e89e3692e7da2ea40c6e7318ac22b06b6c410ccb920c78e8c3547d5d5a286859

Sharing

Copy URL Twitter E-mail

General

Target

e89e3692e7da2ea40c6e7318ac22b06b6c410ccb920c78e8c3547d5d5a286859
Size

128KB
MD5

8469649ef1e2e3b3b7c621e2bddbfaf2
SHA1

a23f88332daf5527574377d1928d88c9413dfdb0
SHA256

e89e3692e7da2ea40c6e7318ac22b06b6c410ccb920c78e8c3547d5d5a286859
SHA512

001b8998f34535a02ab6b24448eed59e11413b6af7d12c5184e1585841d8cc54672b11dd4865ba68d38b9865a5b763d19a8d2b49828302a74eb3955065cfdb76
SSDEEP

3072:s2vwD5Ye9Ruz37HrySzSOIi23almb+Sj5izoFlg:sJDJa7H1SOINalmbyzt

Score

N/A

Malware Config

Signatures

Files

e89e3692e7da2ea40c6e7318ac22b06b6c410ccb920c78e8c3547d5d5a286859
.exe windows x86

639df78c766954eb0475f5f5aecd42fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wkwbl90

?_WksHeapCreate@@YAPAXKKK@Z
?OperatorDelete@@YAXPAX@Z
?_WksHeapDestroy@@YAPAXPAX@Z
?CwchLoadWz@MWblIntl@@SAHPAUHINSTANCE__@@IPA_WH@Z
?PwchFindWchInWz@MWblStrings@@SAPA_WPB_W_W@Z
?CwchWzToDouble@MWblStrings@@SAHPB_WPAN@Z
?OperatorNew@@YAPAXIPAXK@Z
??2@YAPAXIPAXK@Z
??3@YAXPAX0K@Z

kernel32

GetVersionExW
FreeLibrary
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
CloseHandle
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
SetThreadPriority
GetModuleFileNameW
Sleep
CreateThread
CreateEventW
SetEvent
GetCurrentProcess
GetCurrentThreadId
MultiByteToWideChar
LoadLibraryW
LoadResource
FindResourceW
LoadLibraryExW
TerminateThread
ResumeThread
GetCommandLineW
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
InterlockedCompareExchange
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetStartupInfoW
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
lstrlenW
MulDiv
GetProcessHeap
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
SizeofResource
UnhandledExceptionFilter
GetModuleHandleW
GetTickCount

user32

ReleaseDC
GetDC
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
CharUpperW
DestroyWindow
DefWindowProcW
CreateWindowExW
RegisterClassW
UnregisterClassA

gdi32

DeleteDC
CreateFontIndirectW
EnumFontFamiliesExW
EnumFontFamiliesW
DeleteObject
GetDeviceCaps
CreateICW

winspool.drv

EnumPrintersW

advapi32

RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
StringFromGUID2

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
VariantClear
VariantInit

msvcp80

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

msvcr80

_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__setusermatherr
__set_app_type
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_except_handler4_common
_beginthreadex
_resetstkoflw
_adjust_fdiv
__p__commode
_controlfp_s
_crt_debugger_hook
malloc
__CxxFrameHandler3
_invalid_parameter_noinfo
memmove_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
memset
memcpy
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memcmp
calloc
free
memcpy_s
wcscpy_s
wcsncpy_s
wcscat_s
_purecall
_recalloc
__p__fmode

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

639df78c766954eb0475f5f5aecd42fb

Headers

DLL Characteristics

File Characteristics

Imports

wkwbl90

kernel32

user32

gdi32

winspool.drv

advapi32

ole32

oleaut32

msvcp80

msvcr80

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 56KB - Virtual size: 56KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 56KB - Virtual size: 56KB