26a899266df88c3994ed5eef1d94aaeb219e3b7ce9c20d0d55fd1dbbc7dfd977

Sharing

Copy URL Twitter E-mail

General

Target

26a899266df88c3994ed5eef1d94aaeb219e3b7ce9c20d0d55fd1dbbc7dfd977
Size

56KB
MD5

a2922e0a80944cf94c2bd6574085c536
SHA1

005f55f8af1fa4d3bd2704a147205b61dc885f1c
SHA256

26a899266df88c3994ed5eef1d94aaeb219e3b7ce9c20d0d55fd1dbbc7dfd977
SHA512

3c1e8ed680c769c81cb81bcc83aea79d6456c2211bb39a7186611bc2ad00b64d79f44abf58ac783ae42b71327ff5f595ee88f874846e4373caeeee17b4b7a4b5
SSDEEP

768:VLBE4CtCuB2OP4gDBwKsoE5NdrSF353hUdOU8LPCjzg01nAZsQcGKaqAg9gI9SER:FBZDKPPzmKbELwF3Qj8LqjEzcrZAi+wR

Score

N/A

Malware Config

Signatures

Files

26a899266df88c3994ed5eef1d94aaeb219e3b7ce9c20d0d55fd1dbbc7dfd977
.dll windows x86

1ed31e4a5befa7da13ab56bff51423c1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetTickCount
WaitForSingleObject
CreateEventA
MoveFileExA
CopyFileA
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
FindClose
FindNextFileA
FindFirstFileA
GetEnvironmentVariableA
EnterCriticalSection
SetLastError
lstrcpyA
lstrlenA
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetVersion
LeaveCriticalSection
VirtualQuery
Sleep
GetTempPathA
GetTempFileNameA
DeleteFileA
GetVolumeInformationA
InitializeCriticalSection
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetTimeFormatA
GetDateFormatA
DisableThreadLibraryCalls

advapi32

RegEnumKeyExA
RegCreateKeyA
RegSetValueExA
RegEnumKeyA
RegQueryValueExA
RegNotifyChangeKeyValue
RegOpenKeyExA
RegCloseKey

msvcrt

_adjust_fdiv
_initterm
__dllonexit
_stricmp
isalnum
strncpy
strrchr
strncmp
printf
memcpy
memset
srand
time
free
malloc
??3@YAXPAX@Z
rand
strcpy
strlen
_snprintf
_mbslwr
__CxxFrameHandler
_onexit
_strlwr
strstr
??2@YAPAXI@Z
_EH_prolog
atoi
_beginthread
strcat
strchr
realloc
_strcmpi

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1_Lockit@std@@QAE@XZ

mapi32

ord13
ord23
ord135
ord17
ord138
ord11
ord19
ord75
ord140
ord129
ord21

ws2_32

inet_ntoa
ioctlsocket
connect
WSAStartup
WSAGetLastError
gethostbyname
socket
setsockopt
inet_addr
select
gethostname
htons
send
shutdown
closesocket
recv

dnsapi

DnsRecordListFree
DnsQuery_A

urlmon

URLDownloadToFileA

Exports

Exports

Initialize
StartProcessAtWinLogon
StopProcessAtWinLogoff

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.newsec
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1ed31e4a5befa7da13ab56bff51423c1

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

msvcp60

mapi32

ws2_32

dnsapi

urlmon

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

.newsec Size: 8KB - Virtual size: 8KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB

.newsec
Size: 8KB - Virtual size: 8KB