f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4

Sharing

Copy URL

Twitter E-mail

General

Target

f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4
Size

128KB
MD5

085f9c1d660c374c6051e1e7e602d28b
SHA1

36454d715f5d3913f58a51979826514a92c6e3a4
SHA256

f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4
SHA512

fd228c9dbedad25d580bae59162877ed178d5a12cc0d46e24a15e9fd0d48c5407453e5b41446fd9f14e99e024f842909f6d65851304889212fb90b3dc1e4fc3b
SSDEEP

3072:Cb6YGQ6PbTVOlsN+NeaVwHw7SfxvLsm7rGEG1kvQ0rjbn/BSVR:ilI7U4w7SWmfGEZPP0VR

Score

N/A

Malware Config

Signatures

Files

f5d911dfc969d6d89f8f3f1dc6cab5de43620443b177473a37d0a81ef80317b4
.dll windows x86

5f8f587a136bca2185881dac9fb9e007

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Module32NextW
LocalSize
GetProcessVersion
ClearCommError
CreatePipe
SetCalendarInfoW
BeginUpdateResourceA
ReadConsoleInputW
IsDBCSLeadByteEx
GetFileAttributesExW
SetConsoleMode
WaitCommEvent
BuildCommDCBW
GetVDMCurrentDirectories
MoveFileA
WriteTapemark
FillConsoleOutputAttribute
MapViewOfFileEx
IsBadCodePtr
SetFilePointerEx
IsBadHugeReadPtr
CreateMailslotW
lstrcmpW
GetSystemTime
EnumCalendarInfoW
VerifyConsoleIoHandle
CreateFileMappingW
GetVolumeInformationW
FindFirstVolumeMountPointA
BackupRead
FindNextVolumeMountPointA
HeapReAlloc
GlobalFix
GetVersion
HeapLock
GetSystemDirectoryA
GetFileAttributesW
SetConsoleKeyShortcuts
DosDateTimeToFileTime
ExitVDM
SuspendThread
GetProfileIntW
CreateJobObjectA
TlsFree
GetConsoleKeyboardLayoutNameW
GetThreadPriorityBoost
OpenEventW
SetWaitableTimer
GetSystemDefaultLCID
QueryDosDeviceW
FindFirstVolumeA
GetProfileSectionW
SetConsoleCursorInfo
SignalObjectAndWait
RegisterWowExec
SetVolumeMountPointW
RtlUnwind
LoadLibraryA
LocalLock
GetModuleHandleA
VDMOperationStarted
GetLogicalDriveStringsA
FileTimeToDosDateTime
WriteConsoleInputW
GlobalLock
VirtualUnlock
FreeResource
DisconnectNamedPipe
CreateProcessW
OpenSemaphoreA
GetConsoleAliasExesLengthA
GetLongPathNameA
GetQueuedCompletionStatus
HeapSummary
EnumResourceNamesW
GetModuleHandleW
QueueUserWorkItem
InterlockedIncrement
ReadConsoleInputA
RemoveDirectoryA
GlobalFlags
GetPrivateProfileIntA
GetProcAddress
LocalHandle
MoveFileWithProgressA
GetUserDefaultLangID
IsValidLocale
GetHandleInformation
VirtualAlloc
FillConsoleOutputCharacterA

user32

GetPriorityClipboardFormat
GetMessageTime
SendDlgItemMessageW
DdeKeepStringHandle
GetGuiResources
GetUpdateRgn
CountClipboardFormats
DrawIcon
GetSystemMetrics
CreateCursor
GetCaretBlinkTime
AppendMenuA
CharToOemA
GetMenuItemCount
GetLastInputInfo

gdi32

CreateColorSpaceW
CreateFontA
EnumEnhMetaFile
EnumFontFamiliesExW
ExcludeClipRect
SetTextAlign
ResetDCA
GetDCPenColor
PolyPolygon
GetCharABCWidthsI
GetTextExtentPoint32A
AbortDoc
ModifyWorldTransform
SetDCBrushColor
GdiComment
EnumFontFamiliesA
CopyEnhMetaFileA
PlgBlt
GdiPlayEMF
EnumFontsW
ExtFloodFill
RealizePalette
PlayMetaFileRecord
SelectClipPath
SetViewportOrgEx
GdiGetBatchLimit
GetDeviceCaps
GetColorAdjustment
GetMetaFileW
CreateEllipticRgn
SetPaletteEntries
SelectClipRgn
EnumObjects
GetDCOrgEx
GetTextFaceW
AngleArc
FillPath
AddFontResourceExA
GetFontUnicodeRanges
SetSystemPaletteUse
CreateDIBSection
PolyTextOutA
GetEnhMetaFileBits
GdiGetSpoolFileHandle
TextOutW
SetDeviceGammaRamp
CreatePen
CreateHalftonePalette
CreateHatchBrush
GetROP2
PolyPolyline
GetBkMode
LineTo
PaintRgn
SelectBrushLocal
SetRectRgn
GetTextExtentPointA
EudcLoadLinkW
MaskBlt
GetSystemPaletteUse
MoveToEx
DeleteColorSpace
AbortPath
DescribePixelFormat
GetTextExtentExPointW
ResizePalette
FlattenPath
RemoveFontResourceExW
GdiGetPageCount
GetCharWidthI
OffsetWindowOrgEx
GetNearestPaletteIndex
EndDoc
EnumICMProfilesW
GetCurrentObject
GetCurrentPositionEx
GetTextCharacterExtra
GetViewportOrgEx
GetTextCharsetInfo
LPtoDP
GetTextColor
CreateRectRgnIndirect
GetObjectW
EndPath
CreateRectRgn
GetTextExtentPoint32W
GetCharacterPlacementA
SetPixel

advapi32

GetTokenInformation
OpenSCManagerW
ConvertSidToStringSidA
CryptDuplicateHash
SetFileSecurityW
ElfDeregisterEventSource
LsaSetSecret
RegCloseKey
RegConnectRegistryA
BuildTrusteeWithNameW
PrivilegeCheck
AccessCheckAndAuditAlarmW
LsaSetQuotasForAccount
ImpersonateLoggedOnUser
LookupAccountNameW
BuildImpersonateExplicitAccessWithNameW
BuildSecurityDescriptorA
CryptDestroyKey
LsaClose
GetSecurityDescriptorControl
SetSecurityDescriptorSacl
RegDeleteValueW
GetCurrentHwProfileW
TrusteeAccessToObjectA
LsaQueryTrustedDomainInfo
ChangeServiceConfigW
AbortSystemShutdownW
DeregisterEventSource
SystemFunction007
GetSecurityDescriptorSacl
AccessCheckByTypeAndAuditAlarmA
SystemFunction005
ChangeServiceConfig2A
RegEnumKeyW
IsValidSid
MakeAbsoluteSD
SystemFunction028
SetEntriesInAuditListA
SetServiceObjectSecurity
CreateProcessAsUserA
GetNamedSecurityInfoExA
ReportEventA
SetNamedSecurityInfoExA
AllocateAndInitializeSid
ElfReportEventA
GetServiceKeyNameA
GetTrusteeTypeA
RegEnumValueA
RegRestoreKeyW
AddAccessAllowedAce
AccessCheckByType

comctl32

ord8
ImageList_Add
ord7
ImageList_AddMasked
ImageList_Remove
ImageList_GetBkColor
ord16
ord14
ord13
UninitializeFlatSB
FlatSB_SetScrollPos
ImageList_Create
ImageList_DragLeave
ImageList_DrawEx
ord3
ImageList_DrawIndirect
FlatSB_SetScrollProp
ImageList_GetIcon
ImageList_SetOverlayImage
ImageList_ReplaceIcon
ImageList_Read
ImageList_Copy

shell32

SHLoadInProc
SHGetSettings
SHChangeNotify
SHGetSpecialFolderLocation
ShellHookProc
FindExecutableW
StrChrA
SHGetFileInfoW
RealShellExecuteA
StrChrW
StrStrW
ExtractIconExW
SHBrowseForFolderW
SHGetMalloc
StrStrIA
SHGetFileInfoA
StrRStrIA
ExtractAssociatedIconExA
DragQueryPoint
StrNCmpW
InternalExtractIconListA
CheckEscapesW
StrCmpNIW
DoEnvironmentSubstW
StrNCmpIA
SheSetCurDrive
WOWShellExecute
InternalExtractIconListW
StrRChrW
SHGetInstanceExplorer
StrCmpNA
SHFormatDrive
DragAcceptFiles
ExtractIconA
DoEnvironmentSubstA
DragQueryFileW
StrRChrIA
StrRStrA
ShellAboutW
ExtractAssociatedIconExW
SHFileOperationW
SHGetSpecialFolderPathW
FindExecutableA
SHUpdateRecycleBinIcon
SHGetDesktopFolder
StrCmpNW
StrStrIW
SHInvokePrinterCommandA
SHGetSpecialFolderPathA
SHAddToRecentDocs
SHQueryRecycleBinA
StrRStrIW
RealShellExecuteExW
StrChrIW

shlwapi

UrlIsNoHistoryA
StrToIntExA
SHRegSetUSValueW
SHRegDeleteEmptyUSKeyA
SHRegWriteUSValueA
PathCompactPathExW
UrlUnescapeW
PathCombineA
PathMakeSystemFolderA
PathSkipRootW
SHRegGetUSValueW
PathCombineW
PathAddBackslashA
SHDeleteEmptyKeyA
PathRelativePathToA
PathRemoveFileSpecA
SHRegQueryInfoUSKeyA
StrFromTimeIntervalW
PathAddExtensionW
IntlStrEqWorkerA
SHRegOpenUSKeyW
SHDeleteKeyW
StrIsIntlEqualA
StrIsIntlEqualW
PathGetCharTypeA
PathIsRootW
PathUnmakeSystemFolderW
StrFormatByteSizeW
SHCreateShellPalette
PathFindFileNameW
SHSetValueA
SHRegCloseUSKey
PathIsRelativeW
PathIsSystemFolderW
StrCSpnIA
PathCommonPrefixA
PathCreateFromUrlW
SHRegDeleteUSValueW
PathUnmakeSystemFolderA
PathIsURLA
PathCreateFromUrlA
SHOpenRegStreamW
PathIsSameRootA
PathMakePrettyA
PathStripPathW
PathQuoteSpacesA
UrlCreateFromPathA
SHEnumKeyExW
PathMakePrettyW
PathIsSystemFolderA
PathIsUNCServerShareW
StrPBrkA
PathFindOnPathA
PathQuoteSpacesW
SHIsLowMemoryMachine
StrDupA
PathIsURLW
UrlIsA
PathSkipRootA
PathStripToRootW
SHGetValueA
PathGetArgsW
SHEnumKeyExA
SHEnumValueW
SHRegDeleteUSValueA
PathParseIconLocationW
PathStripPathA
PathCompactPathW
PathBuildRootA
SHRegEnumUSKeyW
StrTrimA
UrlGetPartW
PathRemoveBackslashW
SHRegSetUSValueA
UrlGetLocationW
UrlHashW
PathRemoveBackslashA
PathAddExtensionA
StrCatW
GetMenuPosFromID

version

GetFileVersionInfoSizeA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
VerFindFileA

winmm

tid32Message
WOW32ResolveMultiMediaHandle
midiInUnprepareHeader
mmioClose
joyReleaseCapture
mciSendStringA
timeKillEvent
mmioRead
waveInOpen
mod32Message
mmioInstallIOProcA
waveInGetDevCapsA
waveOutGetID
WOWAppExit
wod32Message
midiInGetDevCapsA
WOW32DriverCallback
mmioWrite
midiStreamPosition
waveOutMessage
midiConnect
midiInMessage
mmioDescend
joySetCapture
midiInOpen
midiInPrepareHeader
waveInGetDevCapsW
mmsystemGetVersion

msvcrt

fseek
_fpieee_flt
__setlc_active
sprintf
_memccpy
fclose
fopen
_futime
fwrite
putchar
_fullpath
fputc
__pioinfo
atan
ferror
_seterrormode
setvbuf
_exit
_snwprintf
fread
strtoul
_endthread
towlower
_mbslwr
_CIsin
_dup
towupper
_filbuf
_unlink
getc
iswpunct
wcsrchr
_stricmp
fprintf
feof
_cexit
_wexecle
printf
_CIpow
_wopen
_mbsinc
_ismbcspace
is_wctype
__p__iob
fsetpos
_acmdln
ftell
memset
_wcsicmp
_global_unwind2
_execlpe
strftime
__iscsymf
_wspawnlp
fwprintf
_tzname
time
__p__pgmptr
_adjust_fdiv
fputs
_fcvt
div
_mbsrchr

Exports

Exports

Asih
Cpsto
Fsnd
Hrhiwx
Iwbobu
Vatjxvjnsm

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f8f587a136bca2185881dac9fb9e007

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

shell32

shlwapi

version

winmm

msvcrt

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 52KB - Virtual size: 49KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 52KB - Virtual size: 49KB

.reloc
Size: 8KB - Virtual size: 7KB