7b5a859930498bad7ae5cf2c3b3cb04835ebdd1df6682739718302d119042e24

Sharing

Copy URL Twitter E-mail

General

Target

7b5a859930498bad7ae5cf2c3b3cb04835ebdd1df6682739718302d119042e24
Size

108KB
MD5

59c9429d8589b43d4d3db4ceb3f63064
SHA1

80596e3edd675ae140feba20821551a9b5701a38
SHA256

7b5a859930498bad7ae5cf2c3b3cb04835ebdd1df6682739718302d119042e24
SHA512

0a4507988624d4b637df68e96bb046084a41b3e2c846b947121062b6b953da3853fdb6bd923924e28377430f8d69f9fa47e9e2b2bc65543bec43f95d504ec06d
SSDEEP

1536:a/FSkHtbMvJGZ0Qi+oFqvEdnq1hd+z4LX3gbrgDuK6jMZJZxtdIGaWxS04fq3:WnMhGioCnAhi2X3SAxwWJztdIbwS7f

Score

N/A

Malware Config

Signatures

Files

7b5a859930498bad7ae5cf2c3b3cb04835ebdd1df6682739718302d119042e24
.exe windows x86

fc85b5efdeff38ec5026a79c87d1d1fe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
TraceEvent
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegGetValueW
RegCreateKeyExW
RegSetValueExW

kernel32

RtlCaptureStackBackTrace
IsDebuggerPresent
DebugBreak
HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap
TerminateProcess
TerminateThread
GetCurrentThread
GetModuleHandleW
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
GetStartupInfoA
InterlockedCompareExchange
FreeLibrary
Sleep
GetUserDefaultLangID
FormatMessageW
GetExitCodeThread
ProcessIdToSessionId
WaitForSingleObject
RegisterWaitForSingleObject
GetThreadId
GetCurrentProcessId
GetCurrentProcess
SetProcessWorkingSetSize
GetSystemInfo
GetTickCount
GetProcAddress
LoadLibraryW
SetLastError
ExitProcess
SetErrorMode
GetCurrentThreadId
QueryFullProcessImageNameW
SetProcessShutdownParameters
SetUnhandledExceptionFilter
HeapSetInformation
WerSetFlags
DeleteCriticalSection
GetTickCount64
GetLastError
InitializeCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
ResumeThread
DuplicateHandle
LocalAlloc
LocalReAlloc
WaitForMultipleObjectsEx
LocalFree
lstrcmpiW
IsWow64Process
SetThreadPriority
CreateEventW
SignalObjectAndWait
CloseHandle
CreateThread
OpenProcess
ReleaseMutex
CreateMutexW
SetEvent
OpenEventW
UnhandledExceptionFilter
DelayLoadFailureHook
EnterCriticalSection
InterlockedExchange

gdi32

CreateRectRgn
CombineRgn
GetRandomRgn
CreateCompatibleDC
SelectClipRgn
SelectObject
DeleteObject
GdiAlphaBlend
GetStockObject
GetRgnBox
OffsetRgn
BitBlt
DeleteDC
GetDIBits
CreateDIBSection
CreateCompatibleBitmap
GetDeviceCaps

user32

CheckDesktopByThreadId
GetDC
ReleaseDC
EnumDisplayDevicesW
UnregisterSessionPort
RegisterSessionPort
EnumDisplaySettingsW
DwmStopRedirection
RegisterErrorReportingDialog
InternalGetWindowIcon
HungWindowFromGhostWindow
RegisterGhostWindow
GhostWindowFromHungWindow
RegisterFrostWindow
OpenThreadDesktop
EnumWindows
GetCaretBlinkTime
FlashWindowEx
DwmStartRedirection
MsgWaitForMultipleObjectsEx
EndTask
SystemParametersInfoW
SetForegroundWindow
IsHungAppWindow
MessageBeep
IsWindow
IsWindowEnabled
AdjustWindowRectEx
GetPropW
GetMonitorInfoW
SetClassLongW
GetClassNameW
MonitorFromWindow
IsDialogMessageW
GetAncestor
SetThreadDesktop
OpenDesktopW
InternalGetWindowText
PostThreadMessageW
GetWindowTextW
IsWindowVisible
GetWindowInfo
GetUpdateRgn
SetTimer
SendMessageW
LogicalToPhysicalPoint
GetDCEx
UpdateWindow
GetClientRect
SetWindowTextW
SetWindowLongW
DestroyIcon
GetWindowRect
GetGuiResources
SetWindowPos
LoadStringW
LoadIconW
RegisterWindowMessageW
RegisterPowerSettingNotification
PostQuitMessage
DestroyWindow
UnregisterPowerSettingNotification
DispatchMessageW
TranslateMessage
DefWindowProcW
PeekMessageW
CreateWindowExW
RegisterClassExW
SetProcessDPIAware
GetSystemMetrics
PostMessageW
GetThreadDesktop
GetUserObjectInformationW
ChangeWindowMessageFilter
CloseDesktop
ClientToScreen
GetWindowLongW
GetTitleBarInfo
EndPaint
IsZoomed
CreateDialogParamW
InvalidateRect
KillTimer
OffsetRect
GetWindow
GetSysColorBrush
GetWindowThreadProcessId
ShowWindow
FillRect
IsIconic
BeginPaint

msvcrt

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
memset
srand
rand
_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_purecall
_vsnwprintf
_wcsicmp
memmove
wcsrchr
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
memcpy

ntdll

RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
RtlInitializeGenericTable
DbgPrompt
DbgBreakPoint
NtQuerySystemInformation
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtRequestPort
NtConnectPort
NtRequestWaitReplyPort
WinSqmIsOptedIn
RtlUpcaseUnicodeChar
NtClose
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
RtlAllocateAndInitializeSid
WinSqmEventWrite
WinSqmEventEnabled
NtQueryInformationProcess
DbgPrintEx
WinSqmAddToStream
NtReplyPort
NtCreateWaitablePort
RtlInitUnicodeString
RtlInsertElementGenericTable
RtlNumberGenericTableElements
RtlIsGenericTableEmpty
RtlLookupElementGenericTable

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString

uxtheme

CloseThemeData
OpenThemeData

imm32

ImmDisableIME

dwmredir

DwmRedirectionManagerFailMessage
DwmRedirectionManagerDispatchMessage
DwmRedirectionManagerShutdown
DwmRedirectionManagerInitialize
DwmRedirectionManagerPlayingVideo
DwmInitializeTransport
DwmRedirectionManagerLockMemoryAllocations
DwmVersionCheck
DwmRedirectionManagerWaitForMultipleObjects
DwmShutdownTransport
DwmRedirectionManagerEnableMMCSS

slwga

SLIsGenuineLocal

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mcchygn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fc85b5efdeff38ec5026a79c87d1d1fe

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

ole32

oleaut32

uxtheme

imm32

dwmredir

slwga

Sections

.text Size: 70KB - Virtual size: 70KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 30KB - Virtual size: 31KB

mcchygn Size: - Virtual size: 4KB

.text
Size: 70KB - Virtual size: 70KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 30KB - Virtual size: 31KB

mcchygn
Size: - Virtual size: 4KB