290c6920fa3261761b484b21d352eadcb458db369643cb27c4532a9d4b789224

Sharing

Copy URL Twitter E-mail

General

Target

290c6920fa3261761b484b21d352eadcb458db369643cb27c4532a9d4b789224
Size

121KB
MD5

0f603a5e67e9d7104037bd5efae9e470
SHA1

7543fba4edfcef111109edd6f6a17a654ea80394
SHA256

290c6920fa3261761b484b21d352eadcb458db369643cb27c4532a9d4b789224
SHA512

3371b38e06ad7343b0039b683cbe62adf8a7a68f89ce80ca10dd167d4811217cbfce18c29724a818f25c68f4c06d522528d85fa1c288a351c9035f02d5701e0a
SSDEEP

3072:684/o+GD3B6/blml67G/b04kr8rM7vkBc6e0S4VCF:Z4qD3B6/blo67Gz04o8rM7vPeCF

Score

N/A

Malware Config

Signatures

Files

290c6920fa3261761b484b21d352eadcb458db369643cb27c4532a9d4b789224
.exe windows x86

0010c7fd4f80d3387dc19010a616a9d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
FreeLibraryAndExitThread
GetCurrentThread
GetComputerNameW
OpenProcess
GetExitCodeProcess
GetModuleFileNameW
GetSystemDirectoryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetCommandLineA
GetCurrentThreadId
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
lstrcpyA
lstrcpynA
lstrcatA
lstrcmpiA
IsDBCSLeadByte
lstrlenA
lstrlenW
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetVersionExA
CreateSemaphoreA
CreateThread
WaitForMultipleObjects
MultiByteToWideChar
WideCharToMultiByte
GetLastError
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
InterlockedDecrement
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
DeleteCriticalSection
SetThreadPriority
InitializeCriticalSection
CreateEventW
WaitForSingleObject
GetVersionExW
LocalAlloc
LoadLibraryW
LocalFree
InterlockedCompareExchange
GetStartupInfoA
WaitForSingleObjectEx
HeapSize
CreateEventA
Sleep
SetEvent

msvcrt

_strnicmp
__p__commode
strchr
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
wcsncpy
calloc
strncpy
strtoul
sprintf
_snwprintf
wcsrchr
iswalpha
_XcptFilter
_exit
_ultoa
__p__fmode
__set_app_type
__dllonexit
_onexit
_controlfp
towupper
wcscmp
_wtoi
wcsspn
wcsncmp
wcschr
__CxxFrameHandler
swscanf
_ultow
wcslen
iswdigit
iswcntrl
_cexit
iswascii
_adjust_fdiv
wcscspn
_c_exit
_purecall
realloc
_except_handler3
_stricmp
sscanf
malloc
free
_wcsnicmp
_wcsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
_vsnwprintf
_snprintf
_beginthreadex
_vsnprintf

advapi32

RegQueryValueExW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeAcl
InitializeSecurityDescriptor
GetLengthSid
MakeAbsoluteSD
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetTokenInformation
OpenProcessToken
GetAce
GetAclInformation
AddAce
AddAccessDeniedAce
RegEnumKeyExA
AllocateAndInitializeSid
FreeSid
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AddAccessAllowedAce
EqualSid
DeleteAce
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW

user32

DefWindowProcA
GetWindowLongA
PostMessageA
DestroyWindow
SetWindowLongA
CreateWindowExA
RegisterClassA
GetMessageA
DispatchMessageA
CharPrevA
PostThreadMessageA
CharNextA
PostQuitMessage

ole32

CoUninitialize
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoSuspendClassObjects
CoCreateInstance
CoInitialize
CoCreateGuid

oleaut32

VariantInit
VariantClear
SysStringLen
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocString
SysFreeString

wininet

InternetOpenW
InternetQueryOptionA
HttpOpenRequestW
InternetQueryDataAvailable
HttpSendRequestExW
HttpEndRequestA
HttpQueryInfoA
InternetErrorDlg
HttpQueryInfoW
InternetSetOptionA
InternetCrackUrlW
InternetConnectW
InternetCloseHandle
InternetReadFile

wsock32

bind
shutdown
closesocket
getsockopt
getpeername
getsockname
WSAAsyncSelect
inet_ntoa
WSACleanup
WSAStartup
ntohl
setsockopt
connect
send
sendto
recv
WSASetLastError
getservbyport
ntohs
gethostbyaddr
htons
getservbyname
htonl
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
socket

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kbyrhnv
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0010c7fd4f80d3387dc19010a616a9d2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

user32

ole32

oleaut32

wininet

wsock32

Sections

.text Size: 91KB - Virtual size: 90KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 29KB - Virtual size: 30KB

kbyrhnv Size: - Virtual size: 4KB

.text
Size: 91KB - Virtual size: 90KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 29KB - Virtual size: 30KB

kbyrhnv
Size: - Virtual size: 4KB