286260d6f0d378a063bf74351f0c32cbc9868f7d5739556af57350f580731af9

Sharing

Copy URL Twitter E-mail

General

Target

286260d6f0d378a063bf74351f0c32cbc9868f7d5739556af57350f580731af9
Size

310KB
MD5

5fc64c9a41d69e5f53920345991b3b01
SHA1

aa98090f570fad655704ac5a7fa20054ded4e209
SHA256

286260d6f0d378a063bf74351f0c32cbc9868f7d5739556af57350f580731af9
SHA512

823a48337ec727bf41a5c76c760d10e98805a7afadda353a51d9a6bbc14c3c70c615e8787e897912655d2142ffa7223719c570ce59eadfa449e4ff53d14ea790
SSDEEP

6144:HA7evgUpZSUx1CMmEmjyBeODpVUu9xtPwOlapOFNVzCPtZrZ:g7evDSUpBeOnUu9bBNV2z

Score

N/A

Malware Config

Signatures

Files

286260d6f0d378a063bf74351f0c32cbc9868f7d5739556af57350f580731af9
.dll windows x86

3d06e6e165617ea1cbcd4af081dcb736

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
LocalFree
GetProcAddress
CopyFileW
LoadLibraryA
DeleteFileA
Sleep
DeleteFileW
VirtualAlloc
GetTempPathA
GetTempPathW
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetLastError
LockFile
LockFileEx
UnlockFile
GetFullPathNameA
GetFullPathNameW
GetSystemTime
GetCurrentThreadId
EnterCriticalSection
InitializeCriticalSection
InterlockedIncrement
LeaveCriticalSection
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
CreateFileA
CreateFileW
lstrcpyW
lstrlenW
GetFileAttributesW
GetFileAttributesExW
SystemTimeToFileTime
MultiByteToWideChar
GetFileSize
WideCharToMultiByte
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcessId

advapi32

AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
GetNamedSecurityInfoW

shell32

SHGetFolderLocation
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW

ole32

CoTaskMemFree

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z

msvcr80

?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
__CxxFrameHandler3
strlen
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memmove_s
free
malloc
atoi
memset
memcmp
sprintf
memcpy
??0exception@std@@QAE@ABQBD@Z
strcmp
isdigit
isspace
__iob_func
isalnum
strncpy
toupper
tolower
_gmtime64
_time64
strftime
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
strcpy
strstr
realloc

shlwapi

PathStripPathW
PathAppendW
PathRemoveBackslashW
PathFileExistsW

Exports

Exports

capsBackup
capsCloseSession
capsGetCollection
capsGetCollectionData
capsGetCollectionDataKeys
capsGetCollectionDataKeysAndValues
capsGetCollectionPayloads
capsGetCollections
capsGetInstallState
capsGetLastModTime
capsGetPayload
capsGetPayloadCollections
capsGetPayloadConstraint
capsGetPayloadData
capsGetPayloadDataKeys
capsGetPayloadDataKeysAndValues
capsGetPayloads
capsOpenSession
capsOpenSessionNoCreate
capsRemoveCollectionData
capsRemoveCollectionDomainData
capsRemovePayloadData
capsRemovePayloadDomainData
capsSessionCommit
capsSessionRollback
capsSetCollectionData
capsSetPayloadData
pcdCacheGetLastModTime
pcdCloseSession
pcdGetDomainData
pcdGetDomainDataKeys
pcdGetDomainDataSubdomains
pcdGetLastModTime
pcdOpenCacheSession
pcdOpenCacheSessionNoCreate
pcdOpenSession
pcdOpenSessionNoCreate
pcdRemoveDomainData
pcdSessionCommit
pcdSessionRollback
pcdSetDomainData

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d06e6e165617ea1cbcd4af081dcb736

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

msvcp80

msvcr80

shlwapi

Exports

Exports

Sections

.text Size: 151KB - Virtual size: 150KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 116KB - Virtual size: 116KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 151KB - Virtual size: 150KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 116KB - Virtual size: 116KB

.reloc
Size: 5KB - Virtual size: 4KB