5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef

Sharing

Copy URL

Twitter E-mail

General

Target

5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef
Size

293KB
MD5

0c27abd0469466401a6f20699ff070c0
SHA1

28e0fd5c6bf81cbf01fd132995964c6733cc5c01
SHA256

5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef
SHA512

bd68c16686165b95f090cd1a1f942360e55f5d80b12a65b7233fda56e406af8c70989b414aae37141d055b3306beffd75fc5d14dd4a3185d428d7b266ed3a98e
SSDEEP

6144:MAC6iCyq7Sc9opKLIaNBZfiKrkiUZTSJs6mXEbY9kG6o08n:rCyP7ScNsqTkiu/pUbY2Gjn

Score

N/A

Malware Config

Signatures

Files

5b1cd50fd699ace6612743a4068c2b17927d16a36d3e4a37a7963b58317c3fef
.exe windows x86

5767165a9fbd2e2d5ef8ec7b321a76a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

SetServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
CreateServiceW
DeleteService
ControlService
RegEnumKeyExW
RegisterServiceCtrlHandlerW
GetSecurityDescriptorLength
ConvertStringSecurityDescriptorToSecurityDescriptorW
StartServiceCtrlDispatcherW
IsValidSid
CopySid
GetLengthSid
ConvertSidToStringSidW
GetTokenInformation
OpenThreadToken
RegNotifyChangeKeyValue

kernel32

lstrcmpiW
SetLastError
Sleep
CreateThread
TerminateThread
GetModuleFileNameW
CreateEventW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
LocalFree
GetCommandLineW
GetVersionExW
HeapSetInformation
CreateDirectoryA
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
WideCharToMultiByte
DeleteFileW
GetTempFileNameW
GetTempPathW
GetFileTime
CreateFileW
GetSystemTimeAsFileTime
LockResource
FindResourceExW
GetCurrentThread
SetFileAttributesW
SystemTimeToFileTime
WriteFile
FileTimeToSystemTime
MoveFileW
GetModuleHandleW
GetModuleHandleA
lstrlenA
GetComputerNameExW
CreateMutexW
ReleaseMutex
FlushFileBuffers
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetEndOfFile
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
VirtualAlloc
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
ExitProcess
SetUnhandledExceptionFilter
SetFilePointer
GetConsoleMode
GetConsoleCP
ReadFile
RtlUnwind
GetStartupInfoW
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
WaitForSingleObject
CloseHandle
lstrlenW
SetEvent
WaitForMultipleObjects
ResetEvent

user32

wvsprintfA
MessageBoxW
CharUpperBuffW
CharUpperW
CharNextW
LoadStringW
wvsprintfW
CharLowerBuffW
GetMessageW
PostThreadMessageW
DispatchMessageW
TranslateMessage

shell32

SHGetFolderPathW

ole32

CoInitializeSecurity
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoCreateGuid
CoRevertToSelf
CLSIDFromString
CoImpersonateClient

oleaut32

LoadTypeLi
SysFreeString
SysStringLen
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringLen
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCreate
SafeArrayDestroy
SafeArrayRedim
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantClear
VariantInit
VarBstrCmp

shlwapi

PathAppendW

wininet

HttpOpenRequestW
HttpQueryInfoW
HttpAddRequestHeadersA
InternetCrackUrlW
InternetReadFile
InternetOpenA
InternetSetOptionW
InternetConnectW
InternetCloseHandle
HttpSendRequestW

sensapi

IsNetworkAlive

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertGetNameStringW
CryptQueryObject
CryptMsgGetParam

Sections

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.tdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5767165a9fbd2e2d5ef8ec7b321a76a8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

shell32

ole32

oleaut32

shlwapi

wininet

sensapi

wintrust

crypt32

Sections

.text Size: 167KB - Virtual size: 167KB

.data Size: 6KB - Virtual size: 18KB

.rsrc Size: 31KB - Virtual size: 30KB

.reloc Size: 10KB - Virtual size: 9KB

.tdata Size: 72KB - Virtual size: 72KB

.text
Size: 167KB - Virtual size: 167KB

.data
Size: 6KB - Virtual size: 18KB

.rsrc
Size: 31KB - Virtual size: 30KB

.reloc
Size: 10KB - Virtual size: 9KB

.tdata
Size: 72KB - Virtual size: 72KB