7a952fbea75bf0f553116070612add6a2439c0c2501cd713005dc8192979ee92

Sharing

Copy URL Twitter E-mail

General

Target

7a952fbea75bf0f553116070612add6a2439c0c2501cd713005dc8192979ee92
Size

204KB
MD5

005c376d06424cf81e9cd3a167faca61
SHA1

bb19e2bbd0e220eacab634ea75d63f15450c5f4d
SHA256

7a952fbea75bf0f553116070612add6a2439c0c2501cd713005dc8192979ee92
SHA512

149fbe205a9c30082c8abcf37c18b2a62895bff0d1b038d745c9b94ddcad6d73ec4582aab6ad6471fb94de558344f504e5de5d74eb0be4019c87e33822eade8e
SSDEEP

6144:QRhqqDLoRj+aqNC1+LO4X41gGIKfoseLroiPlmJiyI1tvyeM:QRcqnoRj+aqso/41ZarvqiyAtaeM

Score

N/A

Malware Config

Signatures

Files

7a952fbea75bf0f553116070612add6a2439c0c2501cd713005dc8192979ee92
.exe windows x86

bf82b30002461e76756d3acf3743458e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
GetComputerNameW
GetVersionExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
WriteProcessMemory
GetNativeSystemInfo
IsBadReadPtr
GetModuleHandleA
FlushFileBuffers
CreateRemoteThread
OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
GetLogicalDriveStringsW
HeapFree
GetProcessHeap
SetFileTime
UnmapViewOfFile
Thread32First
WideCharToMultiByte
ReadProcessMemory
GetCommandLineW
HeapCreate
lstrcpynW
Thread32Next
GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
QueryDosDeviceW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
MapViewOfFile
CreateMutexW
CreateThread
GetFileAttributesExW
GetProcessId
VirtualFreeEx
SetThreadContext
GetThreadContext
ExitProcess
GetUserDefaultUILanguage
GetCurrentProcess
CreatePipe
ReadFile
WriteFile
SetHandleInformation
CreateProcessW
SetFileAttributesW
WTSGetActiveConsoleSessionId
lstrcmpiA
CreateFileW
CreateDirectoryW
GetModuleHandleW
TlsFree
TlsAlloc
HeapDestroy
CreateFileMappingW
GetModuleFileNameW
GetFileAttributesW
Sleep
MoveFileExW
VirtualAlloc
VirtualFree
GetCurrentThreadId
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
TlsGetValue
GlobalUnlock
GlobalLock
ResetEvent
EnterCriticalSection
SetLastError
GetLastError
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSection
SetEvent
ExpandEnvironmentStringsW
LocalFree
GetPrivateProfileIntW
LoadLibraryW
GetPrivateProfileStringW
lstrcmpiW
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemTime
ReleaseMutex
CloseHandle
WaitForMultipleObjects
CreateEventW
GetLocalTime
ExitThread
GetTickCount
VirtualQueryEx

user32

DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
GetUserObjectInformationW
CallWindowProcA
EndMenu
CallWindowProcW
DefFrameProcW
RegisterClassA
GetShellWindow
GetMessageA
GetMenuState
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
GetSubMenu
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
EndPaint
GetClassNameW
SystemParametersInfoW
TrackPopupMenuEx
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
CharLowerBuffA
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
MessageBoxA
GetKeyboardLayoutList
ExitWindowsEx
CharToOemW
RegisterWindowMessageW
RegisterClassExA
GetThreadDesktop
GetMenuItemID
GetWindowRect
SetKeyboardState
GetUpdateRgn
GetMessageW
GetWindowDC
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
GetMenu
FillRect
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
GetDC
IntersectRect
GetDCEx
ReleaseDC
PostThreadMessageW
EqualRect
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
MapVirtualKeyW
PostMessageW
TranslateMessage
RegisterClassExW
SendMessageTimeoutW
GetMenuItemRect
GetKeyboardState
GetClipboardData
ToUnicode
DrawIcon
GetIconInfo
GetCursorPos
CharLowerW
GetSystemMetrics
SetCapture

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
CreateProcessAsUserA
CreateProcessAsUserW
EqualSid
InitiateSystemShutdownExW
IsWellKnownSid
GetLengthSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
RegCreateKeyW
RegEnumKeyW
RegQueryValueExW
RegQueryInfoKeyW
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData

shlwapi

SHDeleteValueW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
StrStrIA
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathQuoteSpacesW
PathRemoveBackslashW
PathIsURLW
StrCmpNIW
PathRenameExtensionW
StrStrIW
PathRemoveFileSpecW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

SelectObject
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
GdiFlush
DeleteDC
SetViewportOrgEx
GetDeviceCaps
CreateCompatibleBitmap
GetDIBits
CreateDIBSection
DeleteObject

ws2_32

WSAGetLastError
send
gethostbyname
closesocket
WSASend
getaddrinfo
freeaddrinfo
recv
sendto
inet_addr
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
WSAEventSelect
getsockname
accept
recvfrom
getpeername
listen
WSASetLastError
socket
bind
select

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore

wininet

InternetReadFileExA
InternetReadFile
HttpSendRequestW
GetUrlCacheEntryInfoW
HttpOpenRequestA
InternetSetOptionA
InternetQueryOptionW
InternetOpenA
InternetCrackUrlA
InternetSetStatusCallbackA
InternetConnectA
InternetQueryOptionA
InternetCloseHandle
HttpEndRequestW
HttpSendRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
InternetQueryDataAvailable
HttpAddRequestHeadersW
HttpSendRequestExA
HttpQueryInfoA
HttpSendRequestExW
InternetSetStatusCallbackW

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf82b30002461e76756d3acf3743458e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 192KB - Virtual size: 192KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 192KB - Virtual size: 192KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 7KB