778915e0b5ffd3feabd47770eee2400c8b0cd6f44228ecad5f51576af0f32b9a

Sharing

Copy URL Twitter E-mail

General

Target

778915e0b5ffd3feabd47770eee2400c8b0cd6f44228ecad5f51576af0f32b9a
Size

184KB
MD5

05fc102191e1a8e8be61abba9d128ed3
SHA1

16eb7877e303fff08834b871d581fa7db4cbc1d0
SHA256

778915e0b5ffd3feabd47770eee2400c8b0cd6f44228ecad5f51576af0f32b9a
SHA512

a2fb18e9f99b19c0408d3c8009a34dab8b3f286b517c4dc35b2ed98a136a37aa6fdc5e899cc3da0a5e71be95dcbd44929adfe281685dc96fd73ea37c9f05d31f
SSDEEP

3072:XZ260CaV/fwoESpSEQIem5FeWdmEB8fWcgyo0AlCG7qW0Tk5R:XZ260CaVooESkE95FbJBODgAbG7qW0TI

Score

N/A

Malware Config

Signatures

Files

778915e0b5ffd3feabd47770eee2400c8b0cd6f44228ecad5f51576af0f32b9a
.exe windows x86

6159cf64e694463f1f6f66975285b439

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

winmm

waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutClose

msvcrt

_strcmpi
__set_app_type
__p__fmode
__p__commode
_controlfp
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
_adjust_fdiv
calloc
_beginthreadex
realloc
strncat
exit
wcscpy
_errno
strncmp
printf
time
srand
atoi
rand
strncpy
strcat
strrchr
_except_handler3
free
strcmp
strcpy
malloc
strchr
memcmp
strstr
strlen
_ftol
ceil
memmove
memcpy
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler
??2@YAPAXI@Z
memset
_strrev
_strnicmp
??1type_info@@UAE@XZ

ws2_32

WSACleanup
WSAIoctl
setsockopt
connect
htons
closesocket
select
send
sendto
htonl
WSASocketA
gethostbyname
socket
ntohs
recv
inet_ntoa
gethostname
getsockname
bind
getpeername
accept
listen
recvfrom
__WSAFDIsSet
WSAGetLastError
WSAStartup
inet_addr

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

mfc42

ord2764
ord4129
ord6648
ord537
ord926
ord924
ord922
ord535
ord858
ord6663
ord4278
ord939
ord6877
ord540
ord2818
ord800
ord860

kernel32

OutputDebugStringA
InterlockedExchange
MultiByteToWideChar
GetTickCount
ExitThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
WinExec
SetLastError
GetModuleFileNameA
HeapFree
HeapAlloc
GetProcessHeap
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalMemoryStatus
GetSystemInfo
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableA
GetShortPathNameA
ReleaseMutex
OpenEventA
SetErrorMode
ExitProcess
CreateMutexA
GetTempPathA
lstrcmpiA
Process32First
GetCurrentThreadId
GetModuleHandleA
GetStartupInfoA
GlobalAlloc
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
GetVersionExA
LocalFree
FindClose
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetPrivateProfileStringA
GetProcAddress
LoadLibraryA
CloseHandle
TerminateThread
SetEvent
ResumeThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
lstrcpyA
Sleep
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
FreeLibrary
WideCharToMultiByte
lstrcmpA

user32

GetWindowThreadProcessId
IsWindowVisible
GetWindowTextA
EnumWindows
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
PostMessageA
CreateWindowExA
CloseWindow
GetProcessWindowStation
MapVirtualKeyA
SystemParametersInfoA
SendMessageA
DestroyCursor
LoadCursorA
ExitWindowsEx
MessageBoxA
CharNextA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
SetProcessWindowStation
GetCursorInfo
GetCursorPos
ReleaseDC
GetDesktopWindow
GetDC
SetRect
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
SetCapture
CloseClipboard
SetCursorPos
WindowFromPoint
IsWindow

gdi32

CreateCompatibleBitmap
SelectObject
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection

advapi32

LsaRetrievePrivateData
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
LookupAccountSidA
CreateServiceA
LockServiceDatabase
StartServiceA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
RegSetKeySecurity
FreeSid
OpenProcessToken
LookupPrivilegeValueA
OpenEventLogA
ClearEventLogA
IsValidSid
LookupAccountNameA
LsaClose
LsaOpenPolicy
LsaFreeMemory
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
RegCreateKeyExA
CloseEventLog
AddAccessAllowedAce

shell32

SHGetSpecialFolderPathA

netapi32

NetUserAdd
NetLocalGroupAddMembers

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle

msvfw32

ICSendMessage
ICCompressorFree
ICClose
ICOpen
ICSeqCompressFrameStart
ICSeqCompressFrame

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6159cf64e694463f1f6f66975285b439

Headers

File Characteristics

Imports

shlwapi

winmm

msvcrt

ws2_32

msvcp60

mfc42

kernel32

user32

gdi32

advapi32

shell32

netapi32

wininet

msvfw32

psapi

wtsapi32

Sections

.text Size: 140KB - Virtual size: 138KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 20KB - Virtual size: 23KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 140KB - Virtual size: 138KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 20KB - Virtual size: 23KB

.rsrc
Size: 4KB - Virtual size: 1KB