b1e2ebc53cd3ea0c654a6a4ce9f41f3f639be41767676a57e5bebecabf947b12

Sharing

Copy URL Twitter E-mail

General

Target

b1e2ebc53cd3ea0c654a6a4ce9f41f3f639be41767676a57e5bebecabf947b12
Size

154KB
MD5

0e5dd48376d43324c937baac1ddc35e0
SHA1

74c4ccc8b30ffbb23a45b6b1337a64ab58657e9a
SHA256

b1e2ebc53cd3ea0c654a6a4ce9f41f3f639be41767676a57e5bebecabf947b12
SHA512

c3e5d0dcbdd593eabbc3910137145ca9e37ccc8574adcc29c6e2085332a912693582cfab14859d15d5cf75772d17ef5d3d4f22435cc347d2535889f50d084e9b
SSDEEP

3072:XaONWTQMWKfC+0xuPvYqSlTeoZk/me4C09+C3YSCzxVZDfy9rH8QdQR+5m:XaOATQKfJ0gPvzSlMmeLCd2fUoQdQRqm

Score

N/A

Malware Config

Signatures

Files

b1e2ebc53cd3ea0c654a6a4ce9f41f3f639be41767676a57e5bebecabf947b12
.exe windows x86

f8652362d5049cb6b30edfc847ad13ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
Process32NextW
lstrcmpiW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
CloseHandle
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
WriteProcessMemory
SetFileAttributesW
CreateThread
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateEventW
TlsAlloc
TlsFree
InitializeCriticalSection
LeaveCriticalSection
IsBadReadPtr
GetLastError
GetCommandLineW
GetFileSize
SetErrorMode
GetComputerNameW
CopyFileW
GetVersionExW
GetModuleFileNameW
CreateFileMappingA
OpenEventW
DuplicateHandle
GetCurrentProcessId
GetNativeSystemInfo
GlobalLock
GlobalUnlock
GetLocalTime
MoveFileExW
GetUserDefaultUILanguage
lstrcmpiA
CreateRemoteThread
Process32FirstW
GetModuleHandleA
ResumeThread
GetThreadContext
SetThreadContext
GetProcessId
WTSGetActiveConsoleSessionId
GetProcessHeap
VirtualFree
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
CreateDirectoryW
HeapFree
Thread32Next
GetFileAttributesW
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
ExitProcess
SetFileTime
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetFileAttributesExW
GetModuleHandleW
GetCurrentProcess
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
SetEvent
TlsGetValue
ReleaseMutex
GetCurrentThreadId
SetLastError
GetTickCount
WaitForSingleObject
ExpandEnvironmentStringsW
LocalFree
GetProcAddress
GetPrivateProfileIntW
LoadLibraryW
GetPrivateProfileStringW
FreeLibrary
EnterCriticalSection
GetSystemTime

user32

DispatchMessageW
RegisterClassExA
DefDlgProcW
DefFrameProcA
OpenInputDesktop
TranslateMessage
RegisterClassExW
MessageBoxA
GetClipboardData
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
CallWindowProcW
GetWindow
RegisterClassA
EndPaint
GetUpdateRgn
GetWindowDC
FillRect
DrawEdge
BeginPaint
OpenDesktopW
GetDC
IntersectRect
GetDCEx
ReleaseDC
SetWindowLongW
CharUpperW
GetSubMenu
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
GetKeyboardState
ToUnicode
GetSystemMetrics
ExitWindowsEx
CharLowerBuffA
DrawIcon
GetIconInfo
MapVirtualKeyW
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
MenuItemFromPoint
GetMenu
GetMenuItemRect
CharToOemW
SetKeyboardState
DefFrameProcW
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
CharLowerW
IsRectEmpty
CharLowerA
EndMenu
GetShellWindow
PostThreadMessageW
EqualRect
PrintWindow
DefWindowProcW
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetWindowLongW
GetAncestor
PeekMessageW
PeekMessageA
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
GetUpdateRect
GetWindowThreadProcessId
GetMessagePos
MapWindowPoints
SendMessageW
ReleaseCapture
IsWindow
SendMessageTimeoutW
GetCursorPos
SetWindowPos
GetUserObjectInformationW

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
InitiateSystemShutdownExW
IsWellKnownSid
RegQueryInfoKeyW
RegEnumValueW
GetLengthSid
ConvertSidToStringSidW
EqualSid

shlwapi

wvnsprintfW
PathRemoveFileSpecW
StrCmpNIW
PathRenameExtensionW
PathIsURLW
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA
StrStrIW
StrStrIA

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

psapi

GetProcessImageFileNameW
GetModuleInformation

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDeviceCaps
RestoreDC
SaveDC

ws2_32

listen
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
WSAEventSelect
getpeername
recvfrom
sendto
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
WSAGetLastError
accept
WSASend
closesocket
send
getsockname

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
VariantClear
SysAllocString
SysFreeString

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8652362d5049cb6b30edfc847ad13ab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

psapi

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 143KB - Virtual size: 143KB

.data Size: 1KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 143KB - Virtual size: 143KB

.data
Size: 1KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 7KB - Virtual size: 6KB