fad3c09d76c648d18337948616409f19a4eaff36dfb47c739e50006539ac7b5d

Sharing

Copy URL Twitter E-mail

General

Target

fad3c09d76c648d18337948616409f19a4eaff36dfb47c739e50006539ac7b5d
Size

993KB
MD5

0dc7d07b5965e3f4c3b6985d480cd030
SHA1

527017a8cc2aeb51224e75b3778a0d675d8dd9f9
SHA256

fad3c09d76c648d18337948616409f19a4eaff36dfb47c739e50006539ac7b5d
SHA512

f391e4b0439d883de55a1e824d91e9030992c7c3c6f4b281a26305ba306ca29ca04fa8ac0536eb0d7f6401ece88b84c833e938f433494d8c5c647769c7f1ee37
SSDEEP

24576:vAzR632XWxEv+YyV6y9Tn750te/9ZTARAZ:obXEEmYyVB9LOs9ZTTZ

Score

N/A

Malware Config

Signatures

Files

fad3c09d76c648d18337948616409f19a4eaff36dfb47c739e50006539ac7b5d
.exe windows x86

4376adc78a045a888b0572d42bc71bb7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
FreeLibrary
LoadLibraryExW
GlobalFree
GlobalHandle
CloseHandle
DeleteFileW
Sleep
InitializeCriticalSection
CreateMutexW
GetPrivateProfileSectionW
GetLocalTime
WriteFile
SetFilePointer
GetFileSize
CreateFileW
GetCommandLineW
GetCurrentProcessId
FindClose
FindNextFileW
FindFirstFileW
GlobalLock
SetErrorMode
ReadFile
LoadLibraryW
WideCharToMultiByte
SetEvent
RemoveDirectoryW
WaitForSingleObject
CreateEventW
CreateDirectoryW
GetTickCount
MoveFileW
ResumeThread
CreateProcessW
IsDBCSLeadByte
VirtualProtect
WriteProcessMemory
SystemTimeToFileTime
GetSystemTime
CompareStringW
SetEndOfFile
GetTimeZoneInformation
SetUnhandledExceptionFilter
GlobalUnlock
EnterCriticalSection
CompareFileTime
WinExec
GetProcessTimes
GetExitCodeProcess
WaitForMultipleObjects
GlobalMemoryStatusEx
GetSystemInfo
RaiseException
Process32NextW
Process32FirstW
MulDiv
LocalFree
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
CreateThread
ExitThread
GetSystemTimeAsFileTime
ExitProcess
GetStartupInfoW
HeapSetInformation
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
lstrcmpW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
lstrlenA
SizeofResource
GetLastError
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
GlobalAlloc
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateToolhelp32Snapshot
LeaveCriticalSection
FreeResource
WritePrivateProfileStringW
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
GetVersionExW
SetEnvironmentVariableA

user32

DestroyWindow
GetWindowLongW
ShowWindow
SetTimer
KillTimer
SendDlgItemMessageW
PtInRect
OffsetRect
IntersectRect
UnionRect
GetSystemMetrics
UnregisterClassA
SetWindowPos
MapWindowPoints
GetWindow
GetWindowRect
MonitorFromWindow
GetParent
PostMessageW
PostQuitMessage
SetWindowLongW
IsWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
DefWindowProcW
MapDialogRect
EndDialog
CreateWindowExW
SetWindowContextHelpId
FindWindowExW
EnumChildWindows
SendMessageW
GetSysColor
MoveWindow
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
GetMonitorInfoW
GetClientRect
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetDlgItem
GetClassNameW
SetActiveWindow
AnimateWindow
BringWindowToTop
SetForegroundWindow
OpenClipboard
SystemParametersInfoW
EnableWindow
IsRectEmpty
SetWindowsHookExW
CallNextHookEx
GetAncestor
UnhookWindowsHookEx
GetClassInfoW
RegisterClassW
SetPropW
GetPropW
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
RegisterClassExW
LoadCursorW
GetClassInfoExW
GetFocus
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CallWindowProcW
FillRect
ReleaseCapture

gdi32

CreateCompatibleDC
GetDeviceCaps
SelectObject
DeleteObject
DeleteDC
GetObjectW
BitBlt
CreateSolidBrush
CreateCompatibleBitmap
GetStockObject

advapi32

RegQueryValueExA
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueA
RegQueryValueW
RegDeleteKeyW
GetUserNameW

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHGetFolderPathA
SHGetSpecialFolderPathW

ole32

OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleUninitialize
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
OleLockRunning
CoTaskMemAlloc
OleRun
ProgIDFromCLSID
CoGetClassObject
StringFromGUID2
CoCreateGuid

oleaut32

VarBstrCmp
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantChangeType
VariantCopy
SysStringByteLen
SysAllocStringByteLen
DispCallFunc
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantClear
VariantInit
VarUI4FromStr
GetErrorInfo
SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString

shlwapi

PathFileExistsW
SHRegGetValueA
SHRegGetValueW
SHDeleteKeyW
PathIsDirectoryW

urlmon

ObtainUserAgentString
CoInternetGetSession
UrlMkSetSessionOption

wininet

CommitUrlCacheEntryA
InternetQueryOptionW
InternetSetOptionW
InternetSetCookieW
CommitUrlCacheEntryW
InternetErrorDlg
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetReadFile
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetCloseHandle
HttpQueryInfoW

dsound

ord1

dbghelp

ImageDirectoryEntryToDataEx
MiniDumpWriteDump

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

EnumProcessModules
GetProcessMemoryInfo

winmm

waveOutWrite
midiStreamOut
PlaySoundA
PlaySoundW

wintrust

WinVerifyTrust

crypt32

CertOpenStore

ws2_32

gethostname
gethostbyname
inet_ntoa

iphlpapi

GetAdaptersAddresses

pdh

PdhGetFormattedCounterValue
PdhCollectQueryData
PdhAddCounterW
PdhCloseQuery
PdhOpenQueryW

Sections

.text
Size: 714KB - Virtual size: 714KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4376adc78a045a888b0572d42bc71bb7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

wininet

dsound

dbghelp

version

psapi

winmm

wintrust

crypt32

ws2_32

iphlpapi

pdh

Sections

.text Size: 714KB - Virtual size: 714KB

.rdata Size: 155KB - Virtual size: 154KB

.data Size: 20KB - Virtual size: 29KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 81KB - Virtual size: 82KB

.text
Size: 714KB - Virtual size: 714KB

.rdata
Size: 155KB - Virtual size: 154KB

.data
Size: 20KB - Virtual size: 29KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 81KB - Virtual size: 82KB