60fea5b97b6f8226b0ca9d221d4ca63c573caca1cff3777555001c816fcd8f05

Sharing

Copy URL

Twitter E-mail

General

Target

60fea5b97b6f8226b0ca9d221d4ca63c573caca1cff3777555001c816fcd8f05
Size

988KB
MD5

834433619f3d7f11919e4dc6137dcc5f
SHA1

1fab2f59a63841d7b68490c4b9a88ebe21964588
SHA256

60fea5b97b6f8226b0ca9d221d4ca63c573caca1cff3777555001c816fcd8f05
SHA512

a9faa8c786e9bd3244a40fb71832a0745692c2679a076dd7c757923d332818968fbfa3f7fa9fa89f510aa97df3bd98963ea1205ca039e7c48499ea1966eecd3f
SSDEEP

24576:gv5226zEwZpySbz7WenAoexFAXpUHTZjhIX+qX6I:gU2SbZptf7eHAXpMTBhi+qX

Score

N/A

Malware Config

Signatures

Files

60fea5b97b6f8226b0ca9d221d4ca63c573caca1cff3777555001c816fcd8f05
.exe windows x86

c9d1ee7d8a0374629ce185e274ddb577

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemory

shlwapi

PathStripToRootA
PathIsRootA

ws2_32

getsockopt
inet_addr
socket
WSASetLastError
gethostbyname
closesocket
bind
WSACleanup
WSAGetLastError
recv
send
select
__WSAFDIsSet
setsockopt
getprotobyname
getsockname
shutdown
htons
connect
ioctlsocket
sendto
recvfrom
gethostname
inet_ntoa
WSAStartup
ntohl
htonl
ntohs

kernel32

LocalFree
DuplicateHandle
CreatePipe
ReadFile
PeekNamedPipe
GetExitCodeProcess
CreateProcessA
LoadLibraryA
CreateMutexA
ReleaseMutex
FileTimeToDosDateTime
FileTimeToLocalFileTime
CreateFileA
SetFilePointer
WriteFile
SetEvent
FindFirstFileA
CreateEventA
SetLastError
GetExitCodeThread
WaitForMultipleObjects
SleepEx
ExpandEnvironmentStringsA
QueryPerformanceCounter
GetVersion
GlobalMemoryStatus
GetVersionExA
GetFileType
GetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FindNextFileA
FindClose
SetCurrentDirectoryA
CreateDirectoryA
FormatMessageA
CreateFileW
GetCurrentProcess
GetCurrentThreadId
WaitForSingleObject
FreeLibrary
ReleaseSemaphore
TerminateThread
DeleteCriticalSection
CloseHandle
InitializeCriticalSection
CreateSemaphoreW
CreateThread
LoadLibraryW
GetProcAddress
EnterCriticalSection
SetUnhandledExceptionFilter
LeaveCriticalSection
GetCurrentProcessId
Sleep
GetModuleFileNameA
MultiByteToWideChar
GetLastError
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
FlushConsoleInputBuffer
ReadConsoleInputA
SetConsoleMode
GetTickCount
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
HeapSize
SetStdHandle
LCMapStringW
LCMapStringA
GetCurrentDirectoryA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
InterlockedDecrement
InterlockedIncrement
TlsFree
RtlUnwind
HeapFree
GetModuleHandleA
ExitProcess
DeleteFileA
WideCharToMultiByte
RaiseException
GetCommandLineA
HeapAlloc
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
MoveFileA
GetSystemTimeAsFileTime
RemoveDirectoryA
FileTimeToSystemTime
GetDriveTypeA
GetTimeFormatA
GetDateFormatA
GetFullPathNameA
ExitThread
SetConsoleCtrlHandler
GetTimeZoneInformation
GetFileInformationByHandle
TlsGetValue
TlsAlloc
TlsSetValue

user32

GetDesktopWindow
GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW

gdi32

CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
GetObjectA
BitBlt
GetBitmapBits
DeleteObject
DeleteDC
CreateDCA

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
LookupPrivilegeValueA
GetTokenInformation
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
LogonUserA
ImpersonateLoggedOnUser
RevertToSelf
RegisterServiceCtrlHandlerA
SetServiceStatus
ControlService
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
CloseServiceHandle
OpenSCManagerA
StartServiceCtrlDispatcherA

shell32

SHFileOperationA

ole32

CoCreateGuid
StringFromGUID2
CoInitialize
CoUninitialize

winmm

timeGetTime

Exports

Exports

AGArrayAppend
AGArrayAppendArray
AGArrayAppendIfAbsent
AGArrayCount
AGArrayElementAt
AGArrayEnsureCapacity
AGArrayFinalize
AGArrayFree
AGArrayIndexOf
AGArrayInit
AGArrayInsertAt
AGArrayLastIndexOf
AGArrayNew
AGArrayRemoveAll
AGArrayRemoveAt
AGArrayReplaceAt
AGArraySetCallbacks
AGCollectionCallbacksInit
AGPtrHash
AGStrCmp
AGStrHash

Sections

.text
Size: 672KB - Virtual size: 670KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c9d1ee7d8a0374629ce185e274ddb577

Headers

File Characteristics

Imports

wtsapi32

shlwapi

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

Exports

Exports

Sections

.text Size: 672KB - Virtual size: 670KB

.rdata Size: 192KB - Virtual size: 188KB

.data Size: 72KB - Virtual size: 121KB

.rsrc Size: 48KB - Virtual size: 52KB

.text
Size: 672KB - Virtual size: 670KB

.rdata
Size: 192KB - Virtual size: 188KB

.data
Size: 72KB - Virtual size: 121KB

.rsrc
Size: 48KB - Virtual size: 52KB