f731c64db055998b569d31582e03fcf3784ff52e3f7b3ded378c8dec371116e0

Sharing

Copy URL Twitter E-mail

General

Target

f731c64db055998b569d31582e03fcf3784ff52e3f7b3ded378c8dec371116e0
Size

892KB
MD5

200cf1a1224c3607bc6319df3a40daf0
SHA1

9b8b05926f44c1d73aaf192cdafa730b84b72887
SHA256

f731c64db055998b569d31582e03fcf3784ff52e3f7b3ded378c8dec371116e0
SHA512

0ba44beea2205088ea28db7ca9eaee2d8a035dd095fbc60b54d61aecd779517c928bfbb850132211656aa8c0b9276c4f2bc0bd5d33c497d6409cfd10398db426
SSDEEP

24576:44YuKmqM5CsEcvtb0v124n8s1Y8B88y3:4ruK5cCcBy1248s1jB88

Score

N/A

Malware Config

Signatures

Files

f731c64db055998b569d31582e03fcf3784ff52e3f7b3ded378c8dec371116e0
.exe windows x86

ed8f6ddc9afa098b2c51186f66d99393

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
GetSecurityDescriptorOwner
SetNamedSecurityInfoW
ImpersonateLoggedOnUser
RevertToSelf
RegQueryInfoKeyW
RegEnumValueW
GetSecurityDescriptorDacl
RegDeleteValueW
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetUserNameW
RegGetValueW
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids

kernel32

LoadResource
LockResource
FreeResource
GetThreadPriority
SetThreadPriority
ResetEvent
FileTimeToSystemTime
GlobalFree
WaitForMultipleObjects
GetLongPathNameW
ExpandEnvironmentStringsW
VirtualFree
OpenFileMappingW
VirtualAlloc
GetCurrentThread
InitializeCriticalSectionAndSpinCount
GetSystemTime
SystemTimeToFileTime
HeapAlloc
GetProcessHeap
HeapFree
GetUserDefaultLocaleName
GetNativeSystemInfo
GetProductInfo
SetEvent
CreateThread
TerminateThread
GetExitCodeThread
GetFileAttributesExW
GetTickCount64
ReleaseMutex
CreateTimerQueueTimer
LocalAlloc
DeleteTimerQueueTimer
RaiseException
SetFilePointerEx
RemoveDirectoryA
UnlockFileEx
GetTempPathA
GetFullPathNameA
DeleteFileA
CreateFileA
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetFileAttributesA
GetLocaleInfoEx
GetTempPathW
RemoveDirectoryW
CreateMutexW
CreateEventW
GetCommandLineW
LocalFree
GetTempFileNameW
QueryFullProcessImageNameW
GetNamedPipeServerProcessId
OpenProcess
SizeofResource
WaitForSingleObject
GetComputerNameExW
CopyFileW
GetModuleFileNameW
GetFileSize
CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
UnmapViewOfFile
GetComputerNameW
GetSystemDefaultLocaleName
GetLocalTime
GetFileAttributesW
FlushFileBuffers
DeleteFileW
FindResourceW
LoadLibraryExW
CreateFileW
GetFileSizeEx
SetFilePointer
ReadFile
WriteFile
CompareFileTime
SetFileAttributesW
WerRegisterFile
GetFullPathNameW
CreateDirectoryW
MoveFileExW
GetSystemDefaultUILanguage
GetSystemDefaultLCID
WideCharToMultiByte
InterlockedIncrement
lstrlenW
CloseHandle
GetEnvironmentVariableW
FindNextFileW
FindFirstFileW
FindClose
GetVersionExW
GetModuleHandleW
GetSystemInfo
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
InterlockedDecrement
GetLastError
SetLastError
FindAtomW
CompareStringW
GetThreadUILanguage
GlobalMemoryStatusEx
GetProcAddress
LoadLibraryW
DuplicateHandle
FreeLibraryAndExitThread
OpenMutexW
CreateNamedPipeW
FreeLibrary
DeleteCriticalSection
SetDllDirectoryW

user32

MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
GetSystemMetrics
SetProcessDefaultLayout
PostMessageW
SendMessageW
LoadStringW
TranslateMessage

msvcr90

_cexit
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__getmainargs
_amsg_exit
??_V@YAXPAX@Z
_CxxThrowException
??2@YAPAXI@Z
_purecall
__CxxFrameHandler3
memcpy
memset
realloc
malloc
free
_vsnwprintf
_vsnprintf
??3@YAXPAX@Z
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
wcsstr
rand_s
strcpy_s
sprintf_s
isspace
isprint
wcstok_s
wcstoul
wcschr
_wcsnicmp
_wcsicmp
towupper
wcsrchr
ceil
_wtoi
qsort
iswspace
memmove
??_U@YAPAXI@Z
exit
_ismbblead
_XcptFilter
_exit
towlower
_lock

shell32

ord165
SHCreateDirectoryExW
SHGetFolderPathAndSubDirW
SHGetKnownFolderPath
ShellExecuteW
CommandLineToArgvW
ord43
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoUninitialize

oleaut32

SysFreeString
SysAllocString
SysStringLen

uxcore

?Class@Combobox@DirectUI@@2PAUIClassInfo@2@A
?Click@Button@DirectUI@@2PAEA
?GetTopHWNDParent@DirectUI@@YGPAUHWND__@@PAU2@H@Z
?StrToID@DirectUI@@YGGPB_W@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?GetSelectedString@Combobox@DirectUI@@QAEPA_WPAPAVValue@2@@Z
?IDProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?LayoutPosProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?CreateInt@Value@DirectUI@@SGPAV12@W4Flags@DuiValueFlags@@H@Z
?ParentProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?_ZeroRelease@Value@DirectUI@@AAEXXZ
?Class@HWNDElement@DirectUI@@2PAUIClassInfo@2@A
UXCoreInitThread
UXCoreInitProcess
?RMLoadStringBSTR@@YGPA_WPBDIK@Z
?InsertString@Combobox@DirectUI@@QAEHHPB_W@Z
?ResetContent@Combobox@DirectUI@@QAEHXZ
?CreateBool@Value@DirectUI@@SGPAV12@W4Flags@DuiValueFlags@@_N@Z
?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z
?EnabledProp@Element@DirectUI@@2PAUPropertyInfo@2@A
?RMLoadString@@YGIPBDIPA_WIK@Z
?SelectionChange@Combobox@DirectUI@@2PAEA
DuiCreateObject
??1CDUIDialog@@UAE@XZ
?DoModal@CDUIDialog@@QAEHPBDGPB_WPAUHWND__@@PAUtagPOINT@@1_N1@Z
??0CDUIDialog@@QAE@XZ
UXCoreUnInitThread
UXCoreUnInitProcess
?GetValue@Element@DirectUI@@QBEPAVValue@2@PBUPropertyInfo@2@H@Z
?RMUpdateResourceSet@@YG_NPBDPB_WK11PAUHINSTANCE__@@@Z
?SelectionProp@Combobox@DirectUI@@2PAUPropertyInfo@2@A

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrustEx
WTHelperProvDataFromStateData

secur32

GetUserNameExW

crypt32

CertVerifyCertificateChainPolicy

shlwapi

StrRChrW
PathRemoveArgsW
SHGetValueW
PathAppendW
PathUnquoteSpacesW
PathCombineW
PathIsDirectoryW
StrCmpNW
ord437
PathIsRelativeW
PathStripPathW
PathRemoveFileSpecW
PathFindExtensionW
PathFileExistsW
PathFindFileNameW
StrStrIW
PathFindFileNameA
PathFileExistsA

winhttp

WinHttpCrackUrl
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpSetStatusCallback
WinHttpTimeFromSystemTime
WinHttpSetCredentials
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryHeaders
WinHttpSetOption
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpen
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpGetProxyForUrl

cabinet

ord11
ord10
ord14
ord13

ntdll

NtQuerySystemTime
RtlFreeHeap
RtlAllocateHeap

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wer

WerReportAddFile
WerReportSubmit
WerReportCreate
WerReportCloseHandle
WerReportSetUIOption
WerReportSetParameter

Sections

.text
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 580KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ed8f6ddc9afa098b2c51186f66d99393

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcr90

shell32

ole32

oleaut32

uxcore

wintrust

secur32

crypt32

shlwapi

winhttp

cabinet

ntdll

version

wer

Sections

.text Size: 231KB - Virtual size: 231KB

.data Size: 2KB - Virtual size: 15KB

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 580KB - Virtual size: 1.8MB

.text
Size: 231KB - Virtual size: 231KB

.data
Size: 2KB - Virtual size: 15KB

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 580KB - Virtual size: 1.8MB