94c147036de1b5fe6831819bfe4b69d66f8a693cd8595c6104bf382b04103b71

Sharing

Copy URL Twitter E-mail

General

Target

94c147036de1b5fe6831819bfe4b69d66f8a693cd8595c6104bf382b04103b71
Size

194KB
MD5

934c11cc7fa8a4bc1c3c62d86624705f
SHA1

d7b855ded382a178bda2005b935d5a7251f99dd6
SHA256

94c147036de1b5fe6831819bfe4b69d66f8a693cd8595c6104bf382b04103b71
SHA512

c818a6088b90e3d6003c9743e0f8089914549c8de889e3bd02b95ebe6f5c3789e572ef47d6e20b411947cd75dc70f70339aa2b1cc5bfbf5169029a9d6623977c
SSDEEP

3072:1hUATkLmCObK6d8vT6+kg+K6J8TPfaKn7AmaLuxCyADyC+koHZ4f0gL:1A/CCeKS8TAyCyEJmyc8

Score

N/A

Malware Config

Signatures

Files

94c147036de1b5fe6831819bfe4b69d66f8a693cd8595c6104bf382b04103b71
.exe windows x86

3a72b115746c64f0c64e764eb9240a8b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE

Imports

acledit

EditOwnerInfo
DllMain
SedTakeOwnership
SedSystemAclEditor
EditAuditInfo
EditPermissionInfo
FMExtensionProcW
SedDiscretionaryAclEditor

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory
WTSVirtualChannelOpen
WTSOpenServerW
WTSSetSessionInformationA
WTSQueryUserConfigA
WTSSetUserConfigW
WTSVirtualChannelPurgeInput
WTSQuerySessionInformationW
WTSLogoffSession
WTSEnumerateServersW
WTSWaitSystemEvent
WTSVirtualChannelClose
WTSVirtualChannelRead
WTSEnumerateSessionsA
WTSEnumerateSessionsW
WTSCloseServer
WTSDisconnectSession
WTSQuerySessionInformationA
WTSQueryUserConfigW
WTSShutdownSystem
WTSTerminateProcess
WTSVirtualChannelQuery
WTSOpenServerA
WTSVirtualChannelWrite
WTSEnumerateProcessesA
WTSSetUserConfigA
WTSSendMessageW
WTSSendMessageA
WTSEnumerateServersA
WTSVirtualChannelPurgeOutput
WTSSetSessionInformationW

activeds

ADsSetLastError
ADsBuildEnumerator
ADsEnumerateNext
AllocADsMem
FreeADsMem
ADsBuildVarArrayStr
AdsTypeToPropVariant2
DllCanUnloadNow
AllocADsStr
ADsEncodeBinaryData
ADsFreeEnumerator
ADsDecodeBinaryData
ReallocADsStr
ConvertSecDescriptorToVariant
PropVariantToAdsType2
PropVariantToAdsType
ADsOpenObject
FreeADsStr
ReallocADsMem

msls31

LsTruncateSubline
LsAppendRunToCurrentSubline
LsPointXYFromPointUV
LsGetHihLsimethods
LsExpandSubline
LsdnFinishBySubline
LsGetSpecialEffectsSubline
LssbGetDurTrailInSubline
LsEnumLine
LsdnGetCurTabInfo
LsCreateSubline
LsdnResolvePrevTab
LsdnFinishDeleteAll
LssbFDoneDisplay
LsSetBreakSubline
LsdnDistribute
LssbGetPlsrunsFromSubline
LsSetDoc
LsdnGetFormatDepth
LsQueryLineDup
LsdnSubmitSublines
LsQueryFLineEmpty
LsQueryLineCpPpoint
LsdnQueryPenNode
LsSetCompression
LsLwMultDivR
LsQueryTextCellDetails
LssbGetNumberDnodesInSubline
LsDisplayLine
LsGetLineDur
LssbGetDupSubline
LsPointUV2FromPointUV1
LssbGetVisibleDcpInSubline
LsdnModifyParaEnding
LssbGetObjDimSubline
LsDestroyLine
LsGetTatenakayokoLsimethods
LsGetRubyLsimethods
LsdnFinishDelete
LsdnSetRigidDup

kernel32

DelayLoadFailureHook
CloseHandle
CreateFileA
OpenFileMappingA
VirtualProtectEx
LocalHandle
LocalUnlock
CreateFileMappingA
GetSystemTime
TlsGetValue
GetVersion
GetCompressedFileSizeW
ReadFile
GetCurrentProcess
IsBadCodePtr
GetWindowsDirectoryA
GetFileTime
GetSystemTimeAsFileTime
SetFilePointerEx
QueryPerformanceCounter
GetLocalTime
GetCurrentThread
SystemTimeToTzSpecificLocalTime
MoveFileA
FreeLibrary
GetCurrentProcessId
GetFileAttributesW
ReadConsoleW
GetEnvironmentVariableA
GetCommandLineW
GetBinaryType
CreateMutexA
GetCurrentThreadId
WriteFile
GetCommandLineA
OpenJobObjectW
SwitchToThread
FreeEnvironmentStringsA
lstrlenW
TerminateProcess
lstrlenA
UTUnRegister
GetLastError
VirtualAlloc
GetProfileStringW
GetConsoleTitleA
GetFileAttributesA
GetUserDefaultLCID
GetModuleHandleA

msvcrt

_wcsnicoll
_wcsrev
_heapchk
__winitenv
_wmktemp
fread
_adj_fdiv_m32i
_wctime
_mbctoupper
_strnicoll
__unguarded_readlc_active
__unDName
_lsearch
_fmode
_vsnprintf
_execl
_assert
time
freopen
_mbsnset
_initterm
fsetpos
_wspawnve
_wspawnlp
iswascii
_putch
fflush
_findnext64
_itow
??_Gbad_cast@@UAEPAXI@Z
wcsncat
system
__set_app_type
__p__commode
_wfdopen
ceil
_beep
_filelength
_fstat64

gdi32

DeleteObject
CreateBrushIndirect
RemoveFontResourceExA
EnumFontFamiliesExA
EqualRgn
SetICMProfileW
CreatePenIndirect
CreateDIBSection
CreatePen
SelectObject
DeleteColorSpace
EngPlgBlt

user32

GetTabbedTextExtentA
DrawCaptionTempA
MenuWindowProcW
MenuItemFromPoint
DdeEnableCallback
TrackPopupMenu
IsChild
PostMessageA
GetDesktopWindow
SetDlgItemTextW
DdeReconnect
ChangeDisplaySettingsA
DdeInitializeA
SetProcessWindowStation

ole32

CreateOleAdviseHolder
OleCreateEmbeddingHelper
HMETAFILEPICT_UserUnmarshal
OleUninitialize
DoDragDrop
CreateGenericComposite
CoTreatAsClass
OleConvertOLESTREAMToIStorageEx
STGMEDIUM_UserMarshal
CoMarshalHresult
HGLOBAL_UserFree
HMETAFILEPICT_UserSize
CoTaskMemRealloc
CoRevertToSelf
HBRUSH_UserUnmarshal
HMETAFILE_UserUnmarshal
ReadStringStream
OleSetContainedObject
HBITMAP_UserMarshal
FmtIdToPropStgName
CreateClassMoniker
DllGetClassObject

msasn1

ASN1BERDecCharString
ASN1CEREncBeginBlk
ASN1BEREncMultibyteString
ASN1intx_setuint32
ASN1_SetDecoderOption
ASN1BEREncOctetString
ASN1char16string_free
ASN1BEREncCharString
ASN1utctime_cmp
ASN1_Decode
ASN1BEREoid_free
ASN1BERDecObjectIdentifier2
ASN1CEREncOctetString
ASN1_CloseEncoder
ASN1char32string_free
ASN1_CreateDecoderEx
ASN1octetstring_free
ASN1_CloseEncoder2
ASN1ztchar32string_free
ASN1BEREncZeroMultibyteString
ASN1BERDotVal2Eoid
ASN1BEREncNull
ASN1CEREncChar32String
ASN1open_cmp

utildll

RegGetNetworkDeviceName
StrProcessState
NetBIOSDeviceEnumerate
ConfigureModem
SetupAsyncCdConfig
WinEnumerateDevices
DateTimeString
CompareElapsedTime
StrSdClass

dplayx

DirectPlayLobbyCreateA
DllRegisterServer
DllCanUnloadNow
DirectPlayEnumerateA
DllUnregisterServer
DirectPlayEnumerate
DirectPlayCreate
gdwDPlaySPRefCount
DirectPlayEnumerateW
DllGetClassObject
DirectPlayLobbyCreateW

perfctrs

CollectIPXPerformanceData
OpenSPXPerformanceData
CloseNbfPerformanceData
OpenNbfPerformanceData
OpenDhcpPerformanceData
CloseNWNBPerformanceData
CloseDhcpPerformanceData
CollectSPXPerformanceData
OpenIPXPerformanceData
CloseSPXPerformanceData
CollectTcpIpPerformanceData
CloseIPXPerformanceData
CollectNbfPerformanceData
CollectNWNBPerformanceData
OpenTcpIpPerformanceData
OpenNWNBPerformanceData
CollectDhcpPerformanceData
CloseTcpIpPerformanceData

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a72b115746c64f0c64e764eb9240a8b

Headers

File Characteristics

Imports

acledit

wtsapi32

activeds

msls31

kernel32

msvcrt

gdi32

user32

ole32

msasn1

utildll

dplayx

perfctrs

Sections

.text Size: 4KB - Virtual size: 2KB

.rsrc Size: 102KB - Virtual size: 101KB

.rdata Size: 10KB - Virtual size: 8KB

.data Size: 74KB - Virtual size: 73KB

.reloc Size: 2KB - Virtual size: 404B

.text
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 102KB - Virtual size: 101KB

.rdata
Size: 10KB - Virtual size: 8KB

.data
Size: 74KB - Virtual size: 73KB

.reloc
Size: 2KB - Virtual size: 404B