f05c2e38696995ac204ddfd146ab09df3aa6db709fa5339c8f06a6e5b736d1d9

Sharing

Copy URL

Twitter E-mail

General

Target

f05c2e38696995ac204ddfd146ab09df3aa6db709fa5339c8f06a6e5b736d1d9
Size

221KB
MD5

0785ce2df88165821201c37e954dc354
SHA1

70f533288bfcaae297fb38cd8f3ee1beea123d03
SHA256

f05c2e38696995ac204ddfd146ab09df3aa6db709fa5339c8f06a6e5b736d1d9
SHA512

b8614fbbee42549e54df2b226efeb42b4418f3fac0513dd4cedb18767b451f4a8f40b22b6c00e4a95373165a92144fc08700dea1d76f3b00f552406092ac713f
SSDEEP

6144:zwi0DtjyqqDLSCwlGDsQDReB/o0AA+nxkLT7GaQVywJi1:zwi0DtjHqnlCIReGsYkL//AJE

Score

N/A

Malware Config

Signatures

Files

f05c2e38696995ac204ddfd146ab09df3aa6db709fa5339c8f06a6e5b736d1d9
.exe windows x86

219652eca66647c010561a8731507cdb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAllocEx
FindClose
LoadLibraryA
Process32FirstW
RemoveDirectoryW
QueryDosDeviceW
WaitForMultipleObjects
Process32NextW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
CreateThread
ExpandEnvironmentStringsW
MoveFileExW
GetUserDefaultUILanguage
GetCurrentThreadId
ExitThread
CreateRemoteThread
SetHandleInformation
CreatePipe
HeapDestroy
ResetEvent
CreateEventW
TerminateProcess
GetLocalTime
VirtualProtectEx
TlsGetValue
TlsSetValue
SetThreadPriority
GlobalLock
GlobalUnlock
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetNativeSystemInfo
GetThreadContext
SetThreadContext
GetProcessId
ReadProcessMemory
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualAlloc
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
lstrlenW
MultiByteToWideChar
GetTimeZoneInformation
ReadFile
Thread32Next
lstrcpynW
GetModuleHandleA
HeapCreate
VirtualFree
GetCurrentThread
GetTickCount
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetFileAttributesExW
GetModuleFileNameW
EnterCriticalSection
WaitForSingleObject
GetPrivateProfileIntW
FlushFileBuffers
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
GetModuleHandleW
SetFileAttributesW
CloseHandle
lstrcmpiW
WTSGetActiveConsoleSessionId
GetProcAddress
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
ExitProcess
ReleaseMutex

user32

CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerBuffA
CharLowerA
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
EndPaint
GetMessageA
GetKeyboardLayoutList
GetMessageW
RegisterClassExA
GetWindowDC
SetCapture
DefDlgProcW
DefFrameProcA
ExitWindowsEx
MessageBoxA
IsRectEmpty
SendMessageW
PrintWindow
EqualRect
GetWindowRect
GetParent
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
MapWindowPoints
DrawIcon
GetIconInfo
MapVirtualKeyW
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
HiliteMenuItem
GetMenuItemCount
EndMenu
GetWindowThreadProcessId
GetWindowLongW
GetShellWindow
OpenInputDesktop
BeginPaint
GetUpdateRect
GetKeyboardState
ToUnicode
FillRect
PostMessageW
GetWindowInfo
DrawEdge
GetDC
GetCapture
TranslateMessage
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
GetDCEx
PeekMessageA
ReleaseDC
DefWindowProcA
GetCursorPos
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
ReleaseCapture
RegisterClassW
IntersectRect
GetUpdateRgn
PostThreadMessageW
CallWindowProcA
CallWindowProcW
DefWindowProcW
GetMessagePos
DefFrameProcW
RegisterClassA
CharToOemW
GetSystemMetrics
CharLowerW

advapi32

EqualSid
CreateProcessAsUserA
CreateProcessAsUserW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
AllocateAndInitializeSid
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
RegOpenKeyExW
GetSecurityDescriptorSacl
CheckTokenMembership
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
SetSecurityInfo
RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW
GetLengthSid
InitiateSystemShutdownExW
IsWellKnownSid
RegEnumKeyExW
ConvertSidToStringSidW

shlwapi

PathUnquoteSpacesW
StrStrIW
StrStrIA
PathQuoteSpacesW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathRemoveFileSpecW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRenameExtensionW
StrCmpNIW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

SelectObject
CreateCompatibleBitmap
GetDIBits
GetDeviceCaps
CreateDIBSection
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
GdiFlush
DeleteDC
SetViewportOrgEx
DeleteObject

ws2_32

closesocket
WSASend
getaddrinfo
freeaddrinfo
recv
sendto
getsockname
select
recvfrom
inet_addr
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
gethostbyname
send
WSAGetLastError
accept
listen
WSASetLastError
socket
bind
setsockopt
getpeername

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore

wininet

HttpSendRequestW
HttpOpenRequestA
HttpOpenRequestW
InternetSetFilePointer
HttpSendRequestA
InternetSetStatusCallbackA
HttpAddRequestHeadersA
InternetGetCookieA
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
InternetQueryOptionA
InternetOpenA
HttpAddRequestHeadersW
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpEndRequestW
InternetReadFile
HttpSendRequestExA
HttpQueryInfoA
HttpSendRequestExW
InternetQueryDataAvailable
InternetReadFileExA
HttpEndRequestA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

219652eca66647c010561a8731507cdb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 208KB - Virtual size: 207KB

.data Size: 2KB - Virtual size: 11KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 208KB - Virtual size: 207KB

.data
Size: 2KB - Virtual size: 11KB

.reloc
Size: 8KB - Virtual size: 8KB