84c0b700e5b5ab6758cc627ba4d0a76bb344b5339701793b29f104cce09169c3

Sharing

Copy URL Twitter E-mail

General

Target

84c0b700e5b5ab6758cc627ba4d0a76bb344b5339701793b29f104cce09169c3
Size

166KB
MD5

310a06720712ff3c0b51b5b93321c2c0
SHA1

3be9fa120a5b1b5abe7c6c2c9387349425321334
SHA256

84c0b700e5b5ab6758cc627ba4d0a76bb344b5339701793b29f104cce09169c3
SHA512

347159b8c172b892ad08add491d293ce40f29b48048747b3215bf5f866be95e5f5c9d15ad3d9103a9d18fe29cd31945bd9f6312ca41a6377a7d28b57fd1beb27
SSDEEP

3072:nMfFOR9vcHLscHLBpoTDiJsQFIYe18jA63SMOE98XNctd4JB:nUFOR9UHLPHLLsDo1e18jA63BAN8d4B

Score

N/A

Malware Config

Signatures

Files

84c0b700e5b5ab6758cc627ba4d0a76bb344b5339701793b29f104cce09169c3
.exe windows x86

a34058af4c74d0159cc5f41dbf532d0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
GetCurrentProcessId
InterlockedExchange
LocalFree
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
InterlockedDecrement
GetLastError
Sleep

user32

FindWindowA
SendMessageTimeoutA
SendMessageA
GetDC
ReleaseDC
KillTimer
GetParent
GetWindowDC
UpdateLayeredWindow
InvalidateRect
PostQuitMessage
EndPaint
DrawTextA
GetClientRect
BeginPaint
DefWindowProcA
SetWindowLongA
DestroyWindow
UpdateWindow
EqualRect
GetSystemMetrics
GetWindowLongA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
GetMessageA
IsWindow
LoadAcceleratorsA
LoadStringA
SystemParametersInfoA
PostMessageA
SetWindowPos
GetWindowRect
ShowWindow
GetForegroundWindow

gdi32

CreateDIBSection
BitBlt
GetDeviceCaps
DeleteDC
CreateCompatibleDC
DeleteObject
SelectObject

shell32

SHAppBarMessage

ole32

OleCreate
OleSetContainedObject
OleDraw
OleUninitialize
OleInitialize
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysFreeString
GetErrorInfo

kwlib

?GetUserID@UserId@KwLib@@YA_NQADH@Z
?Tokenize@StringUtility@KwLib@@YAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z

kwmodconfig

AfxGetConfigManager

msvcr90

_encode_pointer
_crt_debugger_hook
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
memcpy
__dllonexit
_unlock
memset
_CxxThrowException
__CxxFrameHandler3
malloc
free
??3@YAXPAX@Z
??2@YAPAXI@Z
_invalid_parameter_noinfo
??_V@YAXPAX@Z
tolower
_purecall

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARED
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a34058af4c74d0159cc5f41dbf532d0d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

kwlib

msvcp90

kwmodconfig

msvcr90

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 1KB

SHARED Size: 512B - Virtual size: 4B

.rsrc Size: 134KB - Virtual size: 136KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 1KB

SHARED
Size: 512B - Virtual size: 4B

.rsrc
Size: 134KB - Virtual size: 136KB