitCodeProcess
CreateMutexW
ReleaseMutex
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
GetProcAddress
Process32NextW
GetModuleHandleA
GetCurrentProcess
GetVersionExW
GetSystemDirectoryW
GetModuleFileNameW
CreateDirectoryW
GetCurrentThreadId
ConnectNamedPipe
RaiseException
ResetEvent
GetStartupInfoW
lstrcmpiW
ExitThread
CreateEventW
CreateThread
CreateNamedPipeW
SetEvent
GetModuleHandleW
InterlockedIncrement
DisconnectNamedPipe
SetThreadPriority
TerminateThread
InterlockedDecrement
CancelIo
PeekNamedPipe
TerminateProcess
GetOverlappedResult
LoadLibraryExW
GetCommandLineW
GetCurrentThread
LocalFree
SetUnhandledExceptionFilter
SetErrorMode
lstrcpyW
WideCharToMultiByte
OpenEventW
GetCommState
SetCommState
SetCommMask
PurgeComm
HeapReAlloc
FindFirstFileW
FindClose
GetSystemTimeAsFileTime
LoadLibraryA
CreateEventA
OpenEventA
MoveFileW
IsDebuggerPresent
UnhandledExceptionFilter
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetCurrentProcessId
InterlockedExchange
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
GetFullPathNameW
GetCurrentDirectoryA
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
FlushFileBuffers
CreateFileA
CompareStringA
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
CompareStringW
SetEnvironmentVariableA
GetTickCount
SetStdHandle
WriteConsoleA

user32

GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PeekMessageW
CharNextW
CharUpperBuffW
wsprintfW
DispatchMessageW
CharUpperW
LoadStringW
DefWindowProcW
RegisterClassW
CreateWindowExW
PostMessageW
DestroyWindow
UnregisterClassW
MessageBoxExW
UnregisterClassA
PostThreadMessageW
MessageBoxW

advapi32

CreateProcessAsUserW
RegOpenKeyExA
RegQueryValueExA
GetLengthSid
CopySid
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
CloseServiceHandle
CreateServiceW
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
DeleteService
SetServiceStatus
ControlService
DeregisterEventSource
GetTokenInformation
OpenServiceW
ReportEventW
RegisterEventSourceW
IsValidSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
RegQueryValueExW
GetUserNameW
RegQueryInfoKeyW
RevertToSelf
RegEnumKeyW
ImpersonateLoggedOnUser
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
CoCreateGuid
StringFromCLSID
CoCreateInstance
CoTaskMemAlloc
CoResumeClassObjects
CoRevokeClassObject
CoInitializeSecurity
CoInitializeEx
CoSuspendClassObjects
StringFromGUID2
CoRegisterClassObject
CoUninitialize
CoTaskMemFree

oleaut32

SafeArrayPutElement
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
VariantInit
SafeArrayRedim
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayDestroy
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysFreeString
SysStringLen
VarBstrCmp
SysAllocString
SysStringByteLen
SysAllocStringLen
VarBstrCat

shlwapi

PathAppendW

Sections

.text
Size: 426KB - Virtual size: 426KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 73KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b1175d351785d74c698b5380f8ae156e

Headers

File Characteristics

Imports

userenv

setupapi

wtsapi32

version

pccs_dbengine

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 426KB - Virtual size: 426KB

.rdata Size: 150KB - Virtual size: 150KB

.data Size: 18KB - Virtual size: 26KB

.rsrc Size: 73KB - Virtual size: 76KB

.text
Size: 426KB - Virtual size: 426KB

.rdata
Size: 150KB - Virtual size: 150KB

.data
Size: 18KB - Virtual size: 26KB

.rsrc
Size: 73KB - Virtual size: 76KB