f52cf9173e74b9ed36a6ab33400a641b1c6d3ad16ef7a2f3809dafd282bbba26

Sharing

Copy URL

Twitter E-mail

General

Target

f52cf9173e74b9ed36a6ab33400a641b1c6d3ad16ef7a2f3809dafd282bbba26
Size

719KB
MD5

57595583156c2f507b8945d77225bfa2
SHA1

8144fb7c3be283a97398e4910edfcc8b13d466d6
SHA256

f52cf9173e74b9ed36a6ab33400a641b1c6d3ad16ef7a2f3809dafd282bbba26
SHA512

20323f2339e19745c7720f3395b08324255883b355d35ba78f6d1d2936126cc4635f18c110d50a1e427c0f3b00f2d12cd5212312818cf5b3faa779f7c8109391
SSDEEP

12288:yES8HXqevJ2jCkhqFC5MWsqbBbbx5i1kVe:NxHvJxWqrWsiBJ5i12e

Score

N/A

Malware Config

Signatures

Files

f52cf9173e74b9ed36a6ab33400a641b1c6d3ad16ef7a2f3809dafd282bbba26
.exe windows x86

8e24e613f052268bddc9d13029d7afe7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
FreeSid
CheckTokenMembership
DuplicateToken
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
RevertToSelf
ImpersonateLoggedOnUser
RegQueryInfoKeyW
RegEnumValueW
OpenThreadToken
GetLengthSid
CopySid
LookupAccountNameW
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA

kernel32

SetEndOfFile
CreateMutexW
GetLocalTime
SystemTimeToFileTime
GetSystemDirectoryW
CreateEventW
ResetEvent
Sleep
CreateProcessW
LoadLibraryW
VirtualProtect
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
DeviceIoControl
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
ReleaseMutex
GetComputerNameW
CompareFileTime
TryEnterCriticalSection
GetExitCodeProcess
GetCurrentProcess
GetProcessHeap
DeleteFileA
MoveFileA
LocalAlloc
GetTempPathA
GetCurrentDirectoryW
CreateMutexA
HeapAlloc
GetVersion
HeapFree
GetSystemDirectoryA
FindFirstFileA
ReadProcessMemory
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
WTSGetActiveConsoleSessionId
GetCurrentProcessId
ProcessIdToSessionId
CompareStringW
RemoveDirectoryW
DeleteFileW
MoveFileExW
FindFirstFileW
CopyFileW
FindNextFileW
FindClose
CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
LocalFree
GetModuleFileNameW
FormatMessageW
CreateThread
CreateFileW
GetFileSize
ReadFile
WaitForMultipleObjects
GetLastError
GetModuleHandleW
OpenEventW
SetEvent
CloseHandle
GetVersionExA
GetStartupInfoW
RtlUnwind
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapSize
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
FreeLibrary
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RaiseException
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetUserDefaultLCID

gdi32

StartPage
StartDocA
SetMapMode
GetDeviceCaps
GetStockObject
SetBkMode
SetTextColor
CreateFontA
GetTextFaceA
GetTextMetricsW
SelectObject
DeleteObject
CreateSolidBrush
EndDoc
EndPage
DeleteDC

user32

GetParent
ShowWindow
GetDlgItem
SetTimer
DrawMenuBar
PostMessageW
GetSystemMenu
EnableWindow
SetWindowTextW
SendMessageW
KillTimer
LoadStringW
SetWindowLongW
EnableMenuItem
CheckDlgButton
GetDesktopWindow
LoadStringA
GetSysColor
MessageBoxW
GetDC
GetClientRect
MapWindowPoints
MoveWindow
ReleaseDC
GetWindowLongW
GetDlgCtrlID
SetCursor
CallWindowProcW
FillRect
DrawTextW
DrawFocusRect
LoadCursorW
DestroyCursor
SetDlgItemTextA
IsWindow
IsDlgButtonChecked
SetDlgItemTextW
GetWindowRect
GetSystemMetrics
SetWindowPos

ole32

CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoInitialize
CoCreateGuid
StringFromGUID2
CLSIDFromProgID

comdlg32

CommDlgExtendedError
PrintDlgA

comctl32

PropertySheetW
CreatePropertySheetPageW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory

crypt32

CryptUnprotectData

shell32

ShellExecuteA

oleaut32

SysAllocString
VariantClear
VariantInit
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
SysFreeString

Sections

.text
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 30KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8e24e613f052268bddc9d13029d7afe7

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

ole32

comdlg32

comctl32

userenv

version

wtsapi32

crypt32

shell32

oleaut32

Sections

.text Size: 362KB - Virtual size: 362KB

.data Size: 30KB - Virtual size: 48KB

.rsrc Size: 19KB - Virtual size: 20KB

.reloc Size: 24KB - Virtual size: 23KB

.pdata Size: 76KB - Virtual size: 76KB

.text
Size: 362KB - Virtual size: 362KB

.data
Size: 30KB - Virtual size: 48KB

.rsrc
Size: 19KB - Virtual size: 20KB

.reloc
Size: 24KB - Virtual size: 23KB

.pdata
Size: 76KB - Virtual size: 76KB