06b91cd354120278501ff21ea62690b237c1fd846d657988f80df35b73e85adb

Sharing

Copy URL Twitter E-mail

General

Target

06b91cd354120278501ff21ea62690b237c1fd846d657988f80df35b73e85adb
Size

884KB
MD5

84dcbd9189da82ff303dd76743bb6f61
SHA1

98eb3713e7569fa9ad66a12035f097b95052333f
SHA256

06b91cd354120278501ff21ea62690b237c1fd846d657988f80df35b73e85adb
SHA512

9b1468d6fe621b184b32afb73223e45d81c06f938e7ffc5d1fd0c155f7fef015ef082cbbe8520671ee65ab316c04796310c2f596f4f262a3535e234a97c1e914
SSDEEP

12288:z8ooCHFSgr/c5w/sjE2wbrfVWWHvZxN7sh0AbPs/nOgoMB5:goocFSA/c9jEhrfsIZxNAh0wPsnOPMB

Score

N/A

Malware Config

Signatures

Files

06b91cd354120278501ff21ea62690b237c1fd846d657988f80df35b73e85adb
.dll windows x86

ed502cd712c714a1671f6187159d8a7e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
GetWindowsDirectoryA
GetCurrentThreadId
GetTickCount
WriteFile
SetFilePointer
GetFileSize
GetCurrentProcessId
GetLocalTime
WideCharToMultiByte
MultiByteToWideChar
SetThreadPriority
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetLastError
SetEvent
ResetEvent
CreateEventA
OpenEventA
GetExitCodeProcess
CreateProcessA
ReleaseMutex
CreateMutexA
GetCurrentProcess
GetModuleHandleA
GetVersionExA
ExpandEnvironmentStringsA
lstrcpynA
lstrcatA
lstrcpyA
GetTempFileNameA
GetTempPathA
GetComputerNameA
DisconnectNamedPipe
FlushFileBuffers
WaitForMultipleObjects
GetOverlappedResult
ReadFile
ConnectNamedPipe
CreateNamedPipeA
WaitNamedPipeA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
FormatMessageA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
ExitThread
CreateThread
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetACP
GetOEMCP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileW
SetEndOfFile
CreateSemaphoreA
WaitForSingleObject
ReleaseSemaphore
GetProcAddress
LoadLibraryA
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
GetLastError
GetSystemDirectoryA
CreateFileA
CloseHandle
TerminateProcess
Sleep

advapi32

GetAce
InitializeSecurityDescriptor
FreeSid
RegEnumValueA
RegCreateKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
CloseServiceHandle
StartServiceA
QueryServiceStatusEx
OpenServiceA
OpenSCManagerA
SetKernelObjectSecurity
GetSecurityDescriptorDacl
SetSecurityInfo
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegCloseKey
GetLengthSid
IsValidSid
AllocateAndInitializeSid

shell32

ShellExecuteA

Exports

Exports

LcsAddMonitor
LcsAddTransport
LcsCancelDiscovery
LcsCancelJobPrinter
LcsCancelJobScanner
LcsCloseCardReader
LcsCloseHid
LcsClosePrinter
LcsCloseScanner
LcsDeleteHid
LcsDeletePrinter
LcsDeleteProfileScanner
LcsDeleteScanner
LcsDiscovery
LcsEndJobPrinter
LcsEndJobScanner
LcsEnumCardReaders
LcsEnumHids
LcsEnumPrinters
LcsEnumScanners
LcsEnumSpecificCardReader
LcsEnumSpecificHid
LcsEnumSpecificPrinter
LcsEnumSpecificScanner
LcsEnumWindowsHids
LcsEnumWindowsPrinters
LcsEnumWindowsScanners
LcsExchangeBidiCardReader
LcsExchangeBidiPrinter
LcsExchangeDataScanner
LcsExchangeNpaPrinter
LcsGetByteArrayPrinter
LcsGetCachePrinter
LcsGetClientId
LcsGetCurrentStateHid
LcsGetCurrentStatePrinter
LcsGetCurrentStateScanner
LcsGetDiscoveryDefaults
LcsGetHostInfo
LcsGetJobStringScanner
LcsGetLongHid
LcsGetLongPrinter
LcsGetLongScanner
LcsGetStringHid
LcsGetStringPrinter
LcsGetStringScanner
LcsGetWideStringPrinter
LcsInitialize
LcsInstall
LcsOpenCardReader
LcsOpenHid
LcsOpenPrinter
LcsOpenScanner
LcsRegisterForAlertsPrinter
LcsRegisterForAsyncDataCardReader
LcsRegisterForAsyncDataScanner
LcsRegisterForNotificationsCardReader
LcsRegisterForNotificationsHid
LcsRegisterForNotificationsPrinter
LcsRegisterForReportsCardReader
LcsRegisterForReportsHid
LcsRegisterForSystemNotifications
LcsRemoveTransport
LcsResume
LcsSendProfileScanner
LcsSetByteArrayPrinter
LcsSetClientInfo
LcsSetDiscoveryDefaults
LcsSetHostInfo
LcsSetJobLongScanner
LcsSetJobStringPrinter
LcsSetJobStringScanner
LcsSetLongPrinter
LcsSetStringPrinter
LcsSetStringScanner
LcsStartJobPrinter
LcsStartJobPrinterW
LcsStartJobScanner
LcsSuspend
LcsUninitialize
LcsUninstall
LcsUnregisterForAlertsPrinter
LcsUnregisterForAsyncDataCardReader
LcsUnregisterForAsyncDataScanner
LcsUnregisterForNotificationsCardReader
LcsUnregisterForNotificationsHid
LcsUnregisterForNotificationsPrinter
LcsUnregisterForReportsCardReader
LcsUnregisterForReportsHid
LcsUnregisterForSystemNotifications
LcsValidatePortName
LcsWritePrinter

Sections

.text
Size: 568KB - Virtual size: 566KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 124KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed502cd712c714a1671f6187159d8a7e

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

Exports

Exports

Sections

.text Size: 568KB - Virtual size: 566KB

.rdata Size: 128KB - Virtual size: 126KB

.data Size: 124KB - Virtual size: 167KB

.rsrc Size: 4KB - Virtual size: 972B

.reloc Size: 56KB - Virtual size: 52KB

.text
Size: 568KB - Virtual size: 566KB

.rdata
Size: 128KB - Virtual size: 126KB

.data
Size: 124KB - Virtual size: 167KB

.rsrc
Size: 4KB - Virtual size: 972B

.reloc
Size: 56KB - Virtual size: 52KB