ef0f4ea42a75427b3436204d9d5a7635d4d8a35865e25feedcc532f4df83865d

Sharing

Copy URL Twitter E-mail

General

Target

ef0f4ea42a75427b3436204d9d5a7635d4d8a35865e25feedcc532f4df83865d
Size

63KB
MD5

0c69dac61122d988d6d1246f1e0514b0
SHA1

ad427312f572f64f6a9b97fb90cb505283959e66
SHA256

ef0f4ea42a75427b3436204d9d5a7635d4d8a35865e25feedcc532f4df83865d
SHA512

ab5d90ef944800740f5d9f1cfd05ab08c68c9cd0afbc594cca70394acb2f0d3629bd14abf29ea7d6cba351668a37b88dbb12391dc52cc78fa8796ec230f24724
SSDEEP

1536:siwLliXu2vrdVTFVUhkIOGw7sc7LQZTmp590:0YueW+IxELZD0

Score

N/A

Malware Config

Signatures

Files

ef0f4ea42a75427b3436204d9d5a7635d4d8a35865e25feedcc532f4df83865d
.exe windows x86

50408b545b36bd2478bb219cff205bb5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CreateIconFromResource
CreateDesktopW
SendMessageA
WindowFromPoint
GetLastActivePopup
DrawStateA
ShowWindow
GetMenuInfo
CheckDlgButton
DefWindowProcA
DefWindowProcW
SetClipboardData
SetWindowPos
LoadMenuW
GetScrollBarInfo
PeekMessageW
GetMenuItemInfoW
EndDialog
GetKeyboardLayoutNameA
ToAscii
DdeCreateDataHandle
MessageBoxIndirectA
InflateRect
DdeEnableCallback
DeleteMenu
UnregisterDeviceNotification
ChildWindowFromPointEx
IMPGetIMEW
DialogBoxParamA
DefDlgProcA
FindWindowExW
IsCharAlphaW
GetScrollPos
DrawAnimatedRects
ImpersonateDdeClientWindow
LoadCursorW
CreateMenu
GetSysColorBrush
LookupIconIdFromDirectoryEx
IMPSetIMEW
CreateMDIWindowA
DrawTextExW
GetTabbedTextExtentW
GetCursorInfo
ScrollWindow
CopyAcceleratorTableW
SwitchToThisWindow
CheckMenuItem

gdi32

BeginPath
CreateScalableFontResourceW
GetTextMetricsW
SetMapperFlags
ColorMatchToTarget
StartDocA
EnumFontsW
GetGraphicsMode
PtInRegion
OffsetViewportOrgEx
GetFontUnicodeRanges
GetViewportExtEx
GetColorAdjustment
GetPath
SelectClipPath
GdiEndPageEMF
ResetDCA
GdiStartPageEMF
PolyDraw
DeleteObject
SetTextCharacterExtra
SetBitmapBits
CreatePatternBrush
GetGlyphOutlineW
GdiResetDCEMF

winmm

mixerMessage
waveOutSetVolume
waveOutGetPosition
midiDisconnect
aux32Message
midiOutCachePatches
timeKillEvent
auxGetDevCapsA
mmioSetBuffer
midiOutReset
auxGetVolume
mixerGetControlDetailsA
mciSendStringW
waveOutUnprepareHeader
waveOutClose
mmioGetInfo
waveInAddBuffer
waveInGetErrorTextA
joyGetDevCapsW
waveOutPrepareHeader
mciSendCommandW
midiOutGetDevCapsA
waveOutGetNumDevs
OpenDriver
mciGetDeviceIDFromElementIDW
midiInAddBuffer
joySetThreshold
midiOutShortMsg
auxSetVolume
PlaySoundW
wid32Message
mixerGetLineControlsW
waveInReset
mixerOpen
waveOutGetDevCapsW
mciGetYieldProc
CloseDriver
mmioSendMessage
waveOutGetErrorTextA
mmioWrite
midiStreamStop
mciGetDeviceIDA
midiStreamOpen
mciGetDeviceIDFromElementIDA
auxGetNumDevs
mixerClose
GetDriverModuleHandle
auxGetDevCapsW
midiOutSetVolume
midiInGetID
waveInGetPosition
auxOutMessage
mciGetDeviceIDW
midiInStop
waveOutOpen
midiInStart
joyGetPosEx
midiInMessage
waveOutMessage
waveOutGetDevCapsA
midiOutUnprepareHeader
waveOutRestart
mmioInstallIOProcA
joyGetPos
waveInStart
WOW32DriverCallback
midiInReset
midiOutGetErrorTextA
mmioRenameA
mmsystemGetVersion
mixerGetControlDetailsW
waveInPrepareHeader
midiOutPrepareHeader
midiInGetDevCapsW
mciGetDriverData
waveInMessage
DefDriverProc
mciFreeCommandResource
midiInOpen
mciSetYieldProc
joyReleaseCapture
mmioAdvance
joyGetDevCapsA
midiInClose
joySetCapture
waveOutGetPlaybackRate
waveOutPause
mciSendStringA
mixerGetLineInfoW
mixerSetControlDetails
midiStreamOut
tid32Message
waveOutWrite
wod32Message
mciLoadCommandResource
mmioAscend

tapi32

lineGetDevCapsA
lineGetTranslateCapsW
lineGetAgentGroupListW
NonAsyncEventThread
lineGetAgentCapsW
lineRedirectW
tapiRequestDrop
phoneSetHookSwitch
lineDeallocateCall
lineForwardA
MMCSetPhoneInfo
lineGetProviderListW
lineMonitorDigits
lineBlindTransferA
lineGetMessage
lineSetDevConfigW
phoneDevSpecific
lineOpenW
lineSetCallData
phoneGetRing
lineNegotiateExtVersion
lineUnparkA
lineSetDevConfigA
lineCompleteCall
lineMakeCallA
lineSetupConferenceW
lineCreateAgentW
lineMonitorMedia
LocWizardDlgProc
lineMakeCallW
MMCGetPhoneInfo
lineParkA
lineParkW

imm32

ImmGetIMCLockCount
ImmEscapeW
ImmAssociateContextEx
ImmSetCompositionStringA
ImmGetContext
ImmInstallIMEA
ImmGetCandidateListW
ImmGetGuideLineA
ImmLockIMCC
ImmSetCompositionWindow
ImmSetOpenStatus
ImmConfigureIMEW
ImmRegisterWordW
ImmEnumRegisterWordW
ImmSetCompositionFontA
ImmShowSoftKeyboard
ImmGetConversionListA
ImmDestroyIMCC
ImmGetCompositionFontW
ImmGetDescriptionW
ImmInstallIMEW
ImmGetIMCCLockCount
ImmEnumRegisterWordA
ImmReleaseContext
ImmReSizeIMCC
ImmRequestMessageA
ImmUnregisterWordA
ImmUnregisterWordW
ImmGetCompositionStringW
ImmGetRegisterWordStyleA
ImmDisableIME
ImmGetDefaultIMEWnd
ImmGetCompositionWindow
ImmGetVirtualKey
ImmGetHotKey
ImmSetCandidateWindow
ImmGetCompositionStringA
ImmCreateContext
ImmCreateIMCC
ImmGetOpenStatus
ImmGetCandidateListCountA
ImmIsUIMessageW
ImmDestroySoftKeyboard
ImmGenerateMessage
ImmGetCandidateListCountW
ImmGetProperty
ImmGetConversionStatus
ImmIsIME
ImmGetDescriptionA
ImmUnlockIMCC

shlwapi

UrlCompareW
SHOpenRegStreamA
AssocQueryKeyA
SHRegCloseUSKey
SHRegDuplicateHKey
UrlIsOpaqueW
StrStrIA
PathRemoveFileSpecW
AssocQueryStringA
ColorAdjustLuma
SHQueryValueExW
SHRegQueryUSValueA
PathIsDirectoryW
StrCmpNA
StrNCatA
SHAutoComplete
PathCompactPathA
PathFindExtensionA
PathIsContentTypeW
StrNCatW
ColorRGBToHLS
UrlGetPartA
PathIsNetworkPathW
StrCatBuffW
UrlGetLocationW
SHRegDeleteUSValueA

msvcrt

toupper
_wexeclpe
_wputenv
_mbsncat
_wfindnext
fopen
_wcsset
_mktemp
fputws
strncmp
_wcsicmp
_seterrormode
__initenv
time
sprintf
_mbbtombc
_execle
_kbhit
swscanf
_wcsnset
_safe_fprem
_wtmpnam
printf
sinh
_wspawnve
_ultoa
__lc_collate_cp
islower
_mbscpy
fgetpos
iscntrl
free
__p__wenviron
_ismbbtrail
atan
fread
iswpunct

samlib

SamLookupNamesInDomain
SamChangePasswordUser
SamSetSecurityObject
SamRemoveMemberFromAlias
SamCreateAliasInDomain
SamRemoveMultipleMembersFromAlias
SamQuerySecurityObject
SamGetMembersInGroup
SamRemoveMemberFromGroup
SamDeleteAlias
SamSetInformationGroup
SamiSetDSRMPassword
SamEnumerateGroupsInDomain
SamiSetBootKeyInformation
SamCreateUser2InDomain
SamGetAliasMembership
SamCloseHandle
SamLookupIdsInDomain
SamiEncryptPasswords
SamDeleteGroup
SamAddMultipleMembersToAlias
SamOpenUser
SamEnumerateDomainsInSamServer
SamiChangePasswordUser
SamQueryInformationDomain
SamSetMemberAttributesOfGroup
SamChangePasswordUser2
SamEnumerateUsersInDomain
SamQueryInformationGroup

mpr

WNetGetResourceParentW
WNetGetConnectionA
WNetGetResourceInformationW
WNetGetNetworkInformationA
WNetAddConnectionW
WNetGetConnectionW
WNetGetLastErrorA
WNetGetUniversalNameW
WNetAddConnection2W
WNetGetNetworkInformationW
WNetCloseEnum
WNetDisconnectDialog
WNetSetLastErrorW
WNetGetLastErrorW
WNetAddConnection3W
WNetGetProviderNameA
WNetOpenEnumW
WNetGetUserA
WNetCancelConnectionA

mswsock

TransmitFile
GetNameByTypeW
getnetbyname
dn_expand
GetAcceptExSockaddrs
EnumProtocolsA
sethostname
rcmd
rexec
SetServiceW
GetNameByTypeA
GetServiceW
AcceptEx
GetServiceA

ole32

HMETAFILEPICT_UserUnmarshal
HMENU_UserFree
CreateStdProgressIndicator
WdtpInterfacePointer_UserFree
CoGetCancelObject
CoGetCurrentLogicalThreadId
ProgIDFromCLSID
OleDuplicateData
StgGetIFillLockBytesOnFile
OleCreateLinkToFileEx
HBITMAP_UserSize
CreateBindCtx
EnableHookObject
OleCreateFromFile
HENHMETAFILE_UserUnmarshal
CoGetApartmentID
IsValidPtrIn
GetRunningObjectTable
HMENU_UserMarshal
HICON_UserUnmarshal

kernel32

SetThreadPriority
WideCharToMultiByte
GetProcAddress
InitializeCriticalSection
GetModuleHandleA

shell32

CheckEscapesW
DuplicateIcon
ExtractAssociatedIconExA
SHGetSpecialFolderPathA
SHFileOperationW
SHGetSettings
SHBrowseForFolderW
SHGetNewLinkInfoW
SHGetFileInfoW
DragQueryFileA
SHCreateProcessAsUserW

iphlpapi

UnenableRouter
GetAdapterOrderMap
InternalSetIpStats
SetIfEntry
DeleteIpNetEntry
NotifyRouteChange
IpRenewAddress
InternalGetIpAddrTable
InternalGetTcpTable
InternalGetIfTable
NhGetInterfaceNameFromGuid
DeleteProxyArpEntry
GetBestRoute
SendARP
NhpAllocateAndGetInterfaceInfoFromStack
EnableRouter
GetIcmpStatistics
SetIpForwardEntry
GetAdapterIndex
GetRTTAndHopCount
NTPTimeToNTFileTime
SetIpTTL
GetInterfaceInfo
GetUniDirectionalAdapterInfo
InternalSetIpNetEntry
GetIpAddrTable
GetUdpTable
SetAdapterIpAddress
GetIpForwardTable
InternalCreateIpForwardEntry
CreateIpNetEntry

Sections

.text
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

50408b545b36bd2478bb219cff205bb5

Headers

File Characteristics

Imports

user32

gdi32

winmm

tapi32

imm32

shlwapi

msvcrt

samlib

mpr

mswsock

ole32

kernel32

shell32

iphlpapi

Sections

.text Size: 33KB - Virtual size: 33KB

.xdata Size: 9KB - Virtual size: 8KB

.rdata Size: 12KB - Virtual size: 12KB

.rsrc Size: 7KB - Virtual size: 8KB

.bss Size: 512B - Virtual size: 2KB

.text
Size: 33KB - Virtual size: 33KB

.xdata
Size: 9KB - Virtual size: 8KB

.rdata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 7KB - Virtual size: 8KB

.bss
Size: 512B - Virtual size: 2KB