01cd6ee0cd0cb37077d79263dfe6ae76176509c606a00024a981f2c9326b4187

Sharing

Copy URL Twitter E-mail

General

Target

01cd6ee0cd0cb37077d79263dfe6ae76176509c606a00024a981f2c9326b4187
Size

230KB
MD5

0ef20791a28fbd78c2abb809531e4efb
SHA1

7da531242bf3daf6191a4a1f1a4c2df481f32c2b
SHA256

01cd6ee0cd0cb37077d79263dfe6ae76176509c606a00024a981f2c9326b4187
SHA512

257a5a458021913acbd9fad2ef7f38ba607477065abf639f96ad167d937d799b92056bce1fada51f3a1707119f26130313b5df3a04026d0f48bbe4a1f7cf7e97
SSDEEP

3072:1ZT25+ANZei1pAW/mu9Hcz0dKdr8pO8EkgUYrq0hUk7WciHxOxwFVQTd:1K+sZVg/88z0dqrsbEecq0HTwX

Score

N/A

Malware Config

Signatures

Files

01cd6ee0cd0cb37077d79263dfe6ae76176509c606a00024a981f2c9326b4187
.exe windows x86

a63af57cc2380a3240e96129b222b5fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
EventRegister
EventUnregister
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegNotifyChangeKeyValue
EventWrite
RegGetValueW
RegQueryValueExW

kernel32

LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreW
SetLastError
GetTickCount
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
EnterCriticalSection
GetModuleFileNameW
CreateMutexW
Sleep
CreateEventW
CreateThread
GetCurrentThreadId
SetEvent
GetCommandLineW
GetSystemTimeAsFileTime
CloseThreadpoolTimer
SetThreadpoolTimer
ResetEvent
CreateThreadpoolTimer
FlushInstructionCache
GetCurrentProcess
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
InitializeCriticalSectionAndSpinCount
RaiseException
lstrlenW
FindFirstFileW
CompareStringOrdinal
CreateFileW
CloseHandle
GetLastError
LoadLibraryExW
SetFileAttributesW
FindClose
FindNextFileW
MoveFileW
GetVersionExA
CopyFileExW
SetFilePointer
GetFileMUIPath
GetFileAttributesW
CompareFileTime
GetSystemInfo
GetSystemDefaultLCID
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
LCMapStringW
SystemTimeToFileTime
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
VirtualAlloc
VirtualFree
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange

gdi32

DeleteObject
CreateCompatibleDC
SelectObject
SetLayout
DeleteDC
CreateCompatibleBitmap
CreateDIBSection
CreateRectRgn

user32

GetMenuState
RegisterWindowMessageW
CreateWindowExW
RegisterClassExW
UnregisterClassA
LoadStringW
InsertMenuW
CharNextW
PostThreadMessageW
CharUpperW
GetMessageW
MsgWaitForMultipleObjects
EnumWindows
DispatchMessageW
TranslateMessage
PeekMessageW
DispatchMessageA
GetMessageA
IsWindowUnicode
CreateIconIndirect
DrawIconEx
GetIconInfo
SetWindowLongW
GetWindowLongW
PostMessageW
IsIconic
ShowWindow
SendMessageW
SetWindowRgn
GetClassInfoExW
LoadCursorW
LoadImageW
GetSystemMetrics
DestroyIcon
PostQuitMessage
CheckMenuItem
GetSystemMenu
SetWindowTextW
ModifyMenuW
DeleteMenu
CallWindowProcW
DefWindowProcW

msvcrt

??3@YAXPAX@Z
??_V@YAXPAX@Z
_vsnwprintf
??_U@YAPAXI@Z
memset
free
malloc
memcpy_s
memmove_s
wcsncpy_s
_purecall
??2@YAPAXI@Z
wcscpy_s
wcscat_s
swprintf_s
_ftol2
bsearch
qsort
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
realloc
_errno
_unlock
__dllonexit
wcstoul
swscanf_s
iswspace
_lock
_onexit
?terminate@@YAXXZ
_controlfp
exit

ole32

PropVariantCopy
CoFreeUnusedLibrariesEx
PropVariantClear
CoDisconnectObject
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CoResumeClassObjects

oleaut32

VariantInit
VariantClear
SysFreeString
VarUI4FromStr
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VariantChangeType

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathAppendW
ord615
ord487
ord16
SHStrDupW
UrlEscapeW
SHCreateStreamOnFileW
PathParseIconLocationW
SHCreateStreamOnFileEx
UrlUnescapeW

propsys

PropVariantCompareEx
PSGetPropertyKeyFromName
StgDeserializePropVariant
PropVariantToStringAlloc
PropVariantChangeType
PSCreateMemoryPropertyStore
PSGetPropertyDescriptionListFromString
PSGetPropertyDescriptionByName
PropVariantToGUID

shell32

ShellExecuteExW
ord155
SHCreateShellItemArrayFromIDLists
ord6
SHGetPropertyStoreForWindow
Shell_NotifyIconW
SHParseDisplayName
SHQueryUserNotificationState
ord165

dwmapi

DwmSetWindowAttribute
DwmSetIconicThumbnail

gdiplus

GdipSetSmoothingMode
GdipFree
GdipAlloc
GdiplusStartup
GdipCreateFromHDC
GdipCreateBitmapFromFileICM
GdipCloneImage
GdiplusShutdown
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipDrawImageRectI

ntdll

WinSqmSetString
WinSqmAddToStreamEx
WinSqmEndSession
WinSqmIsOptedIn
WinSqmStartSession
WinSqmIncrementDWORD
WinSqmSetDWORD
RtlGetNativeSystemInformation

xmllite

CreateXmlReader

rpcrt4

UuidFromStringW

msi

ord113

crypt32

CertVerifyCertificateChainPolicy

wintrust

CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kwktnwd
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a63af57cc2380a3240e96129b222b5fd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shlwapi

propsys

shell32

dwmapi

gdiplus

ntdll

xmllite

rpcrt4

msi

crypt32

wintrust

Sections

.text Size: 151KB - Virtual size: 150KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 37KB - Virtual size: 38KB

kwktnwd Size: - Virtual size: 4KB

.text
Size: 151KB - Virtual size: 150KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 37KB - Virtual size: 38KB

kwktnwd
Size: - Virtual size: 4KB