c12dbff691705b45fa2eedec0914ee1ca9086aab8d11e1c966f570bb7f83eb68

Sharing

Copy URL

Twitter E-mail

General

Target

c12dbff691705b45fa2eedec0914ee1ca9086aab8d11e1c966f570bb7f83eb68
Size

209KB
MD5

0859244de85617e1fc6f3663280c0361
SHA1

90c50b3e721ca1bfbad474307bde80a0e2f116bd
SHA256

c12dbff691705b45fa2eedec0914ee1ca9086aab8d11e1c966f570bb7f83eb68
SHA512

cde960a9b0266767b3fc145cf097cf21acb91d54522a74722f9fcbf96cc36b40786e2d4edee885b360a06a9af3cbae2df6f05723d0b275cb9759721af1ade87d
SSDEEP

6144:pvzUqqDLqfi0jYWPo/Ig00bzjJqorWwUB1YOq7NB+4xi:ZlqnqK0jYW000jJqoy7W7L+4Q

Score

N/A

Malware Config

Signatures

Files

c12dbff691705b45fa2eedec0914ee1ca9086aab8d11e1c966f570bb7f83eb68
.exe windows x86

25ac86e782e6766301074fda78427619

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
CreateDirectoryW
LoadLibraryW
CreateFileW
WTSGetActiveConsoleSessionId
SetFileAttributesW
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
GetLogicalDriveStringsW
HeapFree
GetProcessHeap
SetFileTime
VirtualQueryEx
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
lstrcpynW
GetUserDefaultUILanguage
GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
GetProcessId
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
QueryDosDeviceW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
TlsGetValue
TlsSetValue
ResetEvent
CreateRemoteThread
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalLock
GlobalUnlock
MoveFileExW
GetCurrentThreadId
ExpandEnvironmentStringsW
WriteProcessMemory
GetCurrentProcessId
DuplicateHandle
GetFileAttributesExW
WaitForMultipleObjects
GetModuleFileNameW
VirtualFreeEx
SetThreadContext
GetThreadContext
TlsFree
TlsAlloc
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateMutexW
DeleteFileW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
TerminateProcess
OpenProcess
FlushFileBuffers
ReleaseMutex
GetModuleHandleW
GetComputerNameW
SetErrorMode
GetCommandLineW
ExitProcess
GetModuleHandleA
GetFileAttributesW
IsBadReadPtr
LocalFree
GetVersionExW
GetNativeSystemInfo
VirtualAlloc
VirtualFree
OpenEventW
CreateEventW
Sleep
GetTickCount
SetEvent
lstrcmpiW
LoadLibraryA
WaitForSingleObject
GetProcAddress
FreeLibrary
GetLocalTime
EnterCriticalSection
GetLastError
LeaveCriticalSection
InitializeCriticalSection
CreateThread
GetSystemTime
GetCurrentProcess
CloseHandle
CreatePipe
ExitThread
ReadFile
WriteFile
SetHandleInformation
CreateProcessW
lstrcmpiA
SetThreadPriority
GetCurrentThread
Thread32Next

user32

PeekMessageW
GetDCEx
PeekMessageA
ReleaseCapture
GetMessagePos
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
GetMenu
RegisterClassExW
GetClipboardData
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
IsWindow
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
SendMessageW
CallWindowProcA
EndMenu
SetCursorPos
TranslateMessage
GetCapture
GetUpdateRect
BeginPaint
GetKeyboardState
ToUnicode
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
CharToOemW
GetWindowRect
GetParent
GetWindowInfo
GetWindowLongW
GetClassLongW
GetAncestor
SetWindowPos
TrackPopupMenuEx
SendMessageTimeoutW
CallWindowProcW
DefWindowProcW
DefFrameProcW
MapWindowPoints
IsRectEmpty
EndPaint
GetMessageA
GetUpdateRgn
GetMessageW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
GetSystemMetrics
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
ExitWindowsEx
GetKeyboardLayoutList
CharLowerW
GetWindowDC
PostThreadMessageW
SetCapture
MessageBoxA
DrawIcon
GetIconInfo
GetCursorPos
GetDC
MapVirtualKeyW
PostMessageW
CharLowerBuffA
GetMenuItemRect

advapi32

RegCreateKeyW
RegEnumKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
ConvertSidToStringSidW
IsWellKnownSid
GetLengthSid
InitiateSystemShutdownExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
RegDeleteValueW
RegEnumValueW
CreateProcessAsUserA
CreateProcessAsUserW
EqualSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
RegOpenKeyExW
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
RegEnumKeyExW

shlwapi

PathSkipRootW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathQuoteSpacesW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrCmpNIW
PathUnquoteSpacesW
PathIsURLW
PathRemoveBackslashW
PathRenameExtensionW
PathRemoveFileSpecW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

GetDeviceCaps
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
GetDIBits
CreateDIBSection
RestoreDC
SaveDC
SetRectRgn
GdiFlush
SetViewportOrgEx
SelectObject

ws2_32

getsockname
select
getaddrinfo
recvfrom
getpeername
accept
WSAEventSelect
WSAGetLastError
send
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
sendto
recv
freeaddrinfo
closesocket
WSASend
inet_addr
listen
WSASetLastError
socket
bind
gethostbyname

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore

wininet

HttpOpenRequestA
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle
InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
HttpEndRequestW
HttpSendRequestA
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetCrackUrlA
HttpSendRequestExW
HttpQueryInfoA
InternetConnectA
InternetSetStatusCallbackA
HttpSendRequestExA

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

waveOutGetVolume
PlaySoundA
PlaySoundW
waveOutSetVolume

Sections

.text
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25ac86e782e6766301074fda78427619

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 196KB - Virtual size: 196KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 196KB - Virtual size: 196KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 8KB