fbd1ca7fa8322c6eb6b1ecaab0700fda076096d7639b7565930d3bdd4fa20633

Sharing

Copy URL Twitter E-mail

General

Target

fbd1ca7fa8322c6eb6b1ecaab0700fda076096d7639b7565930d3bdd4fa20633
Size

352KB
MD5

0f24d546ef366a0c68c66310a739ae90
SHA1

0684044915934af914639513dfd4eb7c42941e0a
SHA256

fbd1ca7fa8322c6eb6b1ecaab0700fda076096d7639b7565930d3bdd4fa20633
SHA512

16d5477fe33761bd3cd8ac7eddbb1002be0e7614b8b005830e7b27d3260e04026ce6b83a5803b2b90aa3e15f5297ec78af880f943082e5074b660b29ff905f85
SSDEEP

6144:7RTL3miQkTPf6kJtzv4Q6SvGan4qTAqObZFM9FVdSPmyRdbxRs5Vp:7RTLXzf6kJtzwQ6Svrn4IyDM3SnNi5

Score

N/A

Malware Config

Signatures

Files

fbd1ca7fa8322c6eb6b1ecaab0700fda076096d7639b7565930d3bdd4fa20633
.exe windows x86

786bfb020119036e34843fcdc0727921

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA

psapi

GetModuleInformation
GetProcessImageFileNameW

kernel32

GetCurrentThreadId
GetModuleHandleW
SetErrorMode
GetProcAddress
InitializeCriticalSection
WriteProcessMemory
SetUnhandledExceptionFilter
GetCurrentProcess
HeapFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
EnterCriticalSection
CreateEventW
DuplicateHandle
SearchPathW
CreateProcessW
WaitForMultipleObjects
TerminateProcess
ReadProcessMemory
VirtualAllocEx
GetTickCount
GetPrivateProfileStringW
lstrlenW
CreateProcessA
MultiByteToWideChar
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
OpenEventW
SetEvent
FreeLibrary
ReadFile
SetFilePointer
GetFileSize
GetCurrentProcessId
GetLastError
MoveFileExW
FindFirstFileW
FindNextFileW
FindClose
WaitForSingleObject
ConnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
TerminateThread
DisconnectNamedPipe
GetLocalTime
LocalFree
CreateThread
GetFileAttributesW
WritePrivateProfileStringW
GetSystemInfo
ExpandEnvironmentStringsW
FindFirstFileA
GetPrivateProfileStringA
GetModuleFileNameA
FindNextFileA
SetHandleInformation
CreatePipe
LoadLibraryW
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
InterlockedIncrement
InterlockedDecrement
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsProcessorFeaturePresent
HeapCreate
GetModuleFileNameW
GetProcessHeap
HeapAlloc
CloseHandle
Sleep
WriteFile
CreateFileW
SetFileAttributesW
DeleteFileW
LCMapStringW
RtlUnwind
SetStdHandle
FlushFileBuffers
WriteConsoleW
VirtualProtect
SetEndOfFile
GetStdHandle
ExitProcess
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineW
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetStringTypeW
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
SetHandleCount
HeapDestroy
HeapReAlloc
HeapSize
RaiseException

user32

KillTimer
PostQuitMessage
TranslateMessage
GetMessageW
SetTimer
PostThreadMessageW
IsWindow
SendMessageTimeoutW
FindWindowW

advapi32

RegOpenKeyExA
RegQueryInfoKeyW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
FreeSid
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueA

shell32

ShellExecuteW
SHGetFolderPathW
SHGetFolderPathA
SHGetSpecialFolderPathW

ole32

CoInitialize
CoUninitialize

shlwapi

PathFileExistsW
PathFindFileNameW
PathFileExistsA
wnsprintfA
wnsprintfW
SHGetValueA

wininet

InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetGetConnectedState
InternetCloseHandle

ws2_32

ntohl
htonl

urlmon

URLDownloadToFileW

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

786bfb020119036e34843fcdc0727921

Headers

DLL Characteristics

File Characteristics

Imports

version

psapi

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

ws2_32

urlmon

Sections

.text Size: 171KB - Virtual size: 171KB

.rdata Size: 45KB - Virtual size: 44KB

.data Size: 10KB - Virtual size: 18KB

.rsrc Size: 41KB - Virtual size: 40KB

.reloc Size: 76KB - Virtual size: 80KB

.text
Size: 171KB - Virtual size: 171KB

.rdata
Size: 45KB - Virtual size: 44KB

.data
Size: 10KB - Virtual size: 18KB

.rsrc
Size: 41KB - Virtual size: 40KB

.reloc
Size: 76KB - Virtual size: 80KB