bf91b2eaa4051fed8f910128dfc1d15496345f302dfed8b7f658b56105b6da3d

Sharing

Copy URL Twitter E-mail

General

Target

bf91b2eaa4051fed8f910128dfc1d15496345f302dfed8b7f658b56105b6da3d
Size

214KB
MD5

06f110289f0ff45adaa42bd8bc2f400c
SHA1

26ff4b4c6795e5e680cf057dabc4a80eca3fb26b
SHA256

bf91b2eaa4051fed8f910128dfc1d15496345f302dfed8b7f658b56105b6da3d
SHA512

8bc364ad492e63f6d1577050549a578a6f6aaf4ac4fec9ae4e73abcf3e5c2581ba224a89ea8454d01fbbe32ba02a0622f815bcf6e88f8571526f6dc558736b83
SSDEEP

6144:1zZo6vIxcAGYS3fa/HmuB3CeWVNI4tS2u:BB1AY3MHzB3C/N1S2

Score

N/A

Malware Config

Signatures

Files

bf91b2eaa4051fed8f910128dfc1d15496345f302dfed8b7f658b56105b6da3d
.dll windows x86

738892ed1f96fa712c8d4d13d4a49825

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

kernel32

CreateProcessW
GetCurrentProcess
SetFileAttributesW
SetLastError
GetSystemInfo
RemoveDirectoryW
lstrcmpW
MoveFileW
MoveFileExW
MultiByteToWideChar
UnmapViewOfFile
GetShortPathNameW
GetModuleFileNameW
GetSystemDirectoryW
MapViewOfFile
CreateFileMappingW
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryW
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrcatW
lstrlenW
lstrcpyW
GetVersionExW
Sleep
WaitForSingleObject
GetExitCodeProcess
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
GetPrivateProfileStructW
GetPrivateProfileStringW
WritePrivateProfileStructW
WritePrivateProfileStringW
CreateFileW
DeleteFileW
GetCurrentThread
CloseHandle
GetFileAttributesW
OutputDebugStringW
CreateDirectoryW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
lstrcpynW

msvcrt

wcscpy
_adjust_fdiv
_initterm
memmove
wcsrchr
strtol
_except_handler3
swprintf
wcstoul
wcsncmp
_wcsnicmp
realloc
_snwprintf
wcschr
wcslen
iswctype
_wcsicmp
wcscmp
malloc
wcstol
free

ntdll

RtlNtStatusToDosError
RtlFreeUnicodeString
RtlNtPathNameToDosPathName
RtlInitUnicodeString
RtlpEnsureBufferSize

setupapi

SetupQueueDeleteW
pSetupSetQueueFlags
SetupSetDirectoryIdW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupPromptForDiskW
SetupGetStringFieldW
SetupGetIntField
SetupFindNextLine
SetupFindFirstLineW
SetupCloseInfFile
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupFindNextMatchLineW
SetupGetFieldCount
SetupDiGetActualSectionToInstallW
SetupOpenInfFileW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupPromptReboot
SetupDefaultQueueCallbackW
SetupQueryInfFileInformationW
SetupGetInfInformationW
SetupGetFileCompressionInfoW
SetupQueueCopyW
SetupQueueRenameW
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupCommitFileQueueW
SetupScanFileQueueW
SetupInstallFilesFromInfSectionW
SetupInitDefaultQueueCallbackEx
SetupOpenFileQueue
SetupOpenAppendInfFileW
SetupGetLineCountW
pSetupGetQueueFlags

advapi32

RegDeleteValueW
OpenThreadToken
AccessCheck
FreeSid
RevertToSelf
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
ImpersonateSelf
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW

user32

wvsprintfW
CharNextW
GetUserObjectInformationW
GetProcessWindowStation
CharPrevW
ExitWindowsEx

ole32

CoTaskMemFree
StringFromGUID2
IIDFromString
StringFromIID

Exports

Exports

DoInstall
DoInstallA
DoInstallW
DoUninstall
DoUninstallA
DoUninstallW
DriverInstallComponents
InstallComponentA
InstallComponentW
InstallInfSectionA
InstallInfSectionW
IsInteractiveWindowStation
IsUserAdmin
ProxyRemoteInstall
ProxyRemoteInstallA
ProxyRemoteInstallW
UninstallComponent

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

738892ed1f96fa712c8d4d13d4a49825

Headers

File Characteristics

Imports

kernel32

msvcrt

ntdll

setupapi

advapi32

user32

ole32

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 40KB

.data Size: 168KB - Virtual size: 168KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 41KB - Virtual size: 40KB

.data
Size: 168KB - Virtual size: 168KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB