514f10698920fc26f3072a5c946cf8dc0fd411070ccc2b8ea8cbe963d161578d

Sharing

Copy URL Twitter E-mail

General

Target

514f10698920fc26f3072a5c946cf8dc0fd411070ccc2b8ea8cbe963d161578d
Size

1.1MB
MD5

3908558437ea08fe80e18478553c5c90
SHA1

9b332449a5fd5edf70c3885f3dac8ff682cd0dd7
SHA256

514f10698920fc26f3072a5c946cf8dc0fd411070ccc2b8ea8cbe963d161578d
SHA512

5c7f1af1812825ef7774b84defb051464db51ab70fc382d4793388da95ed7acce902c91c7f439c5cd0160fd5e7658565e0e49e3d1ecc260e0a2f0db679a63ad5
SSDEEP

24576:BP1yIIsyvovrxqxzk+AeJKJXY6mSceeCuUlba0CTWcbWw8d869ixgT:p1yIIsHv1qx4PeJAXYlnQaxTWcbd8d8U

Score

N/A

Malware Config

Signatures

Files

514f10698920fc26f3072a5c946cf8dc0fd411070ccc2b8ea8cbe963d161578d
.exe windows x86

06cb24507330451c9841b7eb214001b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalMemoryStatus
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
GetDriveTypeA
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
GetFullPathNameA
PeekNamedPipe
SetConsoleMode
ReadConsoleInputA
QueryPerformanceCounter
GetStdHandle
GetFileType
GetVersion
OpenProcess
HeapFree
GetProcessHeap
HeapAlloc
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
GetPrivateProfileStringW
GetLocalTime
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryExW
SetErrorMode
SetPriorityClass
CreateMutexW
LocalFree
lstrlenW
CreateProcessW
SetLastError
GetModuleHandleW
MultiByteToWideChar
RaiseException
GetCommandLineW
InterlockedDecrement
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
CreateDirectoryW
FindClose
FindFirstFileW
ResumeThread
GetTempPathW
ReadFile
GetFileSize
CloseHandle
WriteFile
SetFilePointer
CreateFileW
GetFileAttributesW
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetLastError
GetModuleFileNameW
LeaveCriticalSection
GetNativeSystemInfo
GetFileInformationByHandle
GetModuleHandleExA
WaitForMultipleObjects
CreateEventW
SetEvent
WaitForSingleObject
FileTimeToLocalFileTime
Sleep
LoadLibraryW
GetCurrentDirectoryW
FileTimeToSystemTime
InterlockedExchangeAdd
GetModuleHandleExW
GetDriveTypeW
InitializeCriticalSection
FreeLibrary
SetEndOfFile
WideCharToMultiByte
GetModuleFileNameA
GetModuleHandleA
GetVolumeInformationA
GlobalFree
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
ExpandEnvironmentStringsW
GetVersionExW
DeviceIoControl
CreateFileA
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
GetTimeFormatW
GetDateFormatW
ExitThread
CreateThread
HeapSetInformation
GetStartupInfoW
SetConsoleCtrlHandler
RtlUnwind
GetCPInfo
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetLocaleInfoW
GetTimeZoneInformation
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetEnvironmentVariableA
WriteConsoleW
FindFirstFileExA

user32

GetUserObjectInformationW
DispatchMessageW
TranslateMessage
PostThreadMessageW
PeekMessageW
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
DefWindowProcW
CharLowerBuffW
GetDesktopWindow
MessageBoxA
wsprintfW
SetTimer
GetMessageW
KillTimer
GetProcessWindowStation
PostMessageW
UnregisterClassW
DestroyWindow

advapi32

RegCloseKey
RegCreateKeyExW
RegEnumKeyExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RevertToSelf
ImpersonateLoggedOnUser
DeleteService
ControlService
ChangeServiceConfig2W
CreateServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
LookupAccountSidW
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
CryptReleaseContext
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegQueryValueExW
RegOpenKeyExW

shell32

SHCreateDirectoryExW
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString
SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
VariantInit
VariantClear

sensapi

IsNetworkAlive

wininet

InternetOpenUrlW
InternetCloseHandle
InternetGetConnectedState
InternetOpenW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

crypt32

CryptBinaryToStringW

shlwapi

PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
PathFindFileNameW
PathAppendW
SHSetValueW
SHGetValueW

log_report

XLogV

ws2_32

sendto
recvfrom
send
listen
freeaddrinfo
getaddrinfo
gethostname
WSASetLastError
getpeername
bind
ntohs
getsockname
WSACleanup
ioctlsocket
recv
WSAGetLastError
select
__WSAFDIsSet
htons
connect
getsockopt
WSAStartup
accept
setsockopt
inet_addr
gethostbyname
closesocket
socket

iphlpapi

GetAdaptersInfo

winmm

timeGetTime

wldap32

ord32
ord30
ord26
ord50
ord60
ord79
ord143
ord211
ord35
ord200
ord22
ord33
ord301
ord27
ord41
ord46

Sections

.text
Size: 791KB - Virtual size: 791KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 59KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 129KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

06cb24507330451c9841b7eb214001b6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

sensapi

wininet

wtsapi32

userenv

crypt32

shlwapi

log_report

ws2_32

iphlpapi

winmm

wldap32

Sections

.text Size: 791KB - Virtual size: 791KB

.rdata Size: 195KB - Virtual size: 194KB

.data Size: 59KB - Virtual size: 83KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 129KB - Virtual size: 132KB

.text
Size: 791KB - Virtual size: 791KB

.rdata
Size: 195KB - Virtual size: 194KB

.data
Size: 59KB - Virtual size: 83KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 129KB - Virtual size: 132KB