71de6c2a6a0cc596236d78ea9f1f755347714bf5d0c68f7c6df753eae39683bd

Sharing

Copy URL Twitter E-mail

General

Target

71de6c2a6a0cc596236d78ea9f1f755347714bf5d0c68f7c6df753eae39683bd
Size

417KB
MD5

0751a0c49b93accac305004849afaece
SHA1

913eef4f2ab25145b06926374cd61eff43897420
SHA256

71de6c2a6a0cc596236d78ea9f1f755347714bf5d0c68f7c6df753eae39683bd
SHA512

c4dcd397dddadc53a9e02f6b0207b1761ef43f8e53476d4efc7a69d9900f1aa4fb9c74d6a445659a66992180f26a6edf8d7a8f897e6fca67f9fba4a0d330e11f
SSDEEP

12288:taBRxK7rt0qBWZ0HO6GNbi9FVCV+jmw66NuX1tFg:4Bap4e2ODVd66NuXzFg

Score

N/A

Malware Config

Signatures

Files

71de6c2a6a0cc596236d78ea9f1f755347714bf5d0c68f7c6df753eae39683bd
.dll windows x86

b3e08fceaefda6957e403f7cc0c84ed3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
CloseServiceHandle
ControlService
CreateProcessAsUserW
DuplicateTokenEx
FreeSid
GetUserNameW
InitializeSecurityDescriptor
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorSacl
SetTokenInformation
StartServiceW

user32

BringWindowToTop
CopyRect
CreateDialogParamW
CreateWindowExW
DestroyWindow
DialogBoxParamW
EnableWindow
EndDialog
ExitWindowsEx
GetClientRect
GetDesktopWindow
GetDlgItem
GetDlgItemTextW
GetParent
GetSystemMetrics
wsprintfW
ShowWindow
SetWindowTextW
SetWindowPos
SetTimer
SetForegroundWindow
SetDlgItemTextW
SetActiveWindow
SendMessageW
PostMessageW
OffsetRect
MessageBoxW
LoadStringW
LoadImageW
KillTimer
IsWindow
GetWindowRect

wininet

InternetCloseHandle
InternetConnectW
InternetOpenW
InternetQueryDataAvailable
HttpSendRequestW
InternetReadFile
InternetSetOptionW
InternetSetStatusCallbackW
HttpQueryInfoW
HttpOpenRequestW
InternetQueryOptionW
HttpAddRequestHeadersA

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHCreateDirectoryExW
CommandLineToArgvW

shlwapi

PathCompactPathExW

ole32

CoUninitialize
CoInitializeEx

gdi32

SetBkColor
CreateSolidBrush

kernel32

WriteConsoleA
WideCharToMultiByte
WaitNamedPipeW
WaitForSingleObject
WaitForMultipleObjects
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
TerminateThread
TerminateProcess
WriteConsoleW
SetUnhandledExceptionFilter
SetStdHandle
SetLastError
SetHandleCount
SetFilePointer
SetEvent
SetErrorMode
SetEnvironmentVariableA
SetEndOfFile
SearchPathW
RtlUnwind
ResetEvent
ReleaseMutex
ReadFile
RaiseException
QueryPerformanceCounter
Process32NextW
Process32FirstW
OutputDebugStringW
OpenProcess
OpenMutexW
OpenEventA
MultiByteToWideChar
MoveFileW
MoveFileExW
LocalFree
LoadLibraryW
LoadLibraryA
LeaveCriticalSection
LCMapStringW
LCMapStringA
IsValidLocale
IsValidCodePage
IsDebuggerPresent
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
HeapSize
HeapReAlloc
HeapFree
WriteFile
SystemTimeToFileTime
AllocConsole
CancelIo
CloseHandle
CompareStringA
CompareStringW
CopyFileW
CreateEventA
CreateEventW
CreateFileA
CreateMutexW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
DisconnectNamedPipe
EnterCriticalSection
EnumSystemLocalesA
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetEnvironmentStringsA
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesW
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessPriorityBoost
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeExW
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatA
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExW
HeapAlloc
HeapCreate

rpcrt4

UuidToStringW
UuidFromStringW
UuidCreate
RpcStringFreeW

Exports

Exports

Dir
Instance_NewRaw
read_info
write_png

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3e08fceaefda6957e403f7cc0c84ed3

Headers

File Characteristics

Imports

advapi32

user32

wininet

version

shell32

shlwapi

ole32

gdi32

kernel32

rpcrt4

Exports

Exports

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 256KB - Virtual size: 256KB

.data Size: 70KB - Virtual size: 71KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 256KB - Virtual size: 256KB

.data
Size: 70KB - Virtual size: 71KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 3KB - Virtual size: 3KB