d8e5bfdf93e4f11a9a46ea6c83f6c9eae1bd422ee1d9d96de4e89dab933b57aa

Sharing

Copy URL

Twitter E-mail

General

Target

d8e5bfdf93e4f11a9a46ea6c83f6c9eae1bd422ee1d9d96de4e89dab933b57aa
Size

700KB
MD5

92c86777b3de425efe93d5612232cd21
SHA1

b4175652ecd2f7da1b58bfc34d2ff53b71645273
SHA256

d8e5bfdf93e4f11a9a46ea6c83f6c9eae1bd422ee1d9d96de4e89dab933b57aa
SHA512

a0f6d304d10c41ea2465b1ffc15c596f2c7ee22a74d4c6c07990de4029acdf3bfb3f0448d15bc685b790d19eff1111ad6d1e7daf6da6562b0276ed8f0bf96737
SSDEEP

12288:HGlNs/AT0V5TVO8RnO6N6toVz/dA/7cTgp3naQuDJztMKHxE7Ac37ouJe:PTjRnOa7Vz/dAzJtaQMtMKHw30c

Score

N/A

Malware Config

Signatures

Files

d8e5bfdf93e4f11a9a46ea6c83f6c9eae1bd422ee1d9d96de4e89dab933b57aa
.exe windows x86

16b81b80f65bf81003a67234b735409f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CopySid
GetLengthSid
IsValidSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
InitializeAcl
EventRegister
EventUnregister
EventWrite
AdjustTokenPrivileges
LookupPrivilegeValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
OpenThreadToken
LookupAccountNameW
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
MakeSelfRelativeSD
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorLength
GetSidSubAuthority
SetSecurityDescriptorSacl
MakeAbsoluteSD
InitializeSid
GetSidLengthRequired
DeleteAce
EqualPrefixSid
LookupAccountSidW
CreateWellKnownSid
DeregisterEventSource
RegisterEventSourceW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

GetModuleHandleW
SetLastError
InterlockedIncrement
InterlockedDecrement
LoadLibraryA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
GlobalFree
GlobalAlloc
WaitForMultipleObjects
GetTickCount
CreateThread
LoadLibraryW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
ResetEvent
LocalFree
GetHandleInformation
OpenEventW
GetCurrentProcessId
SetErrorMode
HeapSetInformation
lstrlenA
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
GetThreadTimes
GetCurrentProcess
GetProcessTimes
GetCurrentThreadId
WaitForSingleObject
SetEvent
CreateEventW
GetProcAddress
FreeLibrary
CloseHandle
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
lstrlenW
GetSystemDefaultLCID
CompareStringW
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
SearchPathW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetVersionExW
FindResourceExW
WaitForSingleObjectEx
OutputDebugStringW
CopyFileA
DeleteFileA
FlushViewOfFile
GetLocalTime
CreateFileA
FormatMessageA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
LCMapStringW
SetPriorityClass
IsValidCodePage
OpenFileMappingW
OpenSemaphoreW
CreateFileMappingW
VerSetConditionMask
VerifyVersionInfoW
ReleaseSemaphore
RegEnumValueW
RegQueryValueExW
RegDeleteKeyExW
ExpandEnvironmentStringsW
CreateFileW
DuplicateHandle
GetFileSize
GetFileTime
UnlockFile
LockFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
WriteFile
ReadFile
DeleteFileW
FormatMessageW
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
ReleaseMutex
GetCurrentThread
GetVersionExA

msvcrt

_vsnwprintf
bsearch
fprintf
_iob
_controlfp
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
strncmp
strerror
_itow_s
_set_error_mode
_wcsicmp
_wtoi
_itow
wcsncpy_s
memcpy_s
memcpy
memset
__CxxFrameHandler3
wcschr
_purecall
_wcsnicmp
wcsncmp
_CxxThrowException
malloc
free
iswspace
_wtol
_ultow
_vsnprintf

user32

LoadStringW
UnregisterClassA
GetLastInputInfo
MsgWaitForMultipleObjects
CharNextW
PeekMessageW
DispatchMessageW

ole32

CLSIDFromProgID
CoInitializeSecurity
CoDisconnectObject
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateBindCtx
CreateStreamOnHGlobal
CoUnmarshalInterface
CoTaskMemFree
PropVariantClear
CoUninitialize
CoInitializeEx
PropVariantCopy

oleaut32

SysStringLen
SetErrorInfo
CreateErrorInfo
VarUI4FromStr
GetErrorInfo
SysFreeString

tquery

?ciNewNoThrow@@YGPAXI@Z
?ciNew@@YGPAXI@Z
?ciDelete@@YGXPAX@Z

msshooks

LoadMSSearchHooks

imm32

ImmDisableIME

shlwapi

SHRegGetValueW

ntdll

WinSqmIncrementDWORD

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp1
Size: 540KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

16b81b80f65bf81003a67234b735409f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

tquery

msshooks

imm32

shlwapi

ntdll

Sections

.text Size: 147KB - Virtual size: 146KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.vmp1 Size: 540KB - Virtual size: 1.6MB

.text
Size: 147KB - Virtual size: 146KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB

.vmp1
Size: 540KB - Virtual size: 1.6MB