dde56882b655b9b75112deccad2e1fc4288256ff8bddf4763a2cb468fb4d4838

Sharing

Copy URL Twitter E-mail

General

Target

dde56882b655b9b75112deccad2e1fc4288256ff8bddf4763a2cb468fb4d4838
Size

868KB
MD5

2fef0743e00530d7b03c867bdeffc5d0
SHA1

27595c0d264d8837a5e4435ca4e7a7ddb50558d5
SHA256

dde56882b655b9b75112deccad2e1fc4288256ff8bddf4763a2cb468fb4d4838
SHA512

9e67838fec93c9c9dca8844c8f4825ae0d8fc836c6a9b61369c02a64e908824d0b4f9666dd7a1de4a709416dab482213c4c868136f6818120a018c862d196006
SSDEEP

12288:lpSFts9GUf66NzBtYbgdfFZMtJALR281eUED8OYhXWPk86M6FwnHh2Vx:/jO61Brd9ZUJA88wUEDm86M6mHcL

Score

N/A

Malware Config

Signatures

Files

dde56882b655b9b75112deccad2e1fc4288256ff8bddf4763a2cb468fb4d4838
.exe windows x86

6e8ca7d4e1caffce215d24891e718d80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
GetSystemDirectoryW
LoadLibraryW
LocalFree
WideCharToMultiByte
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SystemTimeToFileTime
WriteFile
CreateFileMappingW
RemoveDirectoryW
SetPriorityClass
GetCurrentThread
SetThreadPriority
GetShortPathNameW
FreeLibrary
GetModuleHandleA
GetLogicalDriveStringsW
GetSystemWindowsDirectoryW
ProcessIdToSessionId
QueryDosDeviceW
GetPrivateProfileSectionNamesW
GetVolumeInformationW
DeviceIoControl
GlobalAlloc
MoveFileExW
CopyFileW
CreateDirectoryW
GetTempPathW
FindClose
FindNextFileW
FileTimeToSystemTime
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindFirstFileW
MultiByteToWideChar
GlobalFree
OutputDebugStringA
GetVersionExW
GetLocalTime
OpenMutexW
GetPrivateProfileIntW
GetCurrentProcess
OutputDebugStringW
GetTickCount
GetModuleFileNameW
DeleteFileW
GetModuleHandleW
GetProcAddress
DisconnectNamedPipe
FlushFileBuffers
GetProcessHeap
ConnectNamedPipe
CreateNamedPipeW
CreateEventW
GetCurrentProcessId
Sleep
HeapFree
HeapAlloc
ReadFile
WaitForSingleObject
SetEvent
CreateThread
CreateFileW
CloseHandle
InitializeCriticalSectionAndSpinCount
GetLastError
WritePrivateProfileStringW
GetPrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetEnvironmentVariableW
InitializeCriticalSection
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
TryEnterCriticalSection
QueryPerformanceFrequency
InterlockedCompareExchange
CreateMutexW
ReleaseMutex
ExpandEnvironmentStringsW
ReplaceFileW
MoveFileW
GetTempFileNameW
GetLongPathNameW
GetFileAttributesExW
GetFileAttributesW
InterlockedExchangeAdd
GetModuleHandleExA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
EncodePointer
DecodePointer
GetStringTypeW
GetSystemTimeAsFileTime
GetCurrentThreadId
ExitThread
LoadLibraryExW
ResumeThread
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
SetStdHandle
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
CreateProcessW

user32

GetDesktopWindow
wsprintfW
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
GetQueueStatus
CallMsgFilterW
MessageBoxW
TranslateMessage
DispatchMessageW
PeekMessageW
DestroyWindow
WaitMessage
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
PostMessageW

advapi32

RegOpenCurrentUser
RegCreateKeyExW
AdjustTokenPrivileges
DuplicateTokenEx
LookupPrivilegeValueW
ConvertStringSidToSidW
SetTokenInformation
CreateProcessAsUserW
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RevertToSelf
ImpersonateLoggedOnUser
RegQueryInfoKeyW
GetUserNameW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
ReportEventW
RegisterEventSourceW
DeleteService
ControlService
EnumDependentServicesW
StartServiceW
QueryServiceStatusEx
RegCreateKeyW
ChangeServiceConfig2W
CreateServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeregisterEventSource
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHFileOperationW
SHGetFolderPathW
ShellExecuteW
SHChangeNotify
ShellExecuteExW

ole32

CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeSecurity

oleaut32

VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringByteLen
VariantInit
SysAllocStringByteLen
VariantClear

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

shlwapi

PathFindFileNameW
PathFileExistsW
PathFindFileNameA

winhttp

WinHttpOpen
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpWriteData
WinHttpConnect
WinHttpReceiveResponse
WinHttpReadData
WinHttpSetOption
WinHttpSetTimeouts
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpenRequest

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

Sections

.text
Size: 500KB - Virtual size: 499KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6e8ca7d4e1caffce215d24891e718d80

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

wtsapi32

shlwapi

winhttp

winmm

Sections

.text Size: 500KB - Virtual size: 499KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 11KB - Virtual size: 23KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 138KB - Virtual size: 138KB

.text Size: 108KB - Virtual size: 112KB

.text
Size: 500KB - Virtual size: 499KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 11KB - Virtual size: 23KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 138KB - Virtual size: 138KB

.text
Size: 108KB - Virtual size: 112KB