edaee02f177fc550ea9bbb9df4091d8d9be59e893e4f851cdf7b26a2ad98d481

Sharing

Copy URL

Twitter E-mail

General

Target

edaee02f177fc550ea9bbb9df4091d8d9be59e893e4f851cdf7b26a2ad98d481
Size

1.1MB
MD5

0c7074ea6ac36b9ec86fce7f58bf6a60
SHA1

c631c99b8f4aea22e4a9148eb6f5cc73ca6cf80d
SHA256

edaee02f177fc550ea9bbb9df4091d8d9be59e893e4f851cdf7b26a2ad98d481
SHA512

fe7ebdeba314d500be9bd1ca253cde4cb526348e997c0442f1f39038fe872765ef52a92e8990a866a9704bb55fdfcee2df88730e3cab9892e0b3e8abf88afc3d
SSDEEP

24576:VgG6O3cRxW8jC6aD4R+vkSKhJgTdDXkpQxylq:Vs3wWCnDf63gT5oq

Score

N/A

Malware Config

Signatures

Files

edaee02f177fc550ea9bbb9df4091d8d9be59e893e4f851cdf7b26a2ad98d481
.exe windows x86

87492944bcf23d679fb7dcc067c79c9d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

kernel32

ReleaseMutex
FindFirstFileW
MapViewOfFile
UnmapViewOfFile
CreateDirectoryW
GetFileAttributesW
ReplaceFileW
GetCurrentDirectoryW
MoveFileW
FindClose
CreateFileMappingW
RemoveDirectoryW
FindNextFileW
GetFileAttributesExW
SetFileAttributesW
GetVolumeInformationW
GetNativeSystemInfo
GetModuleHandleA
Sleep
IsDebuggerPresent
GetCurrentThreadId
DuplicateHandle
CreateThread
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
QueryPerformanceCounter
GetSystemTimeAsFileTime
FileTimeToSystemTime
InterlockedExchange
QueryPerformanceFrequency
SetEndOfFile
SetFilePointerEx
SetFileTime
FlushFileBuffers
GetFileInformationByHandle
GetUserDefaultLangID
ExpandEnvironmentStringsW
GetModuleHandleExW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetDiskFreeSpaceExW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetLocalTime
GetSystemDirectoryW
GetComputerNameA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FlushInstructionCache
GetPrivateProfileIntW
GetSystemDefaultUILanguage
GlobalMemoryStatusEx
GetUserDefaultUILanguage
FindResourceExW
LoadLibraryW
TerminateThread
lstrlenW
ReadFile
GetExitCodeThread
LockResource
DosDateTimeToFileTime
CreateFileA
FindResourceA
OutputDebugStringW
CreateDirectoryA
SetFileAttributesA
LocalFileTimeToFileTime
Process32FirstW
Process32NextW
UnregisterWaitEx
UnregisterWait
DisconnectNamedPipe
OutputDebugStringA
SetFilePointer
GetFileSize
SetLastError
GetTickCount
FormatMessageW
SleepEx
WaitForMultipleObjects
PeekNamedPipe
GetTempPathA
GetPrivateProfileIntA
CreateFileMappingA
GetModuleFileNameA
CreateMutexA
DeleteFileA
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
VirtualFree
VirtualAlloc
SetEnvironmentVariableA
GetDriveTypeW
WriteConsoleW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
ReadConsoleW
ExitThread
RtlUnwind
AreFileApisANSI
ExitProcess
GetFileType
SetStdHandle
GetFullPathNameW
CreateMutexW
lstrcmpiW
DecodePointer
EnterCriticalSection
RaiseException
MultiByteToWideChar
LeaveCriticalSection
SizeofResource
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
Module32NextW
CreateToolhelp32Snapshot
Module32FirstW
lstrcpyW
DeleteFileW
VirtualAllocEx
GetProcAddress
GetLastError
IsBadWritePtr
CopyFileW
OpenProcess
SetEnvironmentVariableW
VirtualQueryEx
IsBadReadPtr
GetModuleHandleW
MoveFileExW
GetEnvironmentVariableW
LocalFree
GetCurrentProcessId
CloseHandle
DeleteCriticalSection
CreateEventW
GetProcessId
GetTempPathW
CreateFileW
GetModuleFileNameW
GetVersionExW
ReadProcessMemory
InitializeCriticalSection
WriteFile
SetEvent
InterlockedCompareExchange
WaitForSingleObject
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
EncodePointer
GetStringTypeW
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
CreateProcessW
GetCommandLineW
FileTimeToLocalFileTime
GetPrivateProfileStringA

user32

UnregisterClassW
SetDlgItemTextW
GetSystemMetrics
GetMenuItemCount
GetActiveWindow
IsDlgButtonChecked
SendMessageW
ShowWindow
LoadStringW
GetCursorPos
RedrawWindow
UpdateWindow
GetDlgCtrlID
CharNextW
EndDialog
SetWindowTextW
CharUpperW
wsprintfW
DispatchMessageW
GetDC
KillTimer
SetTimer
UpdateLayeredWindow
OffsetRect
GetWindowPlacement
IsIconic
ReleaseDC
GetWindowDC
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
SetWindowPos
CreateDialogParamW
SetWindowLongW
PeekMessageW
TranslateMessage
DialogBoxParamW
GetMessageW
DestroyWindow
DrawFrameControl
CallWindowProcW
DefWindowProcW
LoadBitmapW
GetDlgItem
GetDesktopWindow
wsprintfA
EnableWindow
PostQuitMessage
MessageBoxW
IsWindowVisible
EndPaint
SetCursor
GetWindowTextLengthW
GetSystemMenu
ScreenToClient
GetWindowRect
FillRect
GetMenuItemID
LoadImageW
PostMessageW
LoadCursorW
DrawIcon
GetClientRect
BeginPaint
InvalidateRect
GetWindowLongW
GetWindowTextW
EnableMenuItem
MoveWindow

gdi32

DeleteObject
BitBlt
SetTextColor
DeleteDC
SetBkColor
CreateBitmap
SetBkMode
GetObjectA
SelectObject
CreateCompatibleDC
CreateFontW
TextOutW
CreateSolidBrush
CreateDIBSection
GetStockObject

advapi32

GetSidSubAuthority
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
AdjustTokenPrivileges
GetLengthSid
AddAce
InitializeSid
GetSidLengthRequired
IsValidSid
InitializeAcl
GetNamedSecurityInfoW
GetAce
LookupPrivilegeValueW
SetNamedSecurityInfoW
CopySid
GetAclInformation
RegQueryValueW
RegOpenKeyW
RegQueryValueExW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegEnumKeyExW

shell32

SHGetFolderPathW
SHGetFileInfoW
ShellExecuteA
ShellExecuteW
SHGetSpecialFolderPathW
SHFileOperationW
CommandLineToArgvW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid

oleaut32

VarUI4FromStr

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

shlwapi

PathFindFileNameW
PathStripPathW
PathAppendW
PathRemoveFileSpecW
SHSetValueW
SHSetValueA
StrCatW
SHGetValueA
SHGetValueW
ord12
PathFindFileNameA
PathRemoveFileSpecA
PathFileExistsW

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
EnumProcesses
GetModuleInformation

gdiplus

GdiplusShutdown
GdiplusStartup
GdipDrawImageI
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipSetClipRectI
GdipGraphicsClear
GdipCreateFromHDC
GdipDeleteGraphics
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipLoadImageFromStream
GdipCreateStringFormat
GdipDeleteStringFormat
GdipMeasureString
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetTextRenderingHint
GdipDrawString
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipSaveGraphics
GdipTranslateWorldTransform
GdipRestoreGraphics
GdipGetImageHeight
GdipGetImageWidth
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSetStringFormatAlign
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount

cabinet

ord23
ord20
ord22
ord21

wininet

InternetConnectW
InternetReadFile
InternetOpenW
HttpOpenRequestW
InternetCloseHandle
HttpSendRequestW
InternetSetOptionW

imagehlp

ImageGetCertificateHeader

ws2_32

inet_ntoa
select
__WSAFDIsSet
WSASetLastError
recvfrom
sendto
ioctlsocket
getsockopt
getsockname
bind
listen
accept
recv
ntohs
send
connect
WSAStartup
inet_addr
WSAGetLastError
htons
setsockopt
WSACleanup
socket
closesocket
gethostbyname
WSAAsyncSelect

comctl32

_TrackMouseEvent

iphlpapi

GetAdaptersInfo

Exports

Exports

?UploadDump@@YAHPAUHINSTANCE__@@H@Z

Sections

.text
Size: 627KB - Virtual size: 627KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 162KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 107KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

87492944bcf23d679fb7dcc067c79c9d

Headers

DLL Characteristics

File Characteristics

Imports

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

version

shlwapi

psapi

gdiplus

cabinet

wininet

imagehlp

ws2_32

comctl32

iphlpapi

Exports

Exports

Sections

.text Size: 627KB - Virtual size: 627KB

.rdata Size: 149KB - Virtual size: 149KB

.data Size: 162KB - Virtual size: 196KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 114KB - Virtual size: 114KB

.reloc Size: 107KB - Virtual size: 108KB

.text
Size: 627KB - Virtual size: 627KB

.rdata
Size: 149KB - Virtual size: 149KB

.data
Size: 162KB - Virtual size: 196KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 114KB - Virtual size: 114KB

.reloc
Size: 107KB - Virtual size: 108KB