e81cff8ec447905037e8a1d9cff316e3a62006b99a4fd67ace820bbf212b9da7

Sharing

Copy URL Twitter E-mail

General

Target

e81cff8ec447905037e8a1d9cff316e3a62006b99a4fd67ace820bbf212b9da7
Size

789KB
MD5

0ee907b1803072d25012b95cf7541520
SHA1

87285c4121db420bcfeea3f527eb7d3f30b28295
SHA256

e81cff8ec447905037e8a1d9cff316e3a62006b99a4fd67ace820bbf212b9da7
SHA512

cfe7447764c9ac6396bb3ab8c42c8ec2bc60c6e26b1b041db161c5fbb4bfabcb000da255230d5cc631be28b33dd27e22f732d770eb48c33ed0a4f96ab0761c54
SSDEEP

24576:XnHxfZQiUbV/XWMdPWqvf0q2JTpDsKfNPOYh:XxfZQ7/mMRfOJTGKwYh

Score

N/A

Malware Config

Signatures

Files

e81cff8ec447905037e8a1d9cff316e3a62006b99a4fd67ace820bbf212b9da7
.exe windows x86

03584bc24e67c092f3489a55f5011f1e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
SetEvent
ResetEvent
SetFilePointer
WaitForMultipleObjects
FindFirstFileW
FindNextFileW
FindClose
GetVersionExW
GetDiskFreeSpaceExW
GetExitCodeThread
FlushInstructionCache
OutputDebugStringW
SetLastError
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
RemoveDirectoryW
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageW
TerminateThread
ReleaseMutex
DuplicateHandle
SleepEx
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineA
CreateEventW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStartupInfoA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
HeapCreate
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
RtlUnwind
GetStartupInfoW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetCurrentProcessId
GetFileAttributesW
WriteFile
GetCurrentProcess
Sleep
GetLocalTime
WaitForSingleObject
CreateProcessW
MoveFileExW
MoveFileW
TerminateProcess
CopyFileW
DeleteFileW
WritePrivateProfileStringW
GetSystemDirectoryW
ExpandEnvironmentStringsW
Module32NextW
Module32FirstW
QueryDosDeviceW
OpenProcess
GetLogicalDriveStringsW
Process32NextW
CreateDirectoryW
Process32FirstW
CreateToolhelp32Snapshot
SetFileAttributesW
lstrlenW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
RaiseException
InitializeCriticalSection
lstrcmpiW
InterlockedDecrement
GetCurrentThreadId
LoadLibraryExW
InterlockedIncrement
GetTickCount
GetPrivateProfileStringW
CreateFileW
GetProcAddress
GlobalFree
CloseHandle
GlobalUnlock
GetSystemDefaultLangID
MultiByteToWideChar
GlobalLock
lstrlenA
GlobalAlloc
WideCharToMultiByte
GetLastError
GetModuleFileNameW
CreateMutexW
GetPrivateProfileIntW
GetFileSize
FreeLibrary
FindResourceExW
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetCommandLineW
LoadLibraryW
ReadFile
GetModuleHandleW
GetEnvironmentStringsW

user32

GetClassInfoExW
IntersectRect
GetDC
LoadBitmapW
LoadImageW
RegisterWindowMessageW
ReleaseDC
PostMessageW
SetTimer
GetFocus
ShowWindow
IsChild
EqualRect
PostQuitMessage
SetActiveWindow
IsDialogMessageW
SetRect
SetWindowPos
GetCursorPos
ScreenToClient
GetDlgItem
CreateWindowExW
GetWindowLongW
GetActiveWindow
DestroyWindow
EndPaint
PtInRect
UnregisterClassA
InflateRect
CharNextW
DrawTextW
ExitWindowsEx
SendMessageW
GetWindowRect
InvalidateRect
GetForegroundWindow
GetWindowThreadProcessId
GetDesktopWindow
AttachThreadInput
BringWindowToTop
SetForegroundWindow
GetMessageW
PostThreadMessageW
PeekMessageW
TranslateMessage
DispatchMessageW
SystemParametersInfoW
IsWindowVisible
OffsetRect
MoveWindow
SetFocus
DrawFrameControl
DestroyIcon
ClientToScreen
IsWindow
SetWindowTextW
CallWindowProcW
UpdateLayeredWindow
GetParent
GetNextDlgTabItem
KillTimer
LoadIconW
SetCapture
GetWindow
MonitorFromWindow
GetMonitorInfoW
IsWindowEnabled
SetRectEmpty
ReleaseCapture
EnableWindow
SetWindowLongW
DrawIconEx
LoadCursorW
MapWindowPoints
BeginPaint
CopyRect
RegisterClassExW
DefWindowProcW
GetDlgCtrlID
SetCursor
GetClientRect

gdi32

GetObjectA
RectInRegion
OffsetRgn
CreateRectRgnIndirect
GetTextExtentPoint32W
TextOutW
RoundRect
ExtSelectClipRgn
GetClipRgn
SetViewportOrgEx
GetViewportOrgEx
GetTextColor
CreateRoundRectRgn
GetCurrentObject
SelectClipRgn
CreateFontIndirectW
GetStockObject
CombineRgn
GetObjectW
SetTextColor
CreateBitmap
Rectangle
CreateCompatibleBitmap
DeleteObject
CreateDIBSection
CreateRectRgn
StretchBlt
SetStretchBltMode
BitBlt
RestoreDC
DeleteDC
SaveDC
ExtTextOutW
SetBkColor
SelectObject
CreateCompatibleDC
CreatePen
SetBkMode

advapi32

OpenSCManagerW
RegQueryValueExA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
CloseServiceHandle
OpenProcessToken
StartServiceW
OpenServiceW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

ShellExecuteW

ole32

CoCreateInstance
CoTaskMemRealloc
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SystemTimeToVariantTime
VarUI4FromStr
VariantTimeToSystemTime

shlwapi

PathAppendW
StrToIntA
PathRemoveFileSpecW
PathAddBackslashW
PathFileExistsW
StrToIntW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipSetPenMode
GdipLoadImageFromFile
GdipDeleteGraphics
GdipSetClipPath
GdipCreatePen1
GdipGetFontSize
GdipSetStringFormatTrimming
GdipGetFamily
GdipDeleteFont
GdipDrawLinesI
GdipCreateFontFromLogfontW
GdipDrawLineI
GdipAddPathStringI
GdipCreateFontFromLogfontA
GdipSetStringFormatLineAlign
GdipDrawLine
GdipSetStringFormatAlign
GdipCreateFontFromDC
GdipAddPathPieI
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawImageI
GdipAddPathRectangleI
GdipDeleteFontFamily
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipMeasureString
GdipResetWorldTransform
GdipSetPenDashStyle
GdipDrawString
GdipSetPixelOffsetMode
GdipCreateBitmapFromScan0
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipFillPath
GdipAddPathArcI
GdipSetTextRenderingHint
GdipSetCompositingQuality
GdipFillRectangleI
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipClosePathFigure
GdipDeletePath
GdipSetPenEndCap
GdipDrawPath
GdipSetPenStartCap
GdipCreateSolidFill
GdipCreatePath
GdipCloneBrush
GdipDeletePen
GdipDeleteBrush
GdipCreateFromHDC
GdipDisposeImage
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipAlloc
GdipCreateImageAttributes
GdipFree
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipDrawImagePointsRectI
GdipDrawImageRectRectI
GdiplusShutdown
GdipDrawImageRectRect
GdiplusStartup
GdipDrawImageRectI
GdipImageRotateFlip
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromStream

iphlpapi

IcmpCreateFile
IcmpCloseHandle
GetNetworkParams
IcmpSendEcho

psapi

GetModuleFileNameExW

ws2_32

inet_ntoa
WSAStartup
gethostbyname
inet_addr
ntohl
closesocket
WSAGetLastError
recv
send
getsockname
ntohs
bind
htons
getsockopt
setsockopt
connect
socket
WSASetLastError
__WSAFDIsSet
select
ioctlsocket
WSACleanup

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 500KB - Virtual size: 499KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

03584bc24e67c092f3489a55f5011f1e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

iphlpapi

psapi

ws2_32

version

Sections

.text Size: 500KB - Virtual size: 499KB

.rdata Size: 120KB - Virtual size: 118KB

.data Size: 12KB - Virtual size: 19KB

.rsrc Size: 148KB - Virtual size: 148KB

.text
Size: 500KB - Virtual size: 499KB

.rdata
Size: 120KB - Virtual size: 118KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 148KB - Virtual size: 148KB