615035fbd871b8048f658c2fe980a447fda501d834eff762c44e35223c8115b5

Sharing

Copy URL Twitter E-mail

General

Target

615035fbd871b8048f658c2fe980a447fda501d834eff762c44e35223c8115b5
Size

750KB
MD5

09b7c32c6a69ab98f456e8adb2502df0
SHA1

4679382981899ec9a9e8b4e026536c4deb111276
SHA256

615035fbd871b8048f658c2fe980a447fda501d834eff762c44e35223c8115b5
SHA512

48e0a6426b1d84fc6f5fad27cbde8360e88618c3a6fe502aca630fd4728d92260853063cad160bd6e1cf6a9d9be8186ad3be7ee4b3257d3d6bf36cd5fd86271b
SSDEEP

12288:jZopl4okck2iJpRKhWwzi34l+8s/f25UJaqmRqb3qF6fPM74NMtZFjAM:jZopl4bTdJpRKhWm6E+n/faqeI3xPw4A

Score

N/A

Malware Config

Signatures

Files

615035fbd871b8048f658c2fe980a447fda501d834eff762c44e35223c8115b5
.exe windows x86

8db2c512f8e4fa4afce0bf06bbb1b5af

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDriveTypeW
GetSystemDirectoryW
GetLogicalDriveStringsW
TerminateThread
GetExitCodeThread
SetEvent
GetPrivateProfileStringW
SetFileAttributesW
CreateEventW
FormatMessageW
MoveFileExW
SetThreadLocale
GetDiskFreeSpaceExW
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
UnmapViewOfFile
GetWindowsDirectoryW
GetComputerNameA
ExpandEnvironmentStringsA
SleepEx
FormatMessageA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
RaiseException
CreateFileMappingW
MapViewOfFileEx
ProcessIdToSessionId
GetVersionExW
SetEndOfFile
GetModuleFileNameA
GetPrivateProfileIntA
CreateDirectoryA
SetFileAttributesA
DeleteFileA
MoveFileA
WritePrivateProfileStringW
OpenFileMappingW
CreateFileA
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
GetFileTime
FileTimeToSystemTime
LocalFree
IsBadWritePtr
CreateThread
CreateProcessW
GetProcessId
WaitForSingleObject
GetTickCount
CreateDirectoryW
SetCurrentDirectoryW
GlobalAddAtomW
GlobalGetAtomNameW
GlobalDeleteAtom
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
SetFilePointer
GetLocalTime
OpenProcess
LoadLibraryA
GetPrivateProfileIntW
CreateFileW
GetFileSize
ReadFile
LoadLibraryExW
FreeResource
SetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCurrentProcessId
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
lstrlenA
MultiByteToWideChar
lstrlenW
GetCurrentThreadId
WideCharToMultiByte
FreeLibrary
LoadLibraryW
Sleep
CloseHandle
GetCurrentProcess
FlushInstructionCache
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetModuleFileNameW
GetFileAttributesW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetStartupInfoW

user32

LoadBitmapW
LoadImageW
PeekMessageW
GetMessageW
TranslateMessage
GetWindowTextLengthW
GetWindowTextW
GetDlgItem
UnregisterClassA
SetWindowLongW
CreateWindowExW
DestroyWindow
GetWindowLongW
SendMessageW
MoveWindow
SetWindowPos
GetWindowRect
GetClientRect
InvalidateRect
IsChild
RegisterClassExW
LoadCursorW
DefWindowProcW
IsWindow
MapWindowPoints
SystemParametersInfoW
GetWindow
GetParent
GetClassInfoExW
RegisterWindowMessageW
CopyRect
GetDlgCtrlID
SetCursor
InflateRect
ShowWindow
IsDialogMessageW
SetWindowTextW
ClientToScreen
DispatchMessageW
GetDC
IsWindowEnabled
SetFocus
KillTimer
SetTimer
GetShellWindow
GetCursorPos
AllowSetForegroundWindow
GetLastInputInfo
GetSystemMetrics
FindWindowW
EnumChildWindows
EnumWindows
GetClassNameW
ReleaseCapture
PostMessageW
EndPaint
BeginPaint
GetNextDlgTabItem
SetCapture
GetActiveWindow
GetFocus
CharNextW
ReleaseDC
PtInRect
DrawTextW
GetDesktopWindow
DestroyIcon
EqualRect
IsWindowVisible
DrawFrameControl
LoadIconW
DrawIconEx
SetRect
OffsetRect
SetWindowRgn
PostThreadMessageW
CallWindowProcW
GetScrollPos
EnableWindow
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
WindowFromPoint
SetActiveWindow
UpdateLayeredWindow
GetMonitorInfoW
MonitorFromWindow
SetRectEmpty
GetKeyState

gdi32

OffsetRgn
GetTextExtentPoint32W
TextOutW
LineTo
MoveToEx
GetClipRgn
CreateRectRgnIndirect
RoundRect
GetCurrentObject
SetBkMode
RectInRegion
GetTextColor
SetStretchBltMode
CreateCompatibleBitmap
DeleteObject
SaveDC
CombineRgn
SelectObject
SelectClipRgn
Rectangle
ExtTextOutW
SetBkColor
CreateRectRgn
CreatePen
GetStockObject
CreateCompatibleDC
CreateDIBSection
DeleteDC
CreateFontIndirectW
GetObjectW
BitBlt
SetTextColor
StretchBlt
SetViewportOrgEx
RestoreDC
CreateBitmap

advapi32

RegOpenKeyExW
GetNamedSecurityInfoW
GetAclInformation
GetAce
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CopySid
IsValidSid
GetLengthSid
SetNamedSecurityInfoW
InitializeAcl
AddAce
ImpersonateLoggedOnUser
SetTokenInformation
RevertToSelf
CreateProcessAsUserW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceConfigW
ChangeServiceConfigW
DuplicateTokenEx
SetEntriesInAclW
AllocateLocallyUniqueId
BuildTrusteeWithSidW
LookupAccountNameW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyW
RegDeleteKeyW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
SHGetSpecialFolderPathW
Shell_NotifyIconW
ShellExecuteExW

ole32

CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateGuid
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathRemoveFileSpecW
StrToIntW
PathFileExistsW
PathRemoveFileSpecA
PathRemoveExtensionA
PathFindFileNameA
PathAppendW
PathIsDirectoryW
PathGetDriveNumberW
StrToIntA

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCreatePen1
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipResetWorldTransform
GdipAlloc
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipFree
GdipDisposeImage
GdipGetImageWidth
GdipDeletePen
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipDrawImageRectRectI
GdipCloneImage
GdipImageRotateFlip
GdipDrawImageRectI
GdipDrawImageRectRect
GdipDrawImagePointsRectI
GdiplusStartup
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdipDrawLinesI
GdipGetImageHeight
GdiplusShutdown
GdipDeleteBrush
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteFont
GdipCreateSolidFill
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetTextRenderingHint
GdipFillRectangleI
GdipDrawString
GdipMeasureString
GdipCreateFontFromDC
GdipCreateFontFromLogfontW
GdipCloneBrush
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathRectangleI
GdipAddPathPieI
GdipSetSmoothingMode
GdipSetClipPath

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa
gethostname
recvfrom
select
ioctlsocket
sendto
WSASocketW
inet_addr
closesocket
WSAGetLastError
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
socket
__WSAFDIsSet
getaddrinfo
freeaddrinfo
WSASetLastError

msvcp80

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

msvcr80

_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_except_handler4_common
rand
srand
_stat64
_gmtime64
getenv
memchr
isdigit
fflush
_errno
fputs
qsort
fgets
_strtoi64
isxdigit
strtol
sscanf
strtoul
__iob_func
fwrite
__sys_nerr
strerror
strrchr
realloc
_snwprintf
_snprintf
clock
wcsnlen
_wfopen
_vswprintf
wcsncmp
strchr
isalpha
tolower
ftell
_vsnprintf_s
atof
sscanf_s
fputc
ferror
fopen_s
memmove
isalnum
isspace
_vsnwprintf
wcscat
_vsnprintf
fprintf
_mbsrchr
_mbsstr
strncmp
_ultoa_s
wcstok
_itow
_wtol
_wcslwr_s
_initterm
strncpy
_itoa
strcat
_wcslwr
_wcsnicmp
_initterm_e
_configthreadlocale
memcmp
_time32
wcscpy_s
strcpy_s
_stricmp
fopen
fseek
fgetpos
fread
fclose
strcpy
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_strlwr_s
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
wcsrchr
iswspace
_invalid_parameter_noinfo
_local_unwind4
_time64
_mktime64
wcsncpy
_localtime64_s
strstr
wcscspn
wcsspn
atoi
abs
_mbschr
_waccess
labs
wcscpy
memcpy
wcsncpy_s
malloc
_mbscmp
vsprintf_s
_vscprintf
_recalloc
strlen
strcmp
_purecall
_beginthreadex
??_V@YAXPAX@Z
vswprintf_s
_vscwprintf
swprintf_s
??2@YAPAXI@Z
_wcsicmp
_wtoi
wcschr
memset
calloc
free
wcslen
wcsstr
wcscmp
memmove_s
_strnicmp
??3@YAXPAX@Z
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_strupr
_strdup
sprintf
memcpy_s

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetModuleFileNameExW

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

Sections

.text
Size: 432KB - Virtual size: 431KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 193KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8db2c512f8e4fa4afce0bf06bbb1b5af

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

msvcp80

msvcr80

version

psapi

wtsapi32

Sections

.text Size: 432KB - Virtual size: 431KB

.rdata Size: 104KB - Virtual size: 103KB

.data Size: 12KB - Virtual size: 14KB

.rsrc Size: 193KB - Virtual size: 196KB

.text
Size: 432KB - Virtual size: 431KB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 12KB - Virtual size: 14KB

.rsrc
Size: 193KB - Virtual size: 196KB