4594db09494129f6980b892632dd5efe1dd836a21b11fe4130c4d50427ed922c

Sharing

Copy URL Twitter E-mail

General

Target

4594db09494129f6980b892632dd5efe1dd836a21b11fe4130c4d50427ed922c
Size

734KB
MD5

84f7d0c72c711a16f132163b201b82c2
SHA1

4a53bbccd366c1a94329ff35ffd70d7cbd9352af
SHA256

4594db09494129f6980b892632dd5efe1dd836a21b11fe4130c4d50427ed922c
SHA512

1682ead12357f187bd3633199c77321c0887e61c1dfd36de8185cb57557b432b4c0b67af6c14336cef6fc71ce3ed8883a3903453aa0857837ef621de2f62647e
SSDEEP

12288:YpzMysLA6C747zsPJT14P5QnJe6BKRcVowpiHOizwFMqPks4+5p8GpKeVrwulSb0:dLhTiB14P5QnJenRcuwMHJz6Mzsd5KGB

Score

N/A

Malware Config

Signatures

Files

4594db09494129f6980b892632dd5efe1dd836a21b11fe4130c4d50427ed922c
.exe windows x86

4237c14906c9d06eb0369ec5833058b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

CreateFileW
SetEnvironmentVariableA
CompareStringW
SetStdHandle
SetFilePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
MultiByteToWideChar
LCMapStringW
RtlUnwind
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
HeapFree
HeapQueryInformation
HeapSize
HeapReAlloc
GetTimeZoneInformation
RaiseException
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteFileA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
EncodePointer
SuspendThread
LocalFree
CloseHandle
FindFirstChangeNotificationA
GetModuleHandleA
GetSystemInfo
GlobalMemoryStatusEx
LockResource
LocalAlloc
GetConsoleScreenBufferInfo
LoadLibraryA
GetTempFileNameA
SetFileAttributesA
GetProcAddress
GetLastError
GetStdHandle
lstrcatA
SizeofResource
Sleep
LoadLibraryW
ExitProcess
FindResourceExA
OpenProcess
FormatMessageA
ExpandEnvironmentStringsA
GetComputerNameW
FindCloseChangeNotification
WaitForSingleObject
GetCurrentProcess
HeapAlloc
LoadResource
lstrlenA
CreateFileA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsBadReadPtr
HeapValidate
IsProcessorFeaturePresent
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetModuleHandleW
DecodePointer
InterlockedDecrement
InterlockedIncrement
DeleteFileW
FillConsoleOutputCharacterA
GetExitCodeProcess

user32

SendMessageA
MoveWindow
GetWindow
CheckMenuItem
RegisterHotKey
EnumDisplayDevicesA
DialogBoxParamA
GetDlgItemTextA
LoadCursorA
SetClipboardData
LoadImageA
EndPaint
ClientToScreen
DestroyWindow
GetMessageA
CloseClipboard
GetSystemMenu
SetTimer
GetWindowRect
InsertMenuItemA
RegisterClassExA
PostQuitMessage
GetWindowDC
GetMenuItemID
KillTimer
DrawTextA
GetSubMenu
SetWindowTextA
IsClipboardFormatAvailable
GetParent
LoadIconA
wsprintfA
GetClientRect
LoadStringA
BeginPaint
GetClassInfoW
GetDC
TranslateMessage
GetMenu
MessageBoxA
InvalidateRect
GetWindowLongA
CreateWindowExA
EmptyClipboard
GetDlgItem
EndDialog
DefWindowProcA
SendDlgItemMessageW
GetMenuItemInfoA
LoadAcceleratorsA
IsDlgButtonChecked
IsWindow
DispatchMessageA
CheckRadioButton
MessageBoxW
RegisterClassW

gdi32

BitBlt
SetTextColor
DeleteDC
GetDeviceCaps
CreateFontIndirectA
CreateDCA
CreateDCW
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
EnumFontFamiliesA
CreateRectRgn
GetFontData
GetObjectA
GetStockObject
GetTextColor

comdlg32

GetFileTitleA
FindTextW
ChooseFontA
FindTextA
ReplaceTextA

advapi32

CryptEnumProviderTypesA
ReadEventLogA
CredEnumerateA
GetOldestEventLogRecord
OpenEventLogW

shell32

SHGetFolderPathA
SHGetFolderPathW
DragQueryFileA
DragFinish

psapi

GetModuleFileNameExA
EnumProcessModules
GetModuleBaseNameA
GetProcessMemoryInfo

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

shlwapi

PathAppendA
StrStrW

comctl32

ord17

uxtheme

DrawThemeBackground

msi

ord64
ord121
ord124
ord17
ord103
ord8

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tada
Size: 391KB - Virtual size: 390KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hot
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4237c14906c9d06eb0369ec5833058b9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

psapi

version

shlwapi

comctl32

uxtheme

msi

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 5KB - Virtual size: 13KB

.tada Size: 391KB - Virtual size: 390KB

.hot Size: 8KB - Virtual size: 8KB

.rsrc Size: 108KB - Virtual size: 107KB

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 5KB - Virtual size: 13KB

.tada
Size: 391KB - Virtual size: 390KB

.hot
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 108KB - Virtual size: 107KB