6d33c0024487c75218eb8d146b11df6c611fe6e3c52094c4c9e8e351267c3696

Sharing

Copy URL Twitter E-mail

General

Target

6d33c0024487c75218eb8d146b11df6c611fe6e3c52094c4c9e8e351267c3696
Size

578KB
MD5

0e8ad6dc05d078eef52c0602da037a20
SHA1

1bf1e9660aae9748d134080672b83a9443c95e22
SHA256

6d33c0024487c75218eb8d146b11df6c611fe6e3c52094c4c9e8e351267c3696
SHA512

0cd1b1016a08d9d174b21ce32fa6b9c76de4eb15defdee33c8d8bfacac3d6dff5b5fa910f5e632867ee9bcef32030626601547b225787d151b26114a1686f0bf
SSDEEP

12288:bzOBoP2lgjZgrSmf63N7BMamDZ/YNMTZvg9/OqI:bzOBVogrSmS9dyxYNmZo92q

Score

N/A

Malware Config

Signatures

Files

6d33c0024487c75218eb8d146b11df6c611fe6e3c52094c4c9e8e351267c3696
.exe windows x86

163f924bbdd8a07c19c534eb12f3c21e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libcurl

curl_easy_setopt
curl_easy_perform
curl_easy_getinfo
curl_easy_cleanup
curl_easy_init

kernel32

MulDiv
GlobalLock
GlobalUnlock
CreateThread
GetFileAttributesW
CreateEventW
CreateJobObjectW
SetInformationJobObject
WideCharToMultiByte
GetModuleHandleW
IsBadWritePtr
MultiByteToWideChar
LoadResource
SizeofResource
FindResourceW
SetEvent
lstrcmpiW
LoadLibraryExW
GetTickCount
GetCommandLineW
LocalFree
CreateFileW
FlushFileBuffers
GetFileSizeEx
ReadFile
WriteFile
SetEndOfFile
DuplicateHandle
InterlockedCompareExchange
Sleep
CreateMutexW
WaitForSingleObject
ReleaseMutex
lstrcpyW
SearchPathW
CreateProcessW
SetUnhandledExceptionFilter
GetModuleHandleExW
CreateFileMappingW
GetFileSize
MapViewOfFile
UnmapViewOfFile
TerminateProcess
ExitProcess
WaitForMultipleObjects
GetVersionExW
lstrcmpW
InterlockedExchange
GetFileAttributesExW
GetModuleFileNameA
InterlockedDecrement
IsDebuggerPresent
AssignProcessToJobObject
ResumeThread
GetProcessTimes
QueryPerformanceCounter
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
IsBadStringPtrW
CreateFileA
SetFilePointer
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
HeapAlloc
UnhandledExceptionFilter
HeapFree
GetStartupInfoW
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
GetConsoleCP
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
GetModuleFileNameW
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetTimeZoneInformation
LoadLibraryA
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
GlobalAlloc
GetCurrentProcessId
GetLocalTime
CloseHandle
GetLastError
SetLastError
GlobalAddAtomW
FreeLibrary
GetProcAddress
LoadLibraryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
IsProcessorFeaturePresent
GetModuleHandleA

user32

SetParent
KillTimer
SetTimer
GetWindowRect
RemovePropW
SetPropW
GetPropW
CallWindowProcW
LoadCursorW
RegisterWindowMessageW
ReleaseCapture
CreateAcceleratorTableW
IsZoomed
SystemParametersInfoW
IsWindowVisible
SetLayeredWindowAttributes
UpdateLayeredWindow
MapWindowPoints
UpdateWindow
UnhookWindowsHookEx
GetDesktopWindow
PostQuitMessage
GetFocus
DestroyAcceleratorTable
GetSysColor
GetClassNameW
IsWindow
GetDlgItem
GetParent
IsChild
GetWindow
SetFocus
SetCapture
RedrawWindow
InvalidateRgn
GetLastInputInfo
DrawTextW
GetSystemMetrics
RegisterHotKey
UnregisterHotKey
GetMessageW
TranslateMessage
DispatchMessageW
MessageBoxW
SendMessageTimeoutW
ReplyMessage
IsIconic
AllowSetForegroundWindow
SetForegroundWindow
DisableProcessWindowsGhosting
FillRect
DestroyIcon
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SendMessageW
CharNextW
WaitForInputIdle
InvalidateRect
TrackMouseEvent
GetCursorPos
EndPaint
BeginPaint
SetCursor
GetWindowThreadProcessId
FindWindowExW
SetWindowPos
PostMessageW
ShowWindow
RegisterClassExW
LoadImageW
UnregisterClassW
SetWindowLongW
GetWindowLongW
CreateWindowExW
DestroyWindow
DefWindowProcW
UnregisterClassA
GetClassInfoExW

gdi32

SetTextAlign
SetBkMode
SetTextColor
SetGraphicsMode
GdiFlush
GdiAlphaBlend
GetObjectType
SetMapMode
EnumFontFamiliesExW
GetCurrentObject
CreateFontIndirectW
CreateDIBSection
GetObjectW
GetStockObject
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
DeleteObject
SetBkColor
GetDeviceCaps
SelectObject

advapi32

RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
CreateProcessAsUserW

shell32

ord680
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CreateStreamOnHGlobal
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleInitialize
OleUninitialize
CoTaskMemRealloc
CLSIDFromString

oleaut32

LoadRegTypeLi
SysFreeString
VarUI4FromStr
OleCreateFontIndirect
SysAllocStringLen
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysAllocString

shlwapi

StrToIntExW
StrNCatW
StrStrIW
StrToInt64ExW
StrCmpIW
wnsprintfW
PathFileExistsW
PathAppendW
wnsprintfA
StrCpyNW

winmm

timeGetTime

imm32

ImmAssociateContext

dbghelp

MakeSureDirectoryPathExists

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSACleanup
WSAStartup

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

163f924bbdd8a07c19c534eb12f3c21e

Headers

DLL Characteristics

File Characteristics

Imports

libcurl

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

winmm

imm32

dbghelp

version

ws2_32

userenv

Sections

.text Size: 374KB - Virtual size: 374KB

.rdata Size: 84KB - Virtual size: 83KB

.data Size: 14KB - Virtual size: 29KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 31KB - Virtual size: 30KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 374KB - Virtual size: 374KB

.rdata
Size: 84KB - Virtual size: 83KB

.data
Size: 14KB - Virtual size: 29KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 31KB - Virtual size: 30KB

.rmnet
Size: 56KB - Virtual size: 60KB