25e7a087714beaaab0fbb8578ff52bb40a57ed8e68d0c7e78d2a71ad633ba779

Sharing

Copy URL Twitter E-mail

General

Target

25e7a087714beaaab0fbb8578ff52bb40a57ed8e68d0c7e78d2a71ad633ba779
Size

294KB
MD5

92a25dffff3436af6a4d14948747fa60
SHA1

3446233a1bb534f0f58b3abdb72ed5524b86e7a6
SHA256

25e7a087714beaaab0fbb8578ff52bb40a57ed8e68d0c7e78d2a71ad633ba779
SHA512

7c1b23765767743e92a0128815dcc63a131e9a0e3f0ee3266fade5d0e4f4ef9b3ace8388f2c70bf77d5147234b61988901928669e85fac3876f4b54db2df4659
SSDEEP

6144:uj4gtTdwFK7H2wHuiOO0fefTFBzkwVYx1PjAmapaUYrzf:+u//WfTJVYx1LAmag

Score

N/A

Malware Config

Signatures

Files

25e7a087714beaaab0fbb8578ff52bb40a57ed8e68d0c7e78d2a71ad633ba779
.exe windows x86

e02b6fe08d33a502a81cbaf60135f405

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

DeleteMonitorA
AddPrinterW
GetPrintProcessorDirectoryW
SetPrinterA

shlwapi

PathCompactPathExW
PathMakePrettyW
PathRemoveFileSpecA
StrToIntA
PathFileExistsA
PathSkipRootA
PathRemoveExtensionW
PathSetDlgItemPathA
PathIsRelativeW
StrCmpNA
StrCSpnA
PathFindFileNameA
PathIsSameRootA
PathMakePrettyA
StrToIntExA
PathSetDlgItemPathW
PathIsPrefixA
ChrCmpIA

netapi32

NetServerTransportDel
NetServerSetInfo
NetServerTransportAdd
NetFileClose

pdh

PdhGetCounterInfoW
PdhGetRawCounterArrayW
PdhCloseLog
PdhOpenLogA

imagehlp

UnMapAndLoad
MapFileAndCheckSumW
ImageDirectoryEntryToData
GetTimestampForLoadedLibrary
SymGetSymPrev

ole32

OleIsRunning

nddeapi

ord607

gdi32

CreateMetaFileA
CreateRectRgn

clusapi

CreateClusterNotifyPort
RemoveClusterResourceNode
ClusterRegGetKeySecurity
OnlineClusterResource
ClusterNetworkCloseEnum
ClusterNetworkEnum

setupapi

SetupDiOpenDeviceInfoA
SetupDiDestroyDriverInfoList
SetupAddToSourceListW
SetupPromptReboot
SetupDiDeleteDeviceInterfaceData
SetupQueryDrivesInDiskSpaceListW
SetupGetSourceFileSizeA
SetupDiGetClassBitmapIndex
SetupDiGetClassInstallParamsW
SetupDuplicateDiskSpaceListW
SetupCloseInfFile
SetupQueueCopyW
SetupGetStringFieldA
SetupDiGetDeviceInstallParamsA
SetupRemoveFromSourceListW
SetupFreeSourceListA
SetupDiGetDriverInfoDetailA
SetupQueueRenameSectionW
SetupDiDeleteDeviceInterfaceRegKey
SetupDiClassNameFromGuidExA
SetupDiGetSelectedDevice
SetupDiGetClassDevPropertySheetsW
SetupOpenInfFileW
SetupDiCancelDriverInfoSearch
SetupDecompressOrCopyFileA
SetupGetBinaryField
SetupGetFileCompressionInfoW
SetupInstallFileA
SetupDiGetClassInstallParamsA
SetupInstallServicesFromInfSectionExA
SetupDiGetClassImageListExW
SetupDiCreateDeviceInfoW
SetupDiCreateDevRegKeyA
SetupQueryInfFileInformationW
SetupDiGetSelectedDriverA

shell32

SHGetFileInfoA

msvcrt

_except_handler3
__dllonexit
__p__fmode
_onexit
__p__commode
_adjust_fdiv
__set_app_type
_controlfp
exit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr

oleaut32

SystemTimeToVariantTime
VarOr
VarDecFromR8
VariantTimeToDosDateTime
VarUI1FromI1

rpcrt4

I_RpcBindingInqTransportType
NDRcopy
RpcMgmtSetServerStackSize
MesBufferHandleReset
RpcEpRegisterW
RpcSmFree
NdrServerMarshall
NdrConformantStructMarshall
NDRSContextMarshallEx
NdrConformantArrayUnmarshall
RpcServerUseProtseqIfW
NdrConformantArrayBufferSize
RpcMgmtStatsVectorFree

user32

ShowWindow
UpdateWindow
EnumChildWindows
DlgDirListComboBoxW
ArrangeIconicWindows
CallMsgFilterW

comdlg32

GetOpenFileNameW

winmm

waveInReset
mmioClose
auxGetDevCapsW
waveOutGetErrorTextW
mmioDescend
mixerSetControlDetails
midiInPrepareHeader
mmioRenameA
waveInUnprepareHeader
midiDisconnect
waveOutReset
midiStreamPause

urlmon

IsAsyncMoniker
CreateFormatEnumerator
URLOpenPullStreamA
CoInternetGetProtocolFlags

imm32

ImmSetCompositionWindow
ImmGetConversionListA
ImmRegisterWordW
ImmGetCompositionFontA
ImmGetStatusWindowPos
ImmDestroyContext

kernel32

GetStartupInfoA
GetModuleHandleA

advapi32

SetTokenInformation
GetSidLengthRequired
OpenSCManagerA
BuildExplicitAccessWithNameW
GetMultipleTrusteeOperationA
BackupEventLogA
GetTrusteeNameW
GetAce
BuildTrusteeWithSidW
FreeSid
RegEnumKeyExA
GetTrusteeTypeW
BuildImpersonateTrusteeW
RegisterServiceCtrlHandlerW
IsTokenRestricted
BuildSecurityDescriptorW
GetExplicitEntriesFromAclA
GetTrusteeNameA
ImpersonateNamedPipeClient
RegEnumKeyW
RegCreateKeyExA
ChangeServiceConfig2A
RegisterEventSourceW
LsaEnumerateAccountRights
RegFlushKey
DecryptFileW
RegSetValueA
AllocateAndInitializeSid
StartServiceCtrlDispatcherA
GetTrusteeTypeA
AddAccessAllowedAce
GetTrusteeFormA
AdjustTokenGroups
AccessCheckAndAuditAlarmW
RegGetKeySecurity
LsaLookupSids
LookupAccountNameW
LsaQueryTrustedDomainInfo
LsaStorePrivateData
GetServiceDisplayNameW

wininet

FindNextUrlCacheEntryA
InternetSetStatusCallback
HttpAddRequestHeadersW
InternetCheckConnectionW
FtpRenameFileW
FtpFindFirstFileW

comctl32

ImageList_GetImageInfo
ImageList_Draw
ImageList_BeginDrag
ImageList_Create
ImageList_Replace
ImageList_SetIconSize
ord16
DestroyPropertySheetPage
FlatSB_GetScrollInfo
ord5
ImageList_Read
ImageList_GetDragImage
ord2
ImageList_DragEnter
ImageList_EndDrag

resutils

ClusWorkerCreate
ResUtilGetPrivateProperties
ResUtilVerifyResourceService
ResUtilSetDwordValue
ResUtilEnumProperties
ResUtilGetDwordValue
ResUtilFindSzProperty
ClusWorkerCheckTerminate
ClusWorkerTerminate

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e02b6fe08d33a502a81cbaf60135f405

Headers

File Characteristics

Imports

winspool.drv

shlwapi

netapi32

pdh

imagehlp

ole32

nddeapi

gdi32

clusapi

setupapi

shell32

msvcrt

oleaut32

rpcrt4

user32

comdlg32

winmm

urlmon

imm32

kernel32

advapi32

wininet

comctl32

resutils

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 368KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 368KB

.rsrc
Size: 4KB - Virtual size: 2KB