44395cb032d407d8a8472668d7ad7a4a5100f4fd7de7a3b5c44dcf9e319d3c2a

Sharing

Copy URL Twitter E-mail

General

Target

44395cb032d407d8a8472668d7ad7a4a5100f4fd7de7a3b5c44dcf9e319d3c2a
Size

221KB
MD5

0ec0f4be802b39a51c69bb0307a9629e
SHA1

e6eee939ead43a73d7b1f8908d66b54e204e8820
SHA256

44395cb032d407d8a8472668d7ad7a4a5100f4fd7de7a3b5c44dcf9e319d3c2a
SHA512

1ac41dac122f06a6451d5e9a95ff8e024d98dc89db0ff845fc2fb5e6b65c6aa081c701b5664964f286ee663edd459504093e5c5f80f1f239a5327e1307a7c0db
SSDEEP

6144:BB7qqDLZi0D5bsqYim2yrIDHR4tH3kER1UBXSzHip1KnG:BB2qnZi0D1uIx4tHxU1tp1MG

Score

N/A

Malware Config

Signatures

Files

44395cb032d407d8a8472668d7ad7a4a5100f4fd7de7a3b5c44dcf9e319d3c2a
.exe windows x86

c594f4db5e47e4c140d863e954640dea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
Process32FirstW
RemoveDirectoryW
QueryDosDeviceW
Process32NextW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
CreateThread
GetTickCount
SetThreadPriority
GetCurrentThreadId
GetModuleHandleA
CreateRemoteThread
ReadFile
ResetEvent
GlobalLock
GlobalUnlock
GetLocalTime
TlsGetValue
TlsSetValue
TerminateProcess
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
SetHandleInformation
CreatePipe
MoveFileExW
GetThreadContext
SetThreadContext
GetProcessId
GetUserDefaultUILanguage
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
Thread32Next
lstrcpynW
HeapCreate
HeapDestroy
ReadProcessMemory
WideCharToMultiByte
Thread32First
OpenProcess
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
GetNativeSystemInfo
GetCurrentThread
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
ExitThread
SetFileAttributesW
WTSGetActiveConsoleSessionId
lstrcmpiA
LoadLibraryW
CreateDirectoryW
EnterCriticalSection
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
WriteProcessMemory
LocalFree
FreeLibrary
GetCurrentProcessId
CloseHandle
DuplicateHandle
OpenEventW
GetFileAttributesExW
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
SetErrorMode
GetCommandLineW
ExitProcess
ReleaseMutex
WaitForSingleObject
lstrcmpiW
LoadLibraryA
GetProcAddress
ExpandEnvironmentStringsW

user32

CallWindowProcA
CallWindowProcW
DefWindowProcW
DefFrameProcW
RegisterClassA
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
GetMessageA
RegisterClassW
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
EndPaint
SetWindowPos
IsWindow
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
DefMDIChildProcA
DefDlgProcA
SwitchDesktop
DefMDIChildProcW
DefWindowProcA
GetDCEx
GetClipboardData
RegisterClassExW
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
MapVirtualKeyW
FillRect
DrawEdge
IntersectRect
EqualRect
PostThreadMessageW
PrintWindow
GetKeyboardState
GetWindowRect
ToUnicode
GetWindowThreadProcessId
IsRectEmpty
GetUpdateRgn
RegisterClassExA
GetWindowDC
DefDlgProcW
DefFrameProcA
OpenInputDesktop
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerW
GetDC
TranslateMessage
GetWindowLongW
CharLowerA
PeekMessageW
ReleaseDC
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
CharLowerBuffA
BeginPaint
PeekMessageA
GetUpdateRect
CharToOemW
ExitWindowsEx
MessageBoxA
GetKeyboardLayoutList
GetSystemMetrics
DrawIcon
GetIconInfo
GetCursorPos
OpenWindowStationW

advapi32

IsWellKnownSid
GetLengthSid
EqualSid
RegCreateKeyW
RegEnumKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
AllocateAndInitializeSid
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
RegOpenKeyExW
GetSecurityDescriptorSacl
CheckTokenMembership
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
SetSecurityInfo
CreateProcessAsUserA
ConvertSidToStringSidW
RegEnumKeyExW
RegDeleteValueW
RegEnumValueW
InitiateSystemShutdownExW

shlwapi

PathAddExtensionW
PathIsURLW
StrStrIW
StrStrIA
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathRenameExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathFindFileNameW
StrCmpNIW
PathRemoveFileSpecW
PathRemoveBackslashW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

SelectObject
CreateCompatibleBitmap
GetDIBits
GetDeviceCaps
CreateDIBSection
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
GdiFlush
DeleteDC
SetViewportOrgEx
DeleteObject

ws2_32

getsockname
select
getaddrinfo
recvfrom
getpeername
WSAGetLastError
accept
listen
inet_addr
WSAEventSelect
WSASend
gethostbyname
WSAIoctl
connect
WSAAddressToStringW
sendto
recv
freeaddrinfo
closesocket
WSASetLastError
socket
bind
setsockopt
shutdown
WSAStartup
send

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXImportCertStore

wininet

InternetSetOptionA
HttpAddRequestHeadersW
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetSetStatusCallbackA
HttpAddRequestHeadersA
InternetGetCookieA
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpEndRequestW
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetReadFile
HttpQueryInfoA
InternetConnectA
InternetQueryOptionW
InternetCrackUrlA
InternetOpenA

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

PlaySoundW
waveOutSetVolume
waveOutGetVolume
PlaySoundA

Sections

.text
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c594f4db5e47e4c140d863e954640dea

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 208KB - Virtual size: 208KB

.data Size: 2KB - Virtual size: 11KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 208KB - Virtual size: 208KB

.data
Size: 2KB - Virtual size: 11KB

.reloc
Size: 8KB - Virtual size: 8KB