5e441f9219440125dc95d91a0c4812efd84b010cade4b9c246ac4b80f34a8ce2

Sharing

Copy URL Twitter E-mail

General

Target

5e441f9219440125dc95d91a0c4812efd84b010cade4b9c246ac4b80f34a8ce2
Size

230KB
MD5

0d5d580678524f63a813296ada52a4e0
SHA1

7ccbf8462afdf156929b7d14fe1e381cc2284e87
SHA256

5e441f9219440125dc95d91a0c4812efd84b010cade4b9c246ac4b80f34a8ce2
SHA512

5e81a93f26963cb04c8c6c3a18131630b0dddb94b0926ed1d5542ae4b65347bd4235588b15c968dba2e7ee38128661bd811038a247ec92c523edfadce2453a19
SSDEEP

6144:7K+sZVg/88z0dqrsbEecq0HTzswrvB0Zu:u+sasbEecq0HswrvmZ

Score

N/A

Malware Config

Signatures

Files

5e441f9219440125dc95d91a0c4812efd84b010cade4b9c246ac4b80f34a8ce2
.exe windows x86

a63af57cc2380a3240e96129b222b5fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
EventRegister
EventUnregister
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegNotifyChangeKeyValue
EventWrite
RegGetValueW
RegQueryValueExW

kernel32

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
SetLastError
GetTickCount
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
EnterCriticalSection
GetModuleFileNameW
CreateMutexW
Sleep
CreateEventW
CreateThread
GetCurrentThreadId
SetEvent
GetCommandLineW
GetSystemTimeAsFileTime
CloseThreadpoolTimer
SetThreadpoolTimer
ResetEvent
CreateThreadpoolTimer
FlushInstructionCache
GetCurrentProcess
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
InitializeCriticalSectionAndSpinCount
RaiseException
lstrlenW
FindFirstFileW
CompareStringOrdinal
CreateFileW
CloseHandle
GetLastError
LoadLibraryExW
SetFileAttributesW
FindClose
FindNextFileW
MoveFileW
GetVersionExA
CopyFileExW
SetFilePointer
GetFileMUIPath
GetFileAttributesW
CompareFileTime
GetSystemInfo
GetSystemDefaultLCID
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
LCMapStringW
SystemTimeToFileTime
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
VirtualAlloc
VirtualFree
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange

gdi32

DeleteObject
CreateCompatibleDC
SelectObject
SetLayout
DeleteDC
CreateCompatibleBitmap
CreateDIBSection
CreateRectRgn

user32

GetMenuState
RegisterWindowMessageW
CreateWindowExW
RegisterClassExW
UnregisterClassA
LoadStringW
InsertMenuW
CharNextW
PostThreadMessageW
CharUpperW
GetMessageW
MsgWaitForMultipleObjects
EnumWindows
DispatchMessageW
TranslateMessage
PeekMessageW
DispatchMessageA
GetMessageA
IsWindowUnicode
CreateIconIndirect
DrawIconEx
GetIconInfo
SetWindowLongW
GetWindowLongW
PostMessageW
IsIconic
ShowWindow
SendMessageW
SetWindowRgn
GetClassInfoExW
LoadCursorW
LoadImageW
GetSystemMetrics
DestroyIcon
PostQuitMessage
CheckMenuItem
GetSystemMenu
SetWindowTextW
ModifyMenuW
DeleteMenu
CallWindowProcW
DefWindowProcW

msvcrt

??3@YAXPAX@Z
??_V@YAXPAX@Z
_vsnwprintf
??_U@YAPAXI@Z
memset
free
malloc
memcpy_s
memmove_s
wcsncpy_s
_purecall
??2@YAPAXI@Z
wcscpy_s
wcscat_s
swprintf_s
_ftol2
bsearch
qsort
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
realloc
_errno
_unlock
__dllonexit
wcstoul
swscanf_s
iswspace
_lock
_onexit
?terminate@@YAXXZ
_controlfp
exit

ole32

PropVariantCopy
CoFreeUnusedLibrariesEx
PropVariantClear
CoDisconnectObject
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CoResumeClassObjects

oleaut32

VariantInit
VariantClear
SysFreeString
VarUI4FromStr
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VariantChangeType

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW
ord615
ord487
ord16
SHStrDupW
UrlEscapeW
SHCreateStreamOnFileW
PathParseIconLocationW
SHCreateStreamOnFileEx
UrlUnescapeW

propsys

PropVariantCompareEx
PSGetPropertyKeyFromName
StgDeserializePropVariant
PropVariantToStringAlloc
PropVariantChangeType
PSCreateMemoryPropertyStore
PSGetPropertyDescriptionListFromString
PSGetPropertyDescriptionByName
PropVariantToGUID

shell32

ShellExecuteExW
ord155
SHCreateShellItemArrayFromIDLists
ord6
SHGetPropertyStoreForWindow
Shell_NotifyIconW
SHParseDisplayName
SHQueryUserNotificationState
ord165

dwmapi

DwmSetWindowAttribute
DwmSetIconicThumbnail

gdiplus

GdipSetSmoothingMode
GdipFree
GdipAlloc
GdiplusStartup
GdipCreateFromHDC
GdipCreateBitmapFromFileICM
GdipCloneImage
GdiplusShutdown
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipDrawImageRectI

ntdll

WinSqmSetString
WinSqmAddToStreamEx
WinSqmEndSession
WinSqmIsOptedIn
WinSqmStartSession
WinSqmIncrementDWORD
WinSqmSetDWORD
RtlGetNativeSystemInformation

xmllite

CreateXmlReader

rpcrt4

UuidFromStringW

msi

ord113

crypt32

CertVerifyCertificateChainPolicy

wintrust

CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

oupdgoj
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a63af57cc2380a3240e96129b222b5fd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shlwapi

propsys

shell32

dwmapi

gdiplus

ntdll

xmllite

rpcrt4

msi

crypt32

wintrust

Sections

.text Size: 151KB - Virtual size: 151KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 37KB - Virtual size: 38KB

oupdgoj Size: - Virtual size: 4KB

.text
Size: 151KB - Virtual size: 151KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 37KB - Virtual size: 38KB

oupdgoj
Size: - Virtual size: 4KB