8b40e6ee3851a2508e1a4ae67b9df3ee1ac136234fcaa37d776bb68987b7efe1

Sharing

Copy URL Twitter E-mail

General

Target

8b40e6ee3851a2508e1a4ae67b9df3ee1ac136234fcaa37d776bb68987b7efe1
Size

197KB
MD5

13030a9ae5394e034bb3a3da3456db50
SHA1

1616a7d726dbe9686355325542a90368f9311c0e
SHA256

8b40e6ee3851a2508e1a4ae67b9df3ee1ac136234fcaa37d776bb68987b7efe1
SHA512

32477f00c408a2ca813d04b76113648bcd6f1926d6da400c96990343421af57b1c434049731ad3b9a1291d75cc38e9f794ae37892fe291db7cca1c1141649201
SSDEEP

3072:G7QcSG2mc9rdc78Xp/8oqgEqxWZeZJshhIPFJRAhP2EAeNstxLzAteGvJ9gEwyrY:Bcn2mc9uWqNq040ODePszueg9qC

Score

N/A

Malware Config

Signatures

Files

8b40e6ee3851a2508e1a4ae67b9df3ee1ac136234fcaa37d776bb68987b7efe1
.exe windows x86

4e1c0afb63e6b2ddd99f11988659e9be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTokenInformation
OpenThreadToken
OpenProcessToken
AdjustTokenPrivileges

kernel32

GetModuleHandleW
LCMapStringW
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
InitializeCriticalSection
CompareStringW
FormatMessageW
CloseHandle
GetCurrentThread
GetCurrentProcess
RegisterApplicationRestart
HeapSetInformation
LocalFree
GetLastError
CreateEventW
SetEvent
SwitchToThread
GetCurrentProcessId
GetStringTypeExW
lstrlenW
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
GetVersionExW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
HeapReAlloc

user32

EndDialog
GetWindowLongW
UpdateWindow
InvalidateRect
GetWindowTextLengthW
SetWindowLongW
DestroyWindow
FindWindowExW
IsDialogMessageW
IsWindow
PeekMessageW
GetWindowThreadProcessId
EnumWindows
GetDlgCtrlID
MessageBoxW
IsDlgButtonChecked
GetDlgItem
SetDlgItemTextW
ShowWindow
CreateDialogParamW
SetFocus
DialogBoxParamW
GetFocus
SetWindowTextW
EnableWindow
SendMessageW
GetWindowTextW
CheckRadioButton
LoadStringW
SendDlgItemMessageW
MoveWindow
GetWindowRect
GetClientRect
GetDesktopWindow
PostMessageW
GetDlgItemTextW
PostQuitMessage
SetCursor
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
MsgWaitForMultipleObjects

msvcrt

__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_controlfp
atol
sscanf
_vsnprintf
memcpy
_CxxThrowException
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_wtoi
_finite
iswspace
_wtol
wcscspn
wcschr
setlocale
mbstowcs
strstr
wcsstr
qsort
_vsnwprintf
swscanf_s
memset
__CxxFrameHandler3
__p__fmode
??1type_info@@UAE@XZ

wbemcomn

??4CVar@@QAEAAV0@ABV0@@Z
?Add@CVarVector@@QAEHAAVCVar@@@Z
?Empty@CVar@@QAEXXZ
?SetVarVector@CVar@@QAEXPAVCVarVector@@H@Z
??0CVarVector@@QAE@HHH@Z
?SetBSTR@CVar@@QAEHPAG@Z
??1CVarVector@@QAE@XZ
??4CVarVector@@QAEAAV0@AAV0@@Z
??YWString@@QAEAAV0@ABV0@@Z
?RemoveAt@CVarVector@@QAEHH@Z
?Size@CVarVector@@QAEHXZ
?FillCVarAt@CVarVector@@QAEXHAAVCVar@@@Z
?GetOleType@CVar@@QAEHXZ
?SetUnknown@CVar@@QAEXPAUIUnknown@@@Z
?SetAt@CFlexArray@@QAEXHPAX@Z
?UnbindPtr@WString@@QAEPAGXZ
??ACFlexArray@@QAEAAPAXH@Z
?RemoveAt@CFlexArray@@QAEHH@Z
?FillVariant@CVar@@QAEXPAUtagVARIANT@@H@Z
??1CVar@@QAE@XZ
??YWString@@QAEAAV0@PBG@Z
??YWString@@QAEAAV0@G@Z
??0CFlexArray@@QAE@HH@Z
??1CFlexArray@@QAE@XZ
?InsertAt@CFlexArray@@QAEHHPAX@Z
?GetNewVariant@CVar@@QAEPAUtagVARIANT@@XZ
??0WString@@QAE@PAGH@Z
??4WString@@QAEAAV0@PBG@Z
?GetAt@CFlexArray@@QBEPAXH@Z
??0WString@@QAE@XZ
?DeleteString@WString@@AAEXPAG@Z
?SetVariant@CVar@@QAEHPAUtagVARIANT@@H@Z
?Init@CVar@@AAEXXZ
?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z
?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z
??0CVarVector@@QAE@XZ

oleaut32

SysAllocStringLen
SysStringLen
GetErrorInfo
SysAllocString
VariantInit
SysFreeString
VariantClear

ole32

CoTaskMemAlloc
CoTaskMemFree
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

oqcsyrl
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4e1c0afb63e6b2ddd99f11988659e9be

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

wbemcomn

oleaut32

ole32

Sections

.text Size: 98KB - Virtual size: 98KB

.data Size: 1024B - Virtual size: 19KB

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 33KB - Virtual size: 34KB

oqcsyrl Size: - Virtual size: 4KB

.text
Size: 98KB - Virtual size: 98KB

.data
Size: 1024B - Virtual size: 19KB

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 33KB - Virtual size: 34KB

oqcsyrl
Size: - Virtual size: 4KB