0d652ef7e03bb70e552d97bf6802cd487d63609875d9a5eb1d43a79a37973b00

Sharing

Copy URL Twitter E-mail

General

Target

0d652ef7e03bb70e552d97bf6802cd487d63609875d9a5eb1d43a79a37973b00
Size

216KB
MD5

3faa9637535d003fbc1bc72b78d7dac0
SHA1

59d81e43c7b9a6840c93c7ff46bfd7e3a17385c3
SHA256

0d652ef7e03bb70e552d97bf6802cd487d63609875d9a5eb1d43a79a37973b00
SHA512

6b968aab8e5d1a4c2f678f31200551c603a9f87db924da0d1efb9b4e5c0560b6193b632ece9138d601630432fb5c64c09c4b0c2f0b10b1a8b81e5ba7bd29200a
SSDEEP

6144:bZJxkYxtELsaE3zR9Bax3uAEiyFogSVJ/ya1+:bfxkYx4uROxzmjSVJ/y3

Score

N/A

Malware Config

Signatures

Files

0d652ef7e03bb70e552d97bf6802cd487d63609875d9a5eb1d43a79a37973b00
.dll windows x86

15d0285df727f3bc7dea26870f1b127c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryInfoKeyW
OpenSCManagerW
RegCloseKey
CloseServiceHandle
QueryServiceConfigW
QueryServiceStatus
RegDeleteValueW
ImpersonateSelf
RegEnumKeyExW
OpenServiceW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyA
RegQueryValueExA

gdi32

GetObjectW
GetBkMode

kernel32

LocalFree
WaitForSingleObject
CreateEventW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapReAlloc
TlsGetValue
TlsSetValue
DisableThreadLibraryCalls
TlsAlloc
TlsFree
OpenFileMappingW
MapViewOfFile
WaitForSingleObjectEx
InterlockedExchange
UnmapViewOfFile
SleepEx
VerifyVersionInfoW
HeapSize
MultiByteToWideChar
GetACP
PulseEvent
LoadLibraryA
GetTickCount
GetModuleFileNameW
Beep
GetFileSize
GetFileTime
CompareFileTime
GlobalHandle
GlobalFree
MoveFileW
_lclose
GetTempPathW
GetTempFileNameW
DeleteFileW
GetFileAttributesW
GetFullPathNameW
_llseek
_lwrite
_lread
CreateEventA
GetCurrentThread
SetEvent
ExitThread
FindResourceW
LoadLibraryExW
LoadResource
LockResource
FreeResource
SetCurrentDirectoryW
GetCurrentDirectoryW
lstrcmpW
lstrcpyA
WideCharToMultiByte
CreateThread
SetThreadPriority
LocalAlloc
OpenEventW
EnterCriticalSection
HeapAlloc
HeapFree
Sleep
GetLastError
GetCurrentProcessId
IsBadWritePtr
IsBadStringPtrW
SetLastError
IsBadReadPtr
IsBadCodePtr
ExpandEnvironmentStringsW
lstrlenW
lstrcpyW
lstrcatW
lstrcmpiW
GetPrivateProfileStringW
CloseHandle
SearchPathW
CreateFileW
GetProfileStringW
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
lstrcmpiA
lstrcpynA
FileTimeToSystemTime
GlobalUnlock
GlobalLock
GetFileAttributesExA
GetModuleFileNameA
lstrcpynW
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
SetErrorMode
FreeLibrary
GlobalReAlloc
GlobalAlloc
InitializeCriticalSection
GetCurrentThreadId
GetThreadPriority
ResetEvent

ntdll

NtQueryVirtualMemory
RtlUnwind
RtlDeleteResource
RtlImageNtHeader
RtlInitializeResource
mbstowcs
VerSetConditionMask
NtCreateEvent
NtWaitForMultipleObjects
NtCreateTimer
NtSetTimer
NtCancelTimer
NtSetEvent
NtSetTimerResolution
NtQueryTimerResolution
memmove
RtlUnicodeToMultiByteN
RtlMultiByteToUnicodeN
wcsrchr
towlower
isdigit
wcscpy
wcscat
strncpy
strspn
strncmp
strstr
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
NtCreateSection
NtMapViewOfSection
NtUnmapViewOfSection
atoi
wcschr
wcstol
swprintf
RtlCreateUserThread
NtResumeThread
wcsncpy
wcsncmp
_wcsnicmp
wcslen
wcsncat
NtSetValueKey
RtlOpenCurrentUser
NtQueryValueKey
RtlInitUnicodeString
NtOpenKey
NtClose

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
NdrClientCall2
RpcStringFreeW

user32

GetWinStationInfo
GetSystemMetrics
SystemParametersInfoW
CharUpperA
LoadIconA
RegisterClassA
CreateWindowExA
GetMessageA
DispatchMessageA
DestroyWindow
DefWindowProcA
PostThreadMessageA
PeekMessageA
UnregisterClassA
PeekMessageW
MessageBoxW
GetAsyncKeyState
LoadStringA
SendMessageA
CharLowerBuffA
PostMessageA
SetTimer
LoadStringW
PostMessageW
KillTimer
RegisterWindowMessageW
IsWindow
wsprintfA
wsprintfW

Exports

Exports

CloseDriver
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
MigrateAllDrivers
MigrateSoundEvents
NotifyCallbackData
OpenDriver
PlaySound
PlaySoundA
PlaySoundW
SendDriverMessage
WOW32DriverCallback
WOW32ResolveMultiMediaHandle
WOWAppExit
WinmmLogoff
WinmmLogon
_gfxLogoff@0
_gfxLogon@4
aux32Message
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
gfxAddGfx
gfxBatchChange
gfxCreateGfxFactoriesList
gfxCreateZoneFactoriesList
gfxDestroyDeviceInterfaceList
gfxEnumerateGfxs
gfxModifyGfx
gfxOpenGfx
gfxRemoveGfx
joy32Message
joyConfigChanged
joyGetDevCapsA
joyGetDevCapsW
joyGetNumDevs
joyGetPos
joyGetPosEx
joyGetThreshold
joyReleaseCapture
joySetCapture
joySetThreshold
mci32Message
mciDriverNotify
mciDriverYield
mciExecute
mciFreeCommandResource
mciGetCreatorTask
mciGetDeviceIDA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDFromElementIDW
mciGetDeviceIDW
mciGetDriverData
mciGetErrorStringA
mciGetErrorStringW
mciGetYieldProc
mciLoadCommandResource
mciSendCommandA
mciSendCommandW
mciSendStringA
mciSendStringW
mciSetDriverData
mciSetYieldProc
mid32Message
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
mmsystemGetVersion
mod32Message
mxd32Message
sndPlaySoundA
sndPlaySoundW
tid32Message
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetSystemTime
timeGetTime
timeKillEvent
timeSetEvent
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite
wid32Message
winmmDbgOut
winmmSetDebugLevel
wod32Message

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

15d0285df727f3bc7dea26870f1b127c

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

ntdll

rpcrt4

user32

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 123KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 6KB - Virtual size: 6KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 123KB - Virtual size: 123KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 6KB - Virtual size: 6KB

.rmnet
Size: 56KB - Virtual size: 60KB