fa29f2584e6cf7d6779272291fa89238a376f530f019083d831398d0532b9772

Sharing

Copy URL Twitter E-mail

General

Target

fa29f2584e6cf7d6779272291fa89238a376f530f019083d831398d0532b9772
Size

1.4MB
MD5

0a5072d541f6d8baa4f0d0d64d1b73d0
SHA1

4bb4d36b9978641b23f9df996a74ecbdb69d2387
SHA256

fa29f2584e6cf7d6779272291fa89238a376f530f019083d831398d0532b9772
SHA512

759c0dae41ef83f6f1feb8a0f4206eecdaff5445b9f4b9b989407b7188fa42ca8c26252f2e7931e686c71520e215f56bfb34fddea4a7fe026fa67a8cb142a6fc
SSDEEP

24576:OAZ+wI6A/KIdWLMClkiFpbIDZ2TjfsBWjE38lMJ7yjD9lFBJvxzI6QUe6uEb4u:dYcMCSi7bIDZ2TGj8Hn9lN5zIZUe6B3

Score

N/A

Malware Config

Signatures

Files

fa29f2584e6cf7d6779272291fa89238a376f530f019083d831398d0532b9772
.exe windows x86

867538c3d7afaeab2401f0b6f569cef9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetCurrentThread
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
Sleep
FreeLibrary
InterlockedExchange
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSection
GetProcAddress
OutputDebugStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
OutputDebugStringW
ReleaseMutex
lstrcmpW
SetFilePointer
GetCurrentDirectoryW
LocalFree
GetFileAttributesW
WaitForMultipleObjects
DuplicateHandle
GetEnvironmentVariableW
FormatMessageW
InterlockedCompareExchange
VirtualQuery
GetTempPathW
GetFileAttributesExW
CopyFileW
MoveFileExW
GetFileTime
FlushFileBuffers
ReadFile
GetFileSize
CompareFileTime
FileTimeToSystemTime
GetStringTypeExW
SystemTimeToFileTime
CreateEventW
ResetEvent
LocalAlloc
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
GetVersionExW
DeviceIoControl
GlobalMemoryStatusEx
SetPriorityClass
CreateProcessW
ProcessIdToSessionId
GetSystemPowerStatus
CreatePipe
SetHandleInformation
CreateMutexW
TryEnterCriticalSection
SetEvent
lstrcpynW
GetLongPathNameW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReadProcessMemory
GetThreadLocale
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetLogicalDriveStringsW
QueryDosDeviceW
GetPrivateProfileSectionNamesW
CreateThread
GetComputerNameExW
GetSystemDefaultLangID
GetUserDefaultLangID
LoadLibraryExW
lstrlenA
GetStringTypeExA
lstrcmpA
WriteConsoleW
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetCurrentProcess
TerminateProcess
DecodePointer
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
HeapSize
FlushInstructionCache
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
GetProcessId
VirtualQueryEx
RtlCaptureContext
ReleaseSemaphore
CreateSemaphoreW
UnregisterWaitEx
QueryPerformanceFrequency
QueueUserWorkItem
GetFileSizeEx
SetStdHandle
GetConsoleMode
GetConsoleCP
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
SetLastError
DeleteFileW
CloseHandle
RemoveDirectoryW
GetLastError
CreateFileW
GetExitCodeProcess
WriteFile
WaitForSingleObject
CreateDirectoryW
SetFilePointerEx
InterlockedDecrement
GetTempFileNameW
FindNextFileW
lstrcmpiW
LockResource
FindClose
RaiseException
lstrlenW
SizeofResource
LoadResource
FindResourceW
FindResourceExW
GetLocalTime
FindFirstFileW

ole32

IIDFromString
CoGetObject
CoGetCallContext
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoRevertToSelf
CoImpersonateClient
WriteClassStm
CoSetProxyBlanket
CoRegisterPSClsid
CoTaskMemAlloc
CoTaskMemRealloc
OleSaveToStream
CoCreateInstance
CoInitializeEx
CoUninitialize
ReadClassStm

oleaut32

SafeArrayCopy
SafeArrayGetVartype
VariantInit
VariantClear
SysAllocString
LoadTypeLi
SafeArrayGetLBound
SysAllocStringLen
SafeArrayGetUBound
SafeArrayDestroy
SysStringLen
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VarUI4FromStr
SysReAllocStringLen
SafeArrayLock
SafeArrayRedim
SafeArrayUnlock
SafeArrayCreate
VarBstrCmp
SysFreeString

shell32

ShellExecuteExW
CommandLineToArgvW
SHGetFolderLocation
SHGetDesktopFolder
SHGetFolderPathW
ord680

user32

CharUpperW
CharLowerW
DestroyWindow
AllowSetForegroundWindow
DispatchMessageW
TranslateMessage
PostQuitMessage
GetMessageW
PeekMessageW
SetForegroundWindow
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
CreateWindowExW
MessageBoxW
OpenClipboard
wvsprintfW
wsprintfW
EmptyClipboard
SetClipboardData
CharNextA
CharLowerBuffA
IsWindow
LoadStringW
CharUpperBuffW
CharNextW
UnregisterClassA
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
CharLowerBuffW
CloseClipboard
KillTimer
SetTimer
RegisterClassExW
GetClassInfoExW
LoadCursorW
DefWindowProcW
SetWindowLongW
CallWindowProcW

netapi32

NetApiBufferFree
NetWkstaGetInfo
NetWkstaUserGetInfo
NetGetJoinInformation

shlwapi

StrRetToStrW
PathFindFileNameW
PathCreateFromUrlW
PathAddBackslashW
PathCanonicalizeW
PathAppendW
PathStripPathW
PathRemoveFileSpecW
SHQueryValueExW
UrlIsW
PathFindExtensionW
PathAddExtensionW
UrlCombineW
UrlEscapeW
PathIsRelativeW
PathRemoveExtensionW

advapi32

CryptAcquireContextW
CryptDestroyHash
CryptCreateHash
CryptHashData
CryptGetHashParam
ImpersonateLoggedOnUser
RegOpenCurrentUser
IsTextUnicode
DeregisterEventSource
ReportEventW
RegisterEventSourceW
TraceEvent
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
DuplicateTokenEx
ImpersonateSelf
RevertToSelf
RegQueryValueExW
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeSelfRelativeSD
GetSecurityDescriptorLength
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
AddAce
InitializeAcl
SetNamedSecurityInfoW
RegOpenKeyExW
SetSecurityDescriptorDacl
GetAclInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetAce
EqualSid
ConvertStringSidToSidW
CryptGenRandom
CryptReleaseContext
OpenThreadToken
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
GetSidIdentifierAuthority
GetSidSubAuthorityCount
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertSidToStringSidW

iphlpapi

GetIfTable

psapi

GetModuleFileNameExW
EnumProcessModules
EnumProcesses

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

userenv

UnloadUserProfile
ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW

crypt32

CryptQueryObject
CryptHashCertificate
CertDuplicateCertificateContext
CryptUnprotectData
CryptProtectData
CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertGetNameStringW

wintrust

WinVerifyTrust

Sections

.text
Size: 424KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 22KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 805KB - Virtual size: 804KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.yrdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

867538c3d7afaeab2401f0b6f569cef9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

oleaut32

shell32

user32

netapi32

shlwapi

advapi32

iphlpapi

psapi

version

userenv

wtsapi32

crypt32

wintrust

Sections

.text Size: 424KB - Virtual size: 424KB

.rdata Size: 82KB - Virtual size: 82KB

.data Size: 22KB - Virtual size: 36KB

.rsrc Size: 805KB - Virtual size: 804KB

.reloc Size: 40KB - Virtual size: 39KB

.yrdata Size: 76KB - Virtual size: 76KB

.text
Size: 424KB - Virtual size: 424KB

.rdata
Size: 82KB - Virtual size: 82KB

.data
Size: 22KB - Virtual size: 36KB

.rsrc
Size: 805KB - Virtual size: 804KB

.reloc
Size: 40KB - Virtual size: 39KB

.yrdata
Size: 76KB - Virtual size: 76KB