f20133cceeb23acc2ff42bc3b1aaf1dc9e55c41ff2a56ba32309ac1971d8ab35

Sharing

Copy URL Twitter E-mail

General

Target

f20133cceeb23acc2ff42bc3b1aaf1dc9e55c41ff2a56ba32309ac1971d8ab35
Size

341KB
MD5

837ef9e80aceb17db133824e7c56f5cb
SHA1

93d7d53e41a14cc83cf4bb659afa44defb05746b
SHA256

f20133cceeb23acc2ff42bc3b1aaf1dc9e55c41ff2a56ba32309ac1971d8ab35
SHA512

c2b38e2c4d1543dd73f7e532990597893701407f07e75df67db651ca208bf3c25f8fbba15dbfaa9364600af1308541a2c4d856e9f80d84a71c9704a6f068a225
SSDEEP

6144:nrJwfzU9Hvzo+BwBl3SzIvAPcO4U+MB+8oMCGzBHjnHjEt2aklo9uEa5:kQZzoRBt0IOVdtBHjHHaV9uE+

Score

N/A

Malware Config

Signatures

Files

f20133cceeb23acc2ff42bc3b1aaf1dc9e55c41ff2a56ba32309ac1971d8ab35
.exe windows x86

ce377100ec56ef1c6025fd8109aeb198

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
NdrDllCanUnloadNow
NdrMesTypeEncode2
CStdStubBuffer_AddRef
NdrCStdStubBuffer_Release
NdrDllUnregisterProxy
NdrMesTypeFree2
NdrDllRegisterProxy
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs
NdrOleFree
IUnknown_AddRef_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllGetClassObject
CStdStubBuffer_QueryInterface
MesHandleFree
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Connect
MesEncodeDynBufferHandleCreate
NdrOleAllocate
MesDecodeBufferHandleCreate
NdrMesTypeDecode2

urlmon

CopyStgMedium

kernel32

GlobalDeleteAtom
DisableThreadLibraryCalls
GlobalAlloc
GetCurrentProcessId
GetDefaultCommConfigW
FindNextChangeNotification
TlsFree
SystemTimeToFileTime
GlobalUnlock
CreateMutexW
SetEvent
ReadFile
VirtualQuery
GetLocaleInfoW
GetCommConfig
GetProfileStringW
LocalAlloc
CreateSemaphoreW
CreateDirectoryW
InterlockedDecrement
TlsGetValue
GetCommTimeouts
DeviceIoControl
RaiseException
MultiByteToWideChar
ExpandEnvironmentStringsW
SetUnhandledExceptionFilter
WaitForMultipleObjectsEx
CreateThread
LeaveCriticalSection
lstrcmpW
HeapAlloc
FindNextFileW
FreeLibraryAndExitThread
CloseHandle
MapViewOfFile
lstrlenA
GetDiskFreeSpaceW
lstrcpyW
HeapDestroy
InterlockedIncrement
DuplicateHandle
VirtualProtect
MoveFileW
OutputDebugStringA
SizeofResource
GetCommProperties
GetFileSize
lstrcpynW
TransmitCommChar
SetFileAttributesW
lstrlenW
Sleep
GetSystemDefaultUILanguage
GetSystemDirectoryA
LocalFree
WriteFile
EscapeCommFunction
GlobalLock
GetCurrentThreadId
WaitForSingleObject
VirtualAlloc
TerminateProcess
GetSystemDefaultLangID
GetSystemTime
DeleteCriticalSection
Beep
GetSystemTimeAsFileTime
SetCommMask
DeleteFileW
ClearCommError
GetTickCount
CreateFileMappingW
FormatMessageW
RemoveDirectoryW
InterlockedExchange
FindFirstChangeNotificationW
WideCharToMultiByte
FindFirstFileW
GetVolumeInformationW
WaitForMultipleObjects
LoadLibraryW
LoadLibraryExW
GlobalHandle
GetProcAddress
LoadResource
QueryDosDeviceW
GetFullPathNameW
LockFileEx
GetCommState
SetFilePointer
lstrcmpiA
GlobalSize
SetFileTime
OpenThread
GetDriveTypeW
CreateEventW
CancelIo
GetModuleHandleA
MulDiv
QueryPerformanceCounter
ResetEvent
FreeLibrary
InitializeCriticalSection
GlobalAddAtomW
BindIoCompletionCallback
LoadLibraryA
GetCommMask
FlushInstructionCache
GetProcessHeap
FindResourceExW
GetVersionExW
SetErrorMode
OutputDebugStringW
GetComputerNameA
GetVersion
ResumeThread
EnterCriticalSection
GetSystemDirectoryW
VerifyVersionInfoW
GetACP
FindResourceW
CreateFileW
PurgeComm
CreateProcessW
GetSystemInfo
QueueUserWorkItem
GetComputerNameW
SetLastError
lstrcmpiW
FreeResource
WaitCommEvent
GetCommModemStatus
GetCurrentProcess
GetTimeZoneInformation
SetupComm
GetOverlappedResult
HeapFree
SetEndOfFile
GetFileInformationByHandle
FindClose
LockResource
FlushFileBuffers
lstrcatW
GetModuleHandleExW
LockFile
GetFileAttributesExW
GetTempPathW
FindCloseChangeNotification
VirtualFree
GetUserDefaultUILanguage
GlobalFree
GetModuleFileNameW
GetModuleHandleW
lstrcmpA
UnlockFile
GetLastError
SetCommState
SearchPathW
UnmapViewOfFile
ReleaseSemaphore
TlsSetValue
InterlockedCompareExchange
GetTempFileNameW
TlsAlloc
GetVersionExA
DebugBreak
UnhandledExceptionFilter
SetCommTimeouts
GetFileAttributesW

advapi32

RegQueryValueExW
GetFileSecurityW
GetUserNameA
GetTraceLoggerHandle
RegCreateKeyW
RegConnectRegistryW
CredWriteDomainCredentialsW
RegEnumKeyExA
CredReadDomainCredentialsW
RegQueryValueExA
CryptAcquireContextW
RegEnumKeyExW
RegOpenKeyA
RegCreateKeyExW
GetTraceEnableLevel
CredWriteW
RegOpenKeyExA
RegSetValueExA
GetUserNameW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteValueA
RegOpenKeyExW
RegCloseKey
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryInfoKeyA
RegDeleteValueW
CryptGenRandom
CredDeleteW
CryptReleaseContext
RegFlushKey
CredFree
CredUnmarshalCredentialW
CredReadW
RegDeleteKeyW
RegCreateKeyExA
CredGetSessionTypes
GetSecurityDescriptorLength
RegEnumValueW
TraceMessage
GetTraceEnableFlags
RegSetValueExW
SetFileSecurityW

cryptui

CryptUIDlgViewCertificateW

netapi32

NetGetJoinInformation
NetApiBufferFree

secur32

FreeContextBuffer
QuerySecurityPackageInfoW
GetUserNameExW
InitializeSecurityContextW
AcquireCredentialsHandleW
FreeCredentialsHandle
DecryptMessage
DeleteSecurityContext
QueryContextAttributesW
EncryptMessage

msimg32

GradientFill

iphlpapi

GetBestInterfaceEx

shlwapi

PathRemoveFileSpecW

gdi32

CreateRectRgnIndirect
CreateDIBPatternBrushPt
CreateRectRgn
SetWindowExtEx
OffsetClipRgn
SelectObject
SetBitmapBits
SaveDC
GetTextAlign
StretchDIBits
MoveToEx
DeleteObject
GetNearestPaletteIndex
SetWindowOrgEx
DeleteMetaFile
SetROP2
GetObjectW
GetCurrentObject
Ellipse
FillRgn
CreatePatternBrush
CreateMetaFileW
GetDeviceCaps
OffsetRgn
DPtoLP
UpdateColors
SetBkColor
CreateFontIndirectW
GetPaletteEntries
SetRectRgn
GetStockObject
CreatePolygonRgn
GetClipBox
GetTextExtentPointW
GdiDrawStream
BitBlt
LineTo
GetBkMode
DeleteDC
CreateBitmap
CreateCompatibleBitmap
CreateSolidBrush
CloseMetaFile
RealizePalette
LPtoDP
CreateDIBSection
PatBlt
SetDIBColorTable
ExtSelectClipRgn
SetPolyFillMode
CreateCompatibleDC
PlayMetaFile
StretchBlt
GetBrushOrgEx
CreateBrushIndirect
CreateDIBitmap
FrameRgn
CombineRgn
SetViewportOrgEx
CreatePalette
RestoreDC
SelectPalette
SetBrushOrgEx
SetTextAlign
Polygon
CreatePen
SetDCBrushColor
GetRgnBox
SelectClipRgn
SetMetaFileBitsEx
GetDIBColorTable
GdiFlush
SetTextColor
GetMapMode
CreateDCW
GetNearestColor
SetMapMode
SetStretchBltMode
SetBkMode
Rectangle
GetMetaFileBitsEx

user32

BeginDeferWindowPos
MoveWindow
CreateIconIndirect
ReleaseCapture
GetWindowDC
ChangeClipboardChain
IsWindowEnabled
GetClipboardFormatNameW
SetDlgItemTextW
LoadIconW
DestroyIcon
LoadCursorW
SetClipboardData
DispatchMessageW
AttachThreadInput
RegisterDeviceNotificationW
MapWindowPoints
SetCursorPos
SetWindowTextW
RegisterWindowMessageW
CountClipboardFormats
keybd_event
KillTimer
PostThreadMessageW
DrawIconEx
EnableWindow
AdjustWindowRect
GetMonitorInfoW
MsgWaitForMultipleObjectsEx
IsIconic
GetRawInputData
EndDialog
CreateDialogParamW
DestroyAcceleratorTable
GetDC
GetClientRect
SetCursor
SetCapture
RegisterClassExW
GetFocus
GetWindowLongW
SetActiveWindow
ShowScrollBar
InvalidateRect
EndDeferWindowPos
IsWindowVisible
UnregisterHotKey
IsChild
DestroyCursor
SystemParametersInfoW
DeferWindowPos
CheckDlgButton
UnhookWindowsHookEx
RegisterClipboardFormatW
RegisterClassW
RegisterRawInputDevices
MessageBeep
GetWindowRect
UnregisterClassW
UpdateWindow
ShowCursor
GetWindowTextW
SetClipboardViewer
GetGUIThreadInfo
SetScrollInfo
MapVirtualKeyW
UnregisterDeviceNotification
SetTimer
ReleaseDC
PostMessageW
GetLastInputInfo
GetAsyncKeyState
GetKeyboardLayout
PtInRect
SetScrollPos
DrawTextW
EnumClipboardFormats
CloseWindow
GetCursorPos
ScreenToClient
GetActiveWindow
SetWindowPos
IsDlgButtonChecked
SetWindowsHookExW
CreateWindowExW
GetClipboardData
LockWindowUpdate
RegisterHotKey
GetKeyboardLayoutNameA
GetKeyboardState
SystemParametersInfoA
UnionRect
GetParent
SendMessageW
FillRect
GetDesktopWindow
IsZoomed
GetClassInfoW
GetKeyState
GetWindowThreadProcessId
CharPrevW
GetKeyboardLayoutNameW
GetSysColor
SetParent
SetFocus
LoadImageW
CallNextHookEx
EnableMenuItem
EndPaint
RedrawWindow
GetClipboardViewer
GetMessageExtraInfo
GetSystemMetrics
GetCapture
IntersectRect
EqualRect
GetDlgItem
SetWindowRgn
ClientToScreen
CopyRect
CopyIcon
wsprintfW
DefWindowProcW
CallWindowProcW
BeginPaint
FlashWindow
ShowWindow
BringWindowToTop
InflateRect
CreateCursor
SetRectEmpty
IsWindow
DefDlgProcW
PostQuitMessage
MonitorFromWindow
CloseClipboard
IsClipboardFormatAvailable
DialogBoxParamW
OpenClipboard
LoadStringW
SetForegroundWindow
CharLowerW
GetClassNameW
GetWindowPlacement
SetWindowPlacement
GetForegroundWindow
DestroyWindow
SetRect
GetMessageW
GetLastActivePopup
EmptyClipboard
SetWindowLongW
GetClassInfoExW
CharNextW
PeekMessageW
FindWindowExW
GetSystemMenu
OffsetRect
GetKeyboardType
FindWindowW
GetSysColorBrush
SendInput
GetWindow

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

winmm

waveOutReset
waveOutGetVolume
waveOutWrite
waveOutGetPitch
waveOutUnprepareHeader
waveOutOpen
waveOutPrepareHeader
waveOutClose
waveOutSetVolume

ws2_32

WSALookupServiceBeginW
freeaddrinfo
getaddrinfo
WSALookupServiceNextW
WSAIoctl
WSANSPIoctl
WSALookupServiceEnd

samlib

SamAddMemberToAlias

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInfoW
SetupDiOpenClassRegKeyExW
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey

ole32

CoInitialize
StringFromCLSID
OleIsCurrentClipboard
OleGetClipboard
CoTaskMemAlloc
OleRegEnumVerbs
CoTaskMemRealloc
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetUserType
ReleaseStgMedium
OleRegGetMiscStatus
CoCreateInstance
CoInitializeEx
CreateOleAdviseHolder
CoTaskMemFree
CoGetMalloc
OleSetClipboard
OleInitialize
CoUninitialize
CLSIDFromString
OleSaveToStream
OleUninitialize

ntdll

RtlAcquireResourceExclusive
RtlFindClearBitsAndSet
RtlEnumerateGenericTable
NtOpenFile
RtlDeleteElementGenericTable
RtlAreBitsSet
RtlLookupElementGenericTable
NtWriteFile
RtlInitializeResource
RtlUnwind
VerSetConditionMask
RtlReleaseResource
NtDeviceIoControlFile
RtlClearBits
NtReadFile
RtlInsertElementGenericTable
RtlInitializeBitMap
RtlAcquireResourceShared
RtlGetLastNtStatus
RtlEnumerateGenericTableWithoutSplaying
RtlDeleteResource
RtlInitializeCriticalSection
NtAllocateVirtualMemory
RtlInitUnicodeString

shell32

SHAppBarMessage
DragQueryFileW
ExtractIconW
SHFileOperationW
Shell_NotifyIconW

wininet

InternetGetCookieW

crypt32

CertGetNameStringW
CertVerifySubjectCertificateContext
CryptProtectData
CryptMsgOpenToDecode
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertFreeCertificateChain
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CryptDecodeObject
CertFindExtension
CertGetCertificateChain
CertCloseStore
CertCreateCertificateContext
CertDuplicateCertificateChain
CertCompareCertificate
CertVerifyCertificateChainPolicy
CryptMsgUpdate
CryptSignMessage
CertFindCertificateInStore
CryptStringToBinaryW
CryptVerifyDetachedMessageSignature
CryptBinaryToStringW
CertOpenStore
CryptMsgClose

credui

CredUIParseUserNameW
CredUIPromptForCredentialsW

msvcrt

_wcsnicmp
memset
wcsncmp
ceil
time
localeconv
free
_XcptFilter
_initterm
iswdigit
isxdigit
_purecall
ferror
_iob
_read
_unlock
_snprintf
_strnicmp
srand
_vsnprintf
iswalnum
towlower
_errno
strchr
_resetstkoflw
fclose
_amsg_exit
_adjust_fdiv
__dllonexit
_isatty
strncmp
isleadbyte
_CxxThrowException
memmove
wcsstr
calloc
toupper
strtok
wcspbrk
_write
iswctype
bsearch
_strlwr
isdigit
mbtowc
printf
_wtoi
_wcslwr
_vsnwprintf
__badioinfo
__mb_cur_max
_itoa
wcsrchr
_lseeki64
_wcsicmp
_fileno
_lock
realloc
__pioinfo
memcpy
malloc
floor
_onexit
wcstok
wcschr
wcstombs
ungetc
_stricmp
strtoul
_wtol
wctomb

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 292KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ce377100ec56ef1c6025fd8109aeb198

Headers

DLL Characteristics

File Characteristics

Imports

version

rpcrt4

urlmon

kernel32

advapi32

cryptui

netapi32

secur32

msimg32

iphlpapi

shlwapi

gdi32

user32

wtsapi32

winmm

ws2_32

samlib

setupapi

ole32

ntdll

shell32

wininet

crypt32

credui

msvcrt

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 292KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 24KB - Virtual size: 24KB

.rdata Size: 3KB - Virtual size: 3KB

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 292KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 24KB - Virtual size: 24KB

.rdata
Size: 3KB - Virtual size: 3KB