a4a5baf4005e46640695077642f2e54be32ff208e15efbc26cf0e3b058ec9295

Sharing

Copy URL

Twitter E-mail

General

Target

a4a5baf4005e46640695077642f2e54be32ff208e15efbc26cf0e3b058ec9295
Size

734KB
MD5

3cec354e376e0fa2605ccc9cbc55c670
SHA1

19c13f63eb88839d74f1aee3b0ca26cd4879d082
SHA256

a4a5baf4005e46640695077642f2e54be32ff208e15efbc26cf0e3b058ec9295
SHA512

875e7d50197100c36b098bb47eb52e579c52ab9b170b10e569a4876b8d8d06c2fa48520beec8ce69dccc12b7fd0f448c94d46644a56ad68c28f978f46b132f90
SSDEEP

12288:YpzMysLA6C747zsPJT14P5QnJe6BKRcVowpiHOizwFMqPks4+5p8GpKeVrwulSbc:dLhTiB14P5QnJenRcuwMHJz6Mzsd5KGt

Score

N/A

Malware Config

Signatures

Files

a4a5baf4005e46640695077642f2e54be32ff208e15efbc26cf0e3b058ec9295
.exe windows x86

4237c14906c9d06eb0369ec5833058b9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

CreateFileW
SetEnvironmentVariableA
CompareStringW
SetStdHandle
SetFilePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
MultiByteToWideChar
LCMapStringW
RtlUnwind
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
HeapFree
HeapQueryInformation
HeapSize
HeapReAlloc
GetTimeZoneInformation
RaiseException
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteFileA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
EncodePointer
SuspendThread
LocalFree
CloseHandle
FindFirstChangeNotificationA
GetModuleHandleA
GetSystemInfo
GlobalMemoryStatusEx
LockResource
LocalAlloc
GetConsoleScreenBufferInfo
LoadLibraryA
GetTempFileNameA
SetFileAttributesA
GetProcAddress
GetLastError
GetStdHandle
lstrcatA
SizeofResource
Sleep
LoadLibraryW
ExitProcess
FindResourceExA
OpenProcess
FormatMessageA
ExpandEnvironmentStringsA
GetComputerNameW
FindCloseChangeNotification
WaitForSingleObject
GetCurrentProcess
HeapAlloc
LoadResource
lstrlenA
CreateFileA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsBadReadPtr
HeapValidate
IsProcessorFeaturePresent
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetModuleHandleW
DecodePointer
InterlockedDecrement
InterlockedIncrement
DeleteFileW
FillConsoleOutputCharacterA
GetExitCodeProcess

user32

SendMessageA
MoveWindow
GetWindow
CheckMenuItem
RegisterHotKey
EnumDisplayDevicesA
DialogBoxParamA
GetDlgItemTextA
LoadCursorA
SetClipboardData
LoadImageA
EndPaint
ClientToScreen
DestroyWindow
GetMessageA
CloseClipboard
GetSystemMenu
SetTimer
GetWindowRect
InsertMenuItemA
RegisterClassExA
PostQuitMessage
GetWindowDC
GetMenuItemID
KillTimer
DrawTextA
GetSubMenu
SetWindowTextA
IsClipboardFormatAvailable
GetParent
LoadIconA
wsprintfA
GetClientRect
LoadStringA
BeginPaint
GetClassInfoW
GetDC
TranslateMessage
GetMenu
MessageBoxA
InvalidateRect
GetWindowLongA
CreateWindowExA
EmptyClipboard
GetDlgItem
EndDialog
DefWindowProcA
SendDlgItemMessageW
GetMenuItemInfoA
LoadAcceleratorsA
IsDlgButtonChecked
IsWindow
DispatchMessageA
CheckRadioButton
MessageBoxW
RegisterClassW

gdi32

BitBlt
SetTextColor
DeleteDC
GetDeviceCaps
CreateFontIndirectA
CreateDCA
CreateDCW
DeleteObject
SelectObject
CreateCompatibleDC
CombineRgn
EnumFontFamiliesA
CreateRectRgn
GetFontData
GetObjectA
GetStockObject
GetTextColor

comdlg32

GetFileTitleA
FindTextW
ChooseFontA
FindTextA
ReplaceTextA

advapi32

CryptEnumProviderTypesA
ReadEventLogA
CredEnumerateA
GetOldestEventLogRecord
OpenEventLogW

shell32

SHGetFolderPathA
SHGetFolderPathW
DragQueryFileA
DragFinish

psapi

GetModuleFileNameExA
EnumProcessModules
GetModuleBaseNameA
GetProcessMemoryInfo

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

shlwapi

PathAppendA
StrStrW

comctl32

ord17

uxtheme

DrawThemeBackground

msi

ord64
ord121
ord124
ord17
ord103
ord8

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tada
Size: 391KB - Virtual size: 390KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hot
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4237c14906c9d06eb0369ec5833058b9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

psapi

version

shlwapi

comctl32

uxtheme

msi

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 5KB - Virtual size: 13KB

.tada Size: 391KB - Virtual size: 390KB

.hot Size: 8KB - Virtual size: 8KB

.rsrc Size: 108KB - Virtual size: 107KB

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 5KB - Virtual size: 13KB

.tada
Size: 391KB - Virtual size: 390KB

.hot
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 108KB - Virtual size: 107KB