4e3ecbe638da2755319ed3b5c17c1ca51f3c4ec67c80ea8e1cba08aca518459a

Sharing

Copy URL Twitter E-mail

General

Target

4e3ecbe638da2755319ed3b5c17c1ca51f3c4ec67c80ea8e1cba08aca518459a
Size

128KB
MD5

0d1a764bacf4605608301983f7f27c8a
SHA1

20f8c7f4bf71eebaa013a84f5c2fd7aa50dc1b4f
SHA256

4e3ecbe638da2755319ed3b5c17c1ca51f3c4ec67c80ea8e1cba08aca518459a
SHA512

5b2596e55e7a92f24243192bd8982c2f2884600f9edfadc868a9f782c2235c6f9faefc8e56c2fa8b2de28afe1cc052c5d948350a783529a94164c19edf251bc2
SSDEEP

3072:m6YGJwPbTVOlsNvNeaVng7SfxvLsm7rGEG1kvQ0rjbn/BSVR:m4u71ng7SWmfGEZPP0VR

Score

N/A

Malware Config

Signatures

Files

4e3ecbe638da2755319ed3b5c17c1ca51f3c4ec67c80ea8e1cba08aca518459a
.dll windows x86

5f8f587a136bca2185881dac9fb9e007

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Module32NextW
LocalSize
GetProcessVersion
ClearCommError
CreatePipe
SetCalendarInfoW
BeginUpdateResourceA
ReadConsoleInputW
IsDBCSLeadByteEx
GetFileAttributesExW
SetConsoleMode
WaitCommEvent
BuildCommDCBW
GetVDMCurrentDirectories
MoveFileA
WriteTapemark
FillConsoleOutputAttribute
MapViewOfFileEx
IsBadCodePtr
SetFilePointerEx
IsBadHugeReadPtr
CreateMailslotW
lstrcmpW
GetSystemTime
EnumCalendarInfoW
VerifyConsoleIoHandle
CreateFileMappingW
GetVolumeInformationW
FindFirstVolumeMountPointA
BackupRead
FindNextVolumeMountPointA
HeapReAlloc
GlobalFix
GetVersion
HeapLock
GetSystemDirectoryA
GetFileAttributesW
SetConsoleKeyShortcuts
DosDateTimeToFileTime
ExitVDM
SuspendThread
GetProfileIntW
CreateJobObjectA
TlsFree
GetConsoleKeyboardLayoutNameW
GetThreadPriorityBoost
OpenEventW
SetWaitableTimer
GetSystemDefaultLCID
QueryDosDeviceW
FindFirstVolumeA
GetProfileSectionW
SetConsoleCursorInfo
SignalObjectAndWait
RegisterWowExec
SetVolumeMountPointW
RtlUnwind
LoadLibraryA
LocalLock
GetModuleHandleA
VDMOperationStarted
GetLogicalDriveStringsA
FileTimeToDosDateTime
WriteConsoleInputW
GlobalLock
VirtualUnlock
FreeResource
DisconnectNamedPipe
CreateProcessW
OpenSemaphoreA
GetConsoleAliasExesLengthA
GetLongPathNameA
GetQueuedCompletionStatus
HeapSummary
EnumResourceNamesW
GetModuleHandleW
QueueUserWorkItem
InterlockedIncrement
ReadConsoleInputA
RemoveDirectoryA
GlobalFlags
GetPrivateProfileIntA
GetProcAddress
LocalHandle
MoveFileWithProgressA
GetUserDefaultLangID
IsValidLocale
GetHandleInformation
VirtualAlloc
FillConsoleOutputCharacterA

user32

GetPriorityClipboardFormat
GetMessageTime
SendDlgItemMessageW
DdeKeepStringHandle
GetGuiResources
GetUpdateRgn
CountClipboardFormats
DrawIcon
GetSystemMetrics
CreateCursor
GetCaretBlinkTime
AppendMenuA
CharToOemA
GetMenuItemCount
GetLastInputInfo

gdi32

CreateColorSpaceW
CreateFontA
EnumEnhMetaFile
EnumFontFamiliesExW
ExcludeClipRect
SetTextAlign
ResetDCA
GetDCPenColor
PolyPolygon
GetCharABCWidthsI
GetTextExtentPoint32A
AbortDoc
ModifyWorldTransform
SetDCBrushColor
GdiComment
EnumFontFamiliesA
CopyEnhMetaFileA
PlgBlt
GdiPlayEMF
EnumFontsW
ExtFloodFill
RealizePalette
PlayMetaFileRecord
SelectClipPath
SetViewportOrgEx
GdiGetBatchLimit
GetDeviceCaps
GetColorAdjustment
GetMetaFileW
CreateEllipticRgn
SetPaletteEntries
SelectClipRgn
EnumObjects
GetDCOrgEx
GetTextFaceW
AngleArc
FillPath
AddFontResourceExA
GetFontUnicodeRanges
SetSystemPaletteUse
CreateDIBSection
PolyTextOutA
GetEnhMetaFileBits
GdiGetSpoolFileHandle
TextOutW
SetDeviceGammaRamp
CreatePen
CreateHalftonePalette
CreateHatchBrush
GetROP2
PolyPolyline
GetBkMode
LineTo
PaintRgn
SelectBrushLocal
SetRectRgn
GetTextExtentPointA
EudcLoadLinkW
MaskBlt
GetSystemPaletteUse
MoveToEx
DeleteColorSpace
AbortPath
DescribePixelFormat
GetTextExtentExPointW
ResizePalette
FlattenPath
RemoveFontResourceExW
GdiGetPageCount
GetCharWidthI
OffsetWindowOrgEx
GetNearestPaletteIndex
EndDoc
EnumICMProfilesW
GetCurrentObject
GetCurrentPositionEx
GetTextCharacterExtra
GetViewportOrgEx
GetTextCharsetInfo
LPtoDP
GetTextColor
CreateRectRgnIndirect
GetObjectW
EndPath
CreateRectRgn
GetTextExtentPoint32W
GetCharacterPlacementA
SetPixel

advapi32

GetTokenInformation
OpenSCManagerW
ConvertSidToStringSidA
CryptDuplicateHash
SetFileSecurityW
ElfDeregisterEventSource
LsaSetSecret
RegCloseKey
RegConnectRegistryA
BuildTrusteeWithNameW
PrivilegeCheck
AccessCheckAndAuditAlarmW
LsaSetQuotasForAccount
ImpersonateLoggedOnUser
LookupAccountNameW
BuildImpersonateExplicitAccessWithNameW
BuildSecurityDescriptorA
CryptDestroyKey
LsaClose
GetSecurityDescriptorControl
SetSecurityDescriptorSacl
RegDeleteValueW
GetCurrentHwProfileW
TrusteeAccessToObjectA
LsaQueryTrustedDomainInfo
ChangeServiceConfigW
AbortSystemShutdownW
DeregisterEventSource
SystemFunction007
GetSecurityDescriptorSacl
AccessCheckByTypeAndAuditAlarmA
SystemFunction005
ChangeServiceConfig2A
RegEnumKeyW
IsValidSid
MakeAbsoluteSD
SystemFunction028
SetEntriesInAuditListA
SetServiceObjectSecurity
CreateProcessAsUserA
GetNamedSecurityInfoExA
ReportEventA
SetNamedSecurityInfoExA
AllocateAndInitializeSid
ElfReportEventA
GetServiceKeyNameA
GetTrusteeTypeA
RegEnumValueA
RegRestoreKeyW
AddAccessAllowedAce
AccessCheckByType

comctl32

ord8
ImageList_Add
ord7
ImageList_AddMasked
ImageList_Remove
ImageList_GetBkColor
ord16
ord14
ord13
UninitializeFlatSB
FlatSB_SetScrollPos
ImageList_Create
ImageList_DragLeave
ImageList_DrawEx
ord3
ImageList_DrawIndirect
FlatSB_SetScrollProp
ImageList_GetIcon
ImageList_SetOverlayImage
ImageList_ReplaceIcon
ImageList_Read
ImageList_Copy

shell32

SHLoadInProc
SHGetSettings
SHChangeNotify
SHGetSpecialFolderLocation
ShellHookProc
FindExecutableW
StrChrA
SHGetFileInfoW
RealShellExecuteA
StrChrW
StrStrW
ExtractIconExW
SHBrowseForFolderW
SHGetMalloc
StrStrIA
SHGetFileInfoA
StrRStrIA
ExtractAssociatedIconExA
DragQueryPoint
StrNCmpW
InternalExtractIconListA
CheckEscapesW
StrCmpNIW
DoEnvironmentSubstW
StrNCmpIA
SheSetCurDrive
WOWShellExecute
InternalExtractIconListW
StrRChrW
SHGetInstanceExplorer
StrCmpNA
SHFormatDrive
DragAcceptFiles
ExtractIconA
DoEnvironmentSubstA
DragQueryFileW
StrRChrIA
StrRStrA
ShellAboutW
ExtractAssociatedIconExW
SHFileOperationW
SHGetSpecialFolderPathW
FindExecutableA
SHUpdateRecycleBinIcon
SHGetDesktopFolder
StrCmpNW
StrStrIW
SHInvokePrinterCommandA
SHGetSpecialFolderPathA
SHAddToRecentDocs
SHQueryRecycleBinA
StrRStrIW
RealShellExecuteExW
StrChrIW

shlwapi

UrlIsNoHistoryA
StrToIntExA
SHRegSetUSValueW
SHRegDeleteEmptyUSKeyA
SHRegWriteUSValueA
PathCompactPathExW
UrlUnescapeW
PathCombineA
PathMakeSystemFolderA
PathSkipRootW
SHRegGetUSValueW
PathCombineW
PathAddBackslashA
SHDeleteEmptyKeyA
PathRelativePathToA
PathRemoveFileSpecA
SHRegQueryInfoUSKeyA
StrFromTimeIntervalW
PathAddExtensionW
IntlStrEqWorkerA
SHRegOpenUSKeyW
SHDeleteKeyW
StrIsIntlEqualA
StrIsIntlEqualW
PathGetCharTypeA
PathIsRootW
PathUnmakeSystemFolderW
StrFormatByteSizeW
SHCreateShellPalette
PathFindFileNameW
SHSetValueA
SHRegCloseUSKey
PathIsRelativeW
PathIsSystemFolderW
StrCSpnIA
PathCommonPrefixA
PathCreateFromUrlW
SHRegDeleteUSValueW
PathUnmakeSystemFolderA
PathIsURLA
PathCreateFromUrlA
SHOpenRegStreamW
PathIsSameRootA
PathMakePrettyA
PathStripPathW
PathQuoteSpacesA
UrlCreateFromPathA
SHEnumKeyExW
PathMakePrettyW
PathIsSystemFolderA
PathIsUNCServerShareW
StrPBrkA
PathFindOnPathA
PathQuoteSpacesW
SHIsLowMemoryMachine
StrDupA
PathIsURLW
UrlIsA
PathSkipRootA
PathStripToRootW
SHGetValueA
PathGetArgsW
SHEnumKeyExA
SHEnumValueW
SHRegDeleteUSValueA
PathParseIconLocationW
PathStripPathA
PathCompactPathW
PathBuildRootA
SHRegEnumUSKeyW
StrTrimA
UrlGetPartW
PathRemoveBackslashW
SHRegSetUSValueA
UrlGetLocationW
UrlHashW
PathRemoveBackslashA
PathAddExtensionA
StrCatW
GetMenuPosFromID

version

GetFileVersionInfoSizeA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
VerFindFileA

winmm

tid32Message
WOW32ResolveMultiMediaHandle
midiInUnprepareHeader
mmioClose
joyReleaseCapture
mciSendStringA
timeKillEvent
mmioRead
waveInOpen
mod32Message
mmioInstallIOProcA
waveInGetDevCapsA
waveOutGetID
WOWAppExit
wod32Message
midiInGetDevCapsA
WOW32DriverCallback
mmioWrite
midiStreamPosition
waveOutMessage
midiConnect
midiInMessage
mmioDescend
joySetCapture
midiInOpen
midiInPrepareHeader
waveInGetDevCapsW
mmsystemGetVersion

msvcrt

fseek
_fpieee_flt
__setlc_active
sprintf
_memccpy
fclose
fopen
_futime
fwrite
putchar
_fullpath
fputc
__pioinfo
atan
ferror
_seterrormode
setvbuf
_exit
_snwprintf
fread
strtoul
_endthread
towlower
_mbslwr
_CIsin
_dup
towupper
_filbuf
_unlink
getc
iswpunct
wcsrchr
_stricmp
fprintf
feof
_cexit
_wexecle
printf
_CIpow
_wopen
_mbsinc
_ismbcspace
is_wctype
__p__iob
fsetpos
_acmdln
ftell
memset
_wcsicmp
_global_unwind2
_execlpe
strftime
__iscsymf
_wspawnlp
fwprintf
_tzname
time
__p__pgmptr
_adjust_fdiv
fputs
_fcvt
div
_mbsrchr

Exports

Exports

Anlr
Cpsto
Fsnd
Hrhiwx
Iwbobu
Vatjxvjnsm

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f8f587a136bca2185881dac9fb9e007

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

shell32

shlwapi

version

winmm

msvcrt

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 52KB - Virtual size: 49KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 52KB - Virtual size: 49KB

.reloc
Size: 8KB - Virtual size: 7KB