1a79c4d9e8ca6957948baa870093fcf6f88a0023d4e442a1130dd6aed5e3095d

Sharing

Copy URL Twitter E-mail

General

Target

1a79c4d9e8ca6957948baa870093fcf6f88a0023d4e442a1130dd6aed5e3095d
Size

875KB
MD5

0e624073f92fcf628cdc65e4115f0580
SHA1

ea81deccbe470ed88e2a83f657ed73931acd7c9d
SHA256

1a79c4d9e8ca6957948baa870093fcf6f88a0023d4e442a1130dd6aed5e3095d
SHA512

3e667f3c9b566caec76d6d6e16a1d3798918dddcdad6b288558966fab27e1f213962f2fa35d76c650c4ec2fdf962501cf339f0da7df982e15427287f48d7a268
SSDEEP

12288:GK0xJKhQjGOhS/IzJqrraq/t2qXy6xdRhMAK4/cGPEl0Io78:GK0ihjGS/EEn/tkIsGPEl0Is8

Score

N/A

Malware Config

Signatures

Files

1a79c4d9e8ca6957948baa870093fcf6f88a0023d4e442a1130dd6aed5e3095d
.exe windows x86

6d86e779a247bf438689a64a68008c86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
EventUnregister
EventRegister
EventWrite
RegQueryValueExW

kernel32

GetCurrentProcess
WaitForSingleObject
CreateMutexW
GetSystemTime
CopyFileW
WideCharToMultiByte
WriteFile
CreateFileW
FlushInstructionCache
LocalFree
FormatMessageW
LockResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DeleteCriticalSection
ReleaseMutex
CloseHandle
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetCurrentThreadId
FreeLibrary
lstrcmpiW
GetModuleHandleW
GetProcAddress
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
GetLastError
lstrlenW
GetSystemDirectoryW
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
VirtualAlloc
VirtualFree
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange
GetVersionExA
OutputDebugStringA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
UnhandledExceptionFilter

gdi32

SetBkMode
GetObjectW
CreateCompatibleDC
SelectObject
SetStretchBltMode
CreateCompatibleBitmap
StretchBlt
GetTextExtentPoint32W
SetDeviceGammaRamp
GetDeviceGammaRamp
GetStockObject
CreateSolidBrush
SetTextColor
SetBkColor
GetDeviceCaps
DeleteDC
CreateDCW
DeleteObject

user32

GetDC
MessageBoxW
GetWindow
ShowWindow
CharNextW
DestroyWindow
GetActiveWindow
GetSystemMetrics
MonitorFromRect
CallWindowProcW
SetWindowPos
SetForegroundWindow
OpenIcon
SendMessageW
SetWindowLongW
GetWindowLongW
MapDialogRect
RegisterWindowMessageW
DefWindowProcW
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowTextLengthW
FindWindowW
InvalidateRect
MoveWindow
MapWindowPoints
GetWindowRect
GetDlgItem
GetParent
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplayMonitors
GetWindowTextW
ReleaseDC
SetTimer
KillTimer
ShowCursor
UnregisterClassA
LoadStringW
SetCursor
LoadCursorW
MonitorFromWindow
PostMessageW
EnumChildWindows
GetWindowThreadProcessId
SetWindowTextW

msvcrt

_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memcpy
_ftol2
_CIpow
_wcsupr
swscanf_s
_ftol2_sse
_purecall
memset
??_U@YAPAXI@Z
wcsncpy_s
memcpy_s
malloc
??2@YAPAXI@Z
free
??_V@YAXPAX@Z
??3@YAXPAX@Z
wcsstr
_vsnwprintf

ntdll

WinSqmAddToStream

dxva2

DestroyPhysicalMonitors
GetPhysicalMonitorsFromHMONITOR
GetNumberOfPhysicalMonitorsFromHMONITOR
GetVCPFeatureAndVCPFeatureReply
SetVCPFeature
GetMonitorBrightness
SetMonitorBrightness
GetMonitorContrast
SetMonitorContrast
GetMonitorCapabilities

mscms

InstallColorProfileW
GetColorProfileFromHandle
WcsCreateIccProfile
SetColorProfileElementSize
SetColorProfileElement
UninstallColorProfileW
DccwGetDisplayProfileAssociationList
WcsDisassociateColorProfileFromDevice
WcsSetDefaultColorProfile
GetColorDirectoryW
WcsGetUsePerUserProfiles
WcsGetDefaultColorProfile
WcsOpenColorProfileW
DccwGetGamutSize
CloseColorProfile
DccwSetDisplayProfileAssociationList
DccwReleaseDisplayProfileAssociationList
WcsGetCalibrationManagementState
WcsSetCalibrationManagementState
DccwCreateDisplayProfileAssociationList

shell32

ShellExecuteW

gdiplus

GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipCreateLineBrushI
GdipCreateSolidFill
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDeleteBrush
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdipCloneImage

comctl32

DestroyPropertySheetPage
CreatePropertySheetPageW
ord345
PropertySheetW

ole32

StringFromCLSID
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 763KB - Virtual size: 763KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6d86e779a247bf438689a64a68008c86

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

dxva2

mscms

shell32

gdiplus

comctl32

ole32

oleaut32

Sections

.text Size: 75KB - Virtual size: 75KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 763KB - Virtual size: 763KB

.reloc Size: 33KB - Virtual size: 34KB

.text
Size: 75KB - Virtual size: 75KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 763KB - Virtual size: 763KB

.reloc
Size: 33KB - Virtual size: 34KB