9e4abf028cf4238a9de773ff7d9d91182bfeb034dc6245de78319787fc93885b

Sharing

Copy URL Twitter E-mail

General

Target

9e4abf028cf4238a9de773ff7d9d91182bfeb034dc6245de78319787fc93885b
Size

370KB
MD5

152c4bb403cb8a3f35385add405cd956
SHA1

b4ab7940bb7f0ba87476d269377bc84bb3b05492
SHA256

9e4abf028cf4238a9de773ff7d9d91182bfeb034dc6245de78319787fc93885b
SHA512

17f7a753d22523bef13bfedd02a4bb024d725114b48dafc27f5f8bfda280b365ab72c76ae9e2de141f6285e1d0eb5e9a8f940063d323f47d5304e829e0205e04
SSDEEP

6144:RiOEoGJG0iVjKl5a6fjGlGjpGeHiuOPz5jsIE2//2UkxeSu2qC/wqmE21g4u1k:RDEhc/s5VjRpGTzljo2/SeSu2qbEd

Score

N/A

Malware Config

Signatures

Files

9e4abf028cf4238a9de773ff7d9d91182bfeb034dc6245de78319787fc93885b
.exe windows x86

de167be0dda15eafa7eb391232b2311a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

setsockopt
WSAIoctl
connect
WSCEnumProtocols
getprotobyname
WSASendDisconnect
recv
getservbyname
getprotobynumber
inet_addr
WSACreateEvent
WSCDeinstallProvider
WSALookupServiceNextW
socket
getaddrinfo
WSAConnect
WSAAsyncGetHostByName
WSAAsyncSelect
WSAAsyncGetHostByAddr
WSAGetServiceClassInfoA
WSAGetOverlappedResult
WSCWriteProviderOrder
WSARecvDisconnect
accept
WSAEnumNameSpaceProvidersW
WSAAsyncGetServByName
WSASendTo
ioctlsocket
WSASetBlockingHook
WSACancelBlockingCall
select
WSApSetPostRoutine
WSAHtons
closesocket
WSALookupServiceBeginW
WSAStringToAddressA
WSALookupServiceBeginA
listen
gethostbyname
__WSAFDIsSet
WSAEnumNetworkEvents

kernel32

SetNamedPipeHandleState
ConnectNamedPipe
SetTapeParameters
WriteConsoleOutputA
DnsHostnameToComputerNameA
GetProfileStringW
WriteConsoleOutputCharacterW
GetConsoleCP
GetLogicalDriveStringsA
GlobalUnfix
GetCommConfig
QueryInformationJobObject
CreateDirectoryA
SetCalendarInfoA
GetEnvironmentStringsA
ScrollConsoleScreenBufferA
OpenWaitableTimerA
WaitForDebugEvent
SetMessageWaitingIndicator
TermsrvAppInstallMode
GetACP
GlobalAlloc
ClearCommBreak
GetExitCodeProcess
HeapSummary
GetTempPathW
GetConsoleWindow
IsWow64Process
ReadProcessMemory
GetDiskFreeSpaceExA
VirtualUnlock
GetCommandLineA
SetCommTimeouts
CreateHardLinkW
GlobalCompact
_hwrite
LoadLibraryA
SetLastError
GetDateFormatA
VirtualAlloc
VirtualLock
GetCurrentThread
DnsHostnameToComputerNameW
DeviceIoControl
GetConsoleScreenBufferInfo

advapi32

WmiExecuteMethodW
ElfReadEventLogA
LogonUserExA
GetSidLengthRequired
GetExplicitEntriesFromAclA
ConvertSecurityDescriptorToStringSecurityDescriptorW
CryptSetProviderExA
GetSidIdentifierAuthority
CredWriteA
LookupAccountSidA
WmiNotificationRegistrationA
OpenEncryptedFileRawA
CryptDestroyKey
CryptEnumProviderTypesA
LsaQueryForestTrustInformation
AllocateAndInitializeSid
RegOpenKeyA
GetAuditedPermissionsFromAclA
GetSecurityDescriptorGroup
SaferiCompareTokenLevels
CloseEncryptedFileRaw
ConvertAccessToSecurityDescriptorA
SystemFunction003
SystemFunction034
LsaGetQuotasForAccount
AdjustTokenGroups
LsaNtStatusToWinError
QueryTraceW
OpenServiceA
QueryServiceConfig2W
LsaOpenTrustedDomain
GetServiceDisplayNameA
FileEncryptionStatusA
CryptGenKey
GetSidSubAuthorityCount
CryptVerifySignatureA
OpenBackupEventLogW
I_ScSetServiceBitsA
OpenThreadToken
RegLoadKeyA
GetTokenInformation

msvcrt40

?str@strstream@@QAEPADXZ
__p__wcmdln
_fcloseall
_get_osfhandle
isalnum
_ismbcalpha
_fmode
atol
_wcsnset
_wsetlocale
sprintf
fgetpos
_wrename
?clog@@3Vostream_withassign@@A
?lockptr@ios@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
_ctype
__p__mbctype
strtok
?delbuf@ios@@QBEHXZ
_stati64
?pbackfail@streambuf@@UAEHH@Z
??6ostream@@QAEAAV0@F@Z
_wremove
?fd@ifstream@@QBEHXZ
_makepath

sqlwoa

_LoadIcon@8
_GetComputerName@8
_CreateDialogIndirectParam@20
_CreateFont@56
_SetWindowText@8
_LoadCursor@8
_SetProp@12
_MoveFile@8
_GetFileTitle@12
_SendMessage@16
newWideCharFromMultiByte
_LoadBitmap@8
_trename
_SetDlgItemText@12
_CreateFontIndirect@4
_SendDlgItemMessage@20
_SetWindowLong@12
_WinHelp@16
_FreeEnvironmentStrings@4
_CharUpper@4
newMultiByteFromWideCharEx
_GetSaveFileName@4
ConvertMultiSZNameToW
_ExtTextOut@32
_tsystem
_GetTextExtentPoint@16
_GetProp@8
_GetClassInfo@12
_GetTextMetrics@8
_GetVersionEx@4
_GetDiskFreeSpaceEx@16
_CreateWindowEx@48

msvcrt

_mbscspn
??0bad_typeid@@QAE@ABV0@@Z
_filelength
__iscsym
_ismbcl2
_wunlink
setbuf
exp
??0bad_cast@@QAE@ABQBD@Z
fseek
sscanf
_mbsnbcoll
_endthread
_mbsnextc
_spawnve
_setjmp3
_aligned_realloc
??8type_info@@QBEHABV0@@Z
_scalb
_wfindnexti64
__crtGetStringTypeW
_j0
?unexpected@@YAXXZ
_pclose
_wpopen
??1exception@@UAE@XZ
vfprintf
puts
_ftime
_wmakepath
__CxxUnregisterExceptionObject
_wtmpnam
_mbctolower

cscdll

CSCFindFirstFileW
CSCTransitionServerOnlineW
CSCDeleteW
CSCFindFirstFileForSidW
CSCDoEnableDisable
CSCQueryFileStatusW
CSCPinFileW
CSCFindClose
CSCSetMaxSpace
CSCFindNextFileW
CSCEnumForStatsW
CSCIsServerOfflineW
CSCIsCSCEnabled
CSCEnumForStatsExW
CSCUnpinFileW

Sections

.text
Size: 105KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 163KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de167be0dda15eafa7eb391232b2311a

Headers

File Characteristics

Imports

ws2_32

kernel32

advapi32

msvcrt40

sqlwoa

msvcrt

cscdll

Sections

.text Size: 105KB - Virtual size: 108KB

.rdata Size: 163KB - Virtual size: 164KB

.data Size: 512B - Virtual size: 496KB

.rsrc Size: 99KB - Virtual size: 100KB

.reloc Size: 1024B - Virtual size: 4KB

.text
Size: 105KB - Virtual size: 108KB

.rdata
Size: 163KB - Virtual size: 164KB

.data
Size: 512B - Virtual size: 496KB

.rsrc
Size: 99KB - Virtual size: 100KB

.reloc
Size: 1024B - Virtual size: 4KB