5a505752d52e2b99c8cdd884fe2af9859e34ce187ccc70fe341d69aaf27836dd

Sharing

Copy URL

Twitter E-mail

General

Target

5a505752d52e2b99c8cdd884fe2af9859e34ce187ccc70fe341d69aaf27836dd
Size

647KB
MD5

124c8a61f7111292a90d1c670a88ca75
SHA1

a12f3878223bf2a994eaa86ef126f491e727c309
SHA256

5a505752d52e2b99c8cdd884fe2af9859e34ce187ccc70fe341d69aaf27836dd
SHA512

058db4eac27c17733793692cd366593437b3780ace02569b41a8c1ab3b45361cc54bf9d3acdfc01ab9067572082d08f1f4bc3bd254c2e81bf2615dc19cb62697
SSDEEP

12288:DchoVn5xBJbXFY33oDv/DSey7BCxPkwrWK2uXVfMFzNYtktAEj8yIDUfPMj:D+oVnbB036/+ey7IxPkwrWKPXVf+h4fH

Score

N/A

Malware Config

Signatures

Files

5a505752d52e2b99c8cdd884fe2af9859e34ce187ccc70fe341d69aaf27836dd
.exe windows x86

12896ad5539689f6031793a6bc2a43e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSACleanup
WSAStartup

crt

ord17
ord84
ord64
ord55
ord46
ord77
ord16
ord5
ord27
ord26
ord25
ord32
ord3
ord4
ord116
ord115
ord34
ord65
ord23
ord24
ord18
ord35
ord94
ord59
ord58
ord62
ord29
ord61
ord38
ord82
ord109
ord74
ord56
ord99
ord33
ord72
ord10
ord110
ord19
ord117
ord36
ord63

kernel32

HeapDestroy
OutputDebugStringW
CreateEventW
WaitForSingleObject
SetEvent
CreateToolhelp32Snapshot
GetModuleFileNameW
Process32FirstW
Process32NextW
CloseHandle
TerminateThread
Sleep
OpenProcess
TerminateProcess
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
LoadLibraryW
LoadLibraryExW
LoadLibraryA
LoadLibraryExA
GetCurrentThread
MultiByteToWideChar
CreateFileW
GetFileSize
ReadFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetCommandLineW
GetProcAddress
lstrlenW
SetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
GetModuleHandleW
lstrcmpiW
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
GetTickCount
OpenEventW
CreateMutexW
GetCurrentProcessId
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
FindFirstFileW
FindClose
FreeResource
GlobalFree
InitializeCriticalSection
InterlockedExchange
DeleteFileW
GetTempPathW
OpenMutexW
CreateProcessW
GetFileAttributesW
FindNextFileW
GetLocalTime
SystemTimeToFileTime
GetModuleHandleA
lstrcpyW
RemoveDirectoryW
GetVersionExW
lstrcmpiA
GetFullPathNameW
WriteFile
SetFilePointer
LocalAlloc
LocalLock
LocalUnlock
LocalFree
HeapAlloc
GetProcessHeap
HeapFree
GlobalMemoryStatusEx
VirtualQuery
InterlockedCompareExchange
VirtualProtect
ResumeThread
SetThreadContext
GetThreadContext
VirtualFree
SuspendThread
VirtualAlloc
HeapReAlloc
HeapSize
InterlockedPushEntrySList
IsProcessorFeaturePresent
InterlockedPopEntrySList
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
CreateFileMappingA
FlushViewOfFile

user32

PostThreadMessageW
KillTimer
GetMessageW
SetTimer
PeekMessageW
UnregisterClassA
GetClassNameW
GetParent
TranslateMessage
FindWindowExW
DispatchMessageW
RegisterClassExW
LoadCursorW
DestroyAcceleratorTable
GetDesktopWindow
ReleaseDC
GetDC
InvalidateRect
InvalidateRgn
GetClientRect
FillRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
ClientToScreen
CreateAcceleratorTableW
CallWindowProcW
GetWindowLongW
SetWindowLongW
DefWindowProcW
GetWindowThreadProcessId
CharNextW
TrackMouseEvent
keybd_event
MessageBoxA
SetMenuItemInfoW
RemoveMenu
GetMenuState
SetMenuInfo
GetMenuInfo
GetClassNameA
CallNextHookEx
SetWindowsHookExW
SetPropA
SetRectEmpty
UnhookWindowsHookEx
GetMenuItemInfoW
SetWindowTextA
OffsetRect
InflateRect
GetWindowDC
GetMenuItemCount
UpdateWindow
GetPropA
SetParent
MonitorFromPoint
TrackPopupMenu
DialogBoxParamW
DestroyMenu
FindWindowA
IsIconic
IsWindowVisible
EnumThreadWindows
GetSubMenu
LoadMenuW
SetForegroundWindow
GetCursorPos
wsprintfW
LoadIconW
PostQuitMessage
FindWindowW
EndDialog
SetDlgItemTextW
LoadBitmapW
LoadImageW
MapWindowPoints
DrawTextW
SetWindowRgn
CopyRect
ShowWindow
PostMessageW
PtInRect
GetWindowRect
IsDialogMessageW
GetSystemMetrics
SystemParametersInfoW
GetMonitorInfoW
MonitorFromWindow
SetRect
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetDlgItem
SendMessageW
IsWindow
GetSysColor
SetWindowPos
RedrawWindow
GetClassInfoExW
CreateWindowExW
DestroyWindow

gdi32

RealizePalette
SelectPalette
CreatePalette
CreateDIBitmap
StretchBlt
ExcludeClipRect
GetClipBox
Rectangle
CreateFontIndirectW
CreatePen
CreatePatternBrush
CreateRoundRectRgn
SetBkMode
SetTextColor
CreateFontW
ExtTextOutW
SetBkColor
CreateSolidBrush
GetObjectW
GetDeviceCaps
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
DeleteDC
GetStockObject

advapi32

RegCreateKeyExW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW

shell32

SHGetSpecialFolderPathW
ShellExecuteW
Shell_NotifyIconW
SHChangeNotify
ShellExecuteExW

ole32

OleInitialize
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
OleUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoLoadLibrary
CoInitializeEx
CLSIDFromProgID
CoCreateInstance
CoFreeLibrary
CoUninitialize
CoInitialize

oleaut32

LoadRegTypeLi
VarBstrCmp
VariantChangeType
SysAllocStringLen
LoadTypeLi
OleCreateFontIndirect
SysAllocString
VariantClear
SysFreeString
SysStringLen
VariantInit
VarUI4FromStr

shlwapi

StrStrIW
StrCmpW
PathRemoveFileSpecW
StrCmpNIW
PathFindFileNameW
PathAppendW
ord156
PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

TransparentBlt

gdiplus

GdiplusShutdown
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipLoadImageFromStream
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdiplusStartup

msvcr100

srand
_wtol
_mktime64
_vsnwprintf_s
iswspace
strncpy
wcsncat
realloc
strchr
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
rand
wcsrchr
iswdigit
swscanf
_wcslwr_s
sscanf
fopen
fread
fwrite
ftell
fseek
fclose
calloc
memset
memcpy
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
_CxxThrowException
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
??0bad_cast@std@@QAE@PBD@Z
wcsnlen
wcstoul
wcsncpy
_ftime64
swprintf_s
_recalloc
malloc
free
wcscpy_s
wcsncpy_s
wcschr
wcsstr
_snwprintf
vswprintf_s
_vscwprintf
??_V@YAXPAX@Z
??_U@YAPAXI@Z
?what@exception@std@@UBEPBDXZ
vsprintf_s
_vscprintf
_mbsrev
memmove_s
atoi
_purecall
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
memcpy_s
memmove
wmemcpy_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_snwprintf_s
_wcsicmp
_beginthreadex
_wtoi
??3@YAXPAX@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
__CxxFrameHandler3
_time32

msvcp100

??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
??1facet@locale@std@@UAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Xmem@tr1@std@@YAXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xbad@tr1@std@@YAXW4error_type@regex_constants@12@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
_Wcsxfrm
_Wcscoll
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Container_base12@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0facet@locale@std@@IAE@I@Z

wininet

InternetGetCookieA

iphlpapi

GetIfTable

Sections

.text
Size: 316KB - Virtual size: 315KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 231KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

12896ad5539689f6031793a6bc2a43e4

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

msvcr100

msvcp100

wininet

iphlpapi

Sections

.text Size: 316KB - Virtual size: 315KB

.rdata Size: 81KB - Virtual size: 81KB

.data Size: 11KB - Virtual size: 13KB

.rsrc Size: 231KB - Virtual size: 232KB

.text
Size: 316KB - Virtual size: 315KB

.rdata
Size: 81KB - Virtual size: 81KB

.data
Size: 11KB - Virtual size: 13KB

.rsrc
Size: 231KB - Virtual size: 232KB