70b94f5b4c7b450f6b8fda2fd6c0b94d019927beb5f1841a58ab7171e2a40c21

Sharing

Copy URL Twitter E-mail

General

Target

70b94f5b4c7b450f6b8fda2fd6c0b94d019927beb5f1841a58ab7171e2a40c21
Size

174KB
MD5

e4eb9a31334bdae6e62e0ef910920955
SHA1

1b9b2bf495fb730a65af0f5775d8895cb65de26a
SHA256

70b94f5b4c7b450f6b8fda2fd6c0b94d019927beb5f1841a58ab7171e2a40c21
SHA512

cfd8fdd4423c60cef8aa974757936f70c84be2470bb217b557d1e6265a5d297e9de3181eb3660b6925f6652ad20dbc88592c196187101612ae456c792ee7cc7f
SSDEEP

3072:KZ/LhS0rKgHq+rFLIwgoovufDUbZWYIWJkDfw5Se:+/LhS0rKE/FLITo9mLIWWDfG

Score

N/A

Malware Config

Signatures

Files

70b94f5b4c7b450f6b8fda2fd6c0b94d019927beb5f1841a58ab7171e2a40c21
.exe windows x86

edf0659abd5188c18e493cb2537cb8d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
CreateFileW
GetFileSizeEx
FindNextFileW
DeleteFileW
SetFileAttributesW
GetVolumeNameForVolumeMountPointW
HeapReAlloc
HeapCompact
HeapAlloc
HeapFree
HeapCreate
SetLastError
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetVersionExW
LocalAlloc
LocalFree
CreateNamedPipeW
GetCommandLineW
CreateMutexW
GetDriveTypeW
FileTimeToSystemTime
OpenMutexW
ReleaseMutex
GetVolumeInformationW
ExpandEnvironmentStringsW
GetFileSize
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GlobalLock
GlobalUnlock
lstrcpynA
lstrcmpiA
SetCurrentDirectoryW
FindVolumeClose
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindNextVolumeMountPointW
GetCurrentDirectoryW
FindVolumeMountPointClose
FindFirstVolumeMountPointW
GetFileAttributesW
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
FindFirstVolumeW
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetStringTypeW
LCMapStringW
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetSystemWow64DirectoryW
GetSystemDirectoryW
WriteFile
SetFileTime
SetFilePointer
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
lstrcpyA
GetSystemTime
LoadLibraryW
GetLocalTime
FindClose
MoveFileW
SetThreadPriority
lstrcmpW
GetACP
FreeConsole
CopyFileW
GetCurrentThread
GetTickCount
GetModuleHandleW
SleepEx
SystemTimeToFileTime
SetUnhandledExceptionFilter
CreateProcessW
FreeLibrary
SetErrorMode
lstrlenA
FindFirstFileW
ExitProcess
GetCurrentProcess
GetExitCodeThread
ExitThread
CreateThread
CloseHandle
TerminateThread
WaitForSingleObject
Sleep
lstrcpyW
GetWindowsDirectoryW
lstrcatW
GetTempPathW
lstrlenW
GetModuleFileNameW
GetComputerNameW
GetEnvironmentVariableW
GetLastError
MultiByteToWideChar
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
GetCPInfo
HeapSize
RaiseException
IsProcessorFeaturePresent
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
EncodePointer
IsBadReadPtr
lstrcmpiW
GetProcAddress
lstrcpynW
GetOEMCP

user32

ShowWindow
SetWindowLongW
PeekMessageW
GetWindowTextW
GetAsyncKeyState
RegisterRawInputDevices
RegisterClassExW
GetKeyboardState
GetRawInputData
PostQuitMessage
CreateWindowExW
DefWindowProcW
GetWindowThreadProcessId
ToUnicodeEx
DispatchMessageW
GetKeyboardType
wsprintfW
GetKeyboardLayout
wsprintfA
GetMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
OpenClipboard
GetClipboardData
CloseClipboard
GetForegroundWindow
GetKeyboardLayoutNameW
CharLowerW

advapi32

CryptGenRandom
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
LookupAccountSidA
QueryServiceStatus
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
CryptGetHashParam
SetEntriesInAclW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegEnumValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
GetTokenInformation
OpenThreadToken
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
GetUserNameW
ChangeServiceConfigW
StartServiceW
OpenServiceW
OpenSCManagerW
CryptAcquireContextW
OpenProcessToken

shell32

ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathW

ole32

CoInitializeSecurity
CoUninitialize
CoInitialize
IIDFromString
CoTaskMemFree
StringFromIID
CoCreateInstance

oleaut32

VariantChangeType
VariantInit
SysAllocString
VariantClear

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

secur32

GetComputerObjectNameW

wininet

InternetGetConnectedState
InternetGetLastResponseInfoW

ws2_32

WSAStartup
WSACleanup

shlwapi

PathAppendW
PathFindExtensionW
StrStrA
PathAddBackslashW
PathRemoveFileSpecW

crypt32

CryptUnprotectData

mpr

WNetCancelConnectionW
WNetAddConnection2W

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

edf0659abd5188c18e493cb2537cb8d9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

rpcrt4

wtsapi32

secur32

wininet

ws2_32

shlwapi

crypt32

mpr

Sections

.text Size: 119KB - Virtual size: 119KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 12KB - Virtual size: 48KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 119KB - Virtual size: 119KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 12KB - Virtual size: 48KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 11KB - Virtual size: 10KB