4e52e0376878be250e97d7e4e135b7da6dd673b2d548e602e2d3272f3f035d8b

Sharing

Copy URL Twitter E-mail

General

Target

4e52e0376878be250e97d7e4e135b7da6dd673b2d548e602e2d3272f3f035d8b
Size

274KB
MD5

a37ee5ff60fa2a64854a9fe391c96010
SHA1

98692aa1f1eae7106d91c0efc1906481c5381f83
SHA256

4e52e0376878be250e97d7e4e135b7da6dd673b2d548e602e2d3272f3f035d8b
SHA512

bc2b9426386b96c4952c302b2668cdd68f7397857879eb9d3e0142b5824085d2b6d2337384229e24e457ffe714e487a33675963e323565ccaa0a21ad113cea57
SSDEEP

6144:eqEsnxk+vKwDq9GUf6+sm/ltOF4JlbDtQQoLQyR2BUru/s/:QsxnvrslFbrbBQ/8ygUruU/

Score

N/A

Malware Config

Signatures

Files

4e52e0376878be250e97d7e4e135b7da6dd673b2d548e602e2d3272f3f035d8b
.exe windows x86

c16c77f47d6ce7a7e9227285c2b9c340

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
GetProcAddress
FlushInstructionCache
FindResourceW
LeaveCriticalSection
GetModuleFileNameW
lstrlenA
GetProcessHeap
GetCurrentProcess
FreeLibrary
DeleteCriticalSection
InterlockedIncrement
lstrcmpiW
InterlockedDecrement
lstrcatW
lstrcpyW
lstrlenW
GetEnvironmentStringsA
HeapDestroy
LoadResource
VirtualFree
LoadLibraryA
MultiByteToWideChar
SetLastError
GetSystemInfo
SetUnhandledExceptionFilter
GetCurrentProcessId
lstrcpynW
GetTickCount
GetSystemTimeAsFileTime
SizeofResource
FormatMessageW
LocalFree
GetLastError
HeapFree
QueryPerformanceCounter
EnterCriticalSection
GetUserDefaultLCID
HeapAlloc

untfs

FormatEx
Chkdsk
Extend
ChkdskEx
Recover
Format

rpcrt4

NdrCStdStubBuffer_Release
NdrDllGetClassObject
CStdStubBuffer_AddRef
IUnknown_AddRef_Proxy
NdrOleFree
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Invoke
NdrOleAllocate
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Disconnect
CStdStubBuffer_CountRefs
CStdStubBuffer_QueryInterface
NdrDllRegisterProxy
NdrDllCanUnloadNow
IUnknown_Release_Proxy

user32

SetDlgItemTextW
MapWindowPoints
CharNextW
LoadImageW
CreateDialogParamW
SetWindowTextW
SetFocus
EndDialog
SendMessageW
SystemParametersInfoW
SetWindowPos
ShowWindow
GetDlgItem
GetDialogBaseUnits
DialogBoxParamW
GetWindow
EnableWindow
CopyRect
SendDlgItemMessageW
DestroyWindow
GetWindowRect
GetSystemMetrics
GetDlgItemTextW
GetWindowLongW
MessageBoxW
LoadStringW
GetClientRect
GetParent
DrawTextW
SetWindowLongW

advapi32

RegSetValueExW
RegisterTraceGuidsW
RegDeleteValueW
UnregisterTraceGuids
GetTraceLoggerHandle
RegDeleteKeyW
TraceMessage
GetTraceEnableLevel
RegEnumKeyExW
RegQueryInfoKeyW
GetTraceEnableFlags
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

netshell

HrGetIconFromMediaType

msvcrt

wcscat
??3@YAXPAX@Z
_adjust_fdiv
malloc
??2@YAPAXI@Z
wcslen
swprintf
wcsncpy
_except_handler3
__CxxFrameHandler
?terminate@@YAXXZ
realloc
_initterm
??1type_info@@UAE@XZ
free
wcscmp

ole32

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc

shell32

ShellExecuteW
SHGetFolderPathW

gdi32

SetBkMode

Sections

text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 650B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c16c77f47d6ce7a7e9227285c2b9c340

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

untfs

rpcrt4

user32

advapi32

netshell

msvcrt

ole32

shell32

gdi32

Sections

text Size: 86KB - Virtual size: 86KB

.rdata Size: 184KB - Virtual size: 184KB

.rsrc Size: 1024B - Virtual size: 650B

text
Size: 86KB - Virtual size: 86KB

.rdata
Size: 184KB - Virtual size: 184KB

.rsrc
Size: 1024B - Virtual size: 650B