1ef97c2cb6fd8809113d7291476efe034719bb1954d3255b1dfe77744db75fb2

Sharing

Copy URL Twitter E-mail

General

Target

1ef97c2cb6fd8809113d7291476efe034719bb1954d3255b1dfe77744db75fb2
Size

251KB
MD5

0ea844a4764c9acede29d576fcf8ef68
SHA1

c99a78f7bd391756288466dc454142d150694527
SHA256

1ef97c2cb6fd8809113d7291476efe034719bb1954d3255b1dfe77744db75fb2
SHA512

c7a14e743717a513e9e6a64d4c30cd193fe18325d56c5ec371cdabf152b7fec2583d70ec8d16dc07eeba8d403d602bcd405ecce3119f59be2738eef98e4b9886
SSDEEP

6144:M04yWvcstPkpZZAJrc0lTmgVP+niDAVPLxeniDAVPLyKI3Qy:8JbJk3ZABzTNVP+niDAVPLxeniDAVPLK

Score

N/A

Malware Config

Signatures

Files

1ef97c2cb6fd8809113d7291476efe034719bb1954d3255b1dfe77744db75fb2
.exe windows x86

c8a1f0373db0e348b97ef0598d8a73e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
FlushFileBuffers
VirtualFree
HeapFree
HeapCreate
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
SetEndOfFile
GetProcessHeap
ReadFile
GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
GetTempPathA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
CreateMutexA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
GetFileAttributesExA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
InitializeCriticalSectionAndSpinCount
WriteFile
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetStartupInfoA
HeapValidate
IsBadReadPtr
GetProcAddress
TlsGetValue
GetModuleHandleW
TlsAlloc

user32

wsprintfA
GetClassLongA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathGetArgsA
PathFileExistsA
PathIsDirectoryA
PathRemoveBlanksA
PathFindFileNameA

ws2_32

closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
recv
send

netapi32

Netbios

comsvcs

RecycleSurrogate
CoEnterServiceDomain

crypt32

CertSerializeCertificateStoreElement
CertAddEncodedCertificateToSystemStoreA
CertRDNValueToStrA
CryptSetKeyIdentifierProperty
CryptMsgCountersignEncoded
CryptMsgClose
CryptMsgOpenToDecode
CertStrToNameW
CertEnumSystemStore
CryptDecodeObjectEx
CertGetValidUsages
CertSetCertificateContextProperty
CertFreeCertificateChain
CryptDecodeObject
PFXImportCertStore
CertFindCTLInStore
CryptHashPublicKeyInfo
CryptFindCertificateKeyProvInfo
CertOIDToAlgId
CryptExportPublicKeyInfoEx
CertDuplicateCertificateContext
CertFindCRLInStore
CertRemoveEnhancedKeyUsageIdentifier
CertSetCertificateContextPropertiesFromCTLEntry

imm32

ImmDisableTextFrameService
ImmConfigureIMEW
ImmGetCompositionWindow
ImmGetGuideLineA
ImmConfigureIMEA
ImmUnregisterWordA
ImmInstallIMEA
ImmGetCompositionStringA
ImmSetCandidateWindow
ImmGetRegisterWordStyleW
ImmGetDescriptionA
ImmAssociateContext
ImmGetConversionListA
ImmGetCompositionFontW
ImmIsUIMessageW
ImmGetCandidateListW
ImmCreateContext
ImmEscapeW

iphlpapi

GetBestInterfaceEx

msi

ord83
ord263
ord268
ord228
ord7
ord237
ord95
ord37
ord96
ord209
ord15
ord59
ord245
ord231
ord94
ord274
ord243
ord249
ord130
ord189
ord256
ord168
ord155
ord193
ord16
ord190
ord273

msimg32

AlphaBlend

mswsock

GetAcceptExSockaddrs
TransmitFile
AcceptEx

Sections

.text
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8a1f0373db0e348b97ef0598d8a73e3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

ws2_32

netapi32

comsvcs

crypt32

imm32

iphlpapi

msi

msimg32

mswsock

Sections

.text Size: 166KB - Virtual size: 166KB

.rdata Size: 62KB - Virtual size: 62KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 166KB - Virtual size: 166KB

.rdata
Size: 62KB - Virtual size: 62KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 17KB - Virtual size: 16KB