b9439f832699ecbae557680fbd73a2768056d655453fc17c96501a001b0208e4

Sharing

Copy URL Twitter E-mail

General

Target

b9439f832699ecbae557680fbd73a2768056d655453fc17c96501a001b0208e4
Size

209KB
MD5

21f8960dbc18b19b0375d327220e5ea0
SHA1

f5fce9a909fd6cc0efdbff90198e647a2e195848
SHA256

b9439f832699ecbae557680fbd73a2768056d655453fc17c96501a001b0208e4
SHA512

8d8d1f1af1c8f0e0eea75271d0dd0d76b973dda4e451e48c4ef4ce9364ef6f02fd28d3e6cccbb949b65b665b703c40d93194ced84e28af24c2d32f87336532a9
SSDEEP

6144:jf4qqDLwO20DqLlmBfbjqHmibNj3klOlKk8bBgksHtt438:jVqnwO20DqUBnVcxklOlKk8uta38

Score

N/A

Malware Config

Signatures

Files

b9439f832699ecbae557680fbd73a2768056d655453fc17c96501a001b0208e4
.exe windows x86

c3e0f6be3a018f995514b6dced3c274c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
Thread32First
WideCharToMultiByte
LoadLibraryW
ReadProcessMemory
HeapDestroy
HeapCreate
lstrcpynW
Thread32Next
GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
CreateFileW
FindNextFileW
VirtualProtect
GetFileTime
ReleaseMutex
CreateDirectoryW
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
GetSystemTime
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
ResetEvent
GlobalLock
GlobalUnlock
GetUserDefaultUILanguage
GetCurrentThreadId
GetLocalTime
TlsGetValue
TlsSetValue
GetModuleHandleA
WTSGetActiveConsoleSessionId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetFileAttributesW
GetPrivateProfileStringW
CreateRemoteThread
WriteProcessMemory
GetCurrentProcessId
DuplicateHandle
OpenEventW
GetModuleFileNameW
VirtualFree
GetModuleHandleW
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetPrivateProfileIntW
FileTimeToLocalFileTime
FlushFileBuffers
SetEvent
GetComputerNameW
SetErrorMode
GetCommandLineW
LocalFree
GetVersionExW
GetNativeSystemInfo
GetFileAttributesExW
GetProcessId
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
VirtualFreeEx
InitializeCriticalSection
SetThreadContext
GetThreadContext
ExitProcess
lstrcmpiA
SetThreadPriority
GetCurrentThread
FreeLibrary
WaitForMultipleObjects
CreateEventW
CreatePipe
ExitThread
ReadFile
WriteFile
SetHandleInformation
CreateProcessW
DeleteFileW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
TerminateProcess
Sleep
OpenProcess
WaitForSingleObject
MoveFileExW
lstrcmpiW
LoadLibraryA
GetProcAddress
QueryDosDeviceW

user32

DefWindowProcW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PrintWindow
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
IsWindow
ReleaseCapture
SendMessageW
CallWindowProcW
GetMessagePos
GetWindowThreadProcessId
IsRectEmpty
GetSystemMetrics
GetKeyboardState
GetClipboardData
EqualRect
PostThreadMessageW
GetDCEx
IntersectRect
GetUpdateRect
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
RegisterClassExA
DefDlgProcW
DefFrameProcA
OpenInputDesktop
RegisterClassExW
DefWindowProcA
DefMDIChildProcW
DefDlgProcA
SwitchDesktop
DefMDIChildProcA
RegisterClassW
GetWindowInfo
CallWindowProcA
ToUnicode
GetTopWindow
DefFrameProcW
RegisterClassA
EndPaint
GetUpdateRgn
GetWindowDC
FillRect
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerW
CharToOemW
GetDC
TranslateMessage
GetWindowLongW
CharLowerA
PeekMessageW
ReleaseDC
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
MapVirtualKeyW
DrawEdge
MapWindowPoints
BeginPaint
PostMessageW
ExitWindowsEx
MessageBoxA
GetKeyboardLayoutList
CharLowerBuffA
DrawIcon
GetIconInfo
GetCursorPos
GetParent

advapi32

RegCreateKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumValueW
RegCloseKey
CreateProcessAsUserA
CreateProcessAsUserW
ConvertSidToStringSidW
IsWellKnownSid
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
SetSecurityInfo
InitiateSystemShutdownExW
RegEnumKeyExW
EqualSid
RegEnumKeyW

shlwapi

PathCombineW
StrCmpNIW
StrStrIW
StrStrIA
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathAddExtensionW
PathUnquoteSpacesW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveBackslashW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

DeleteObject
GetDIBits
GetDeviceCaps
CreateDIBSection
SelectObject
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap

ws2_32

listen
send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
inet_addr
WSASend
gethostbyname
getpeername
recvfrom
WSAIoctl
connect
WSAEventSelect
getsockname
accept
sendto
setsockopt
shutdown
WSAGetLastError
select
getaddrinfo
WSAStartup
WSAAddressToStringW

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
InternetSetStatusCallbackA
HttpEndRequestW
HttpAddRequestHeadersA
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetQueryOptionW
InternetOpenA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3e0f6be3a018f995514b6dced3c274c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 196KB - Virtual size: 196KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 196KB - Virtual size: 196KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 8KB