0eae0fe7cf0a2ddd2a5f31352a3d54b26e9465ddb7f4dc74a2dbc4dbac2115ff

Sharing

Copy URL Twitter E-mail

General

Target

0eae0fe7cf0a2ddd2a5f31352a3d54b26e9465ddb7f4dc74a2dbc4dbac2115ff
Size

580KB
MD5

1015b050e3eb23340ede2fe43d1cee6a
SHA1

8e184a022038713350566eb6f797df4c1497ee56
SHA256

0eae0fe7cf0a2ddd2a5f31352a3d54b26e9465ddb7f4dc74a2dbc4dbac2115ff
SHA512

9c314b43ffcb666e55803a1cf01584fa02157652c7d66273ea3c6a39befdfa13aa020ff9ba2e597c3e73f07ca081ca9f626b70d969d8952ad9a049c874b734a6
SSDEEP

12288:D7O70hJmqp3qOepjXWfPMwhXbUIT8p9EY1P/yEr:a5KNyjXHYT8puY1P/y

Score

N/A

Malware Config

Signatures

Files

0eae0fe7cf0a2ddd2a5f31352a3d54b26e9465ddb7f4dc74a2dbc4dbac2115ff
.exe windows x86

39ffd653303861b3373fdacc91301f95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegSetValueW
RegDeleteKeyW
GetLengthSid
GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenProcessToken
AddAccessAllowedAceEx
ConvertStringSidToSidW

kernel32

LoadLibraryW
SetErrorMode
GetSystemDirectoryW
GetVersionExW
CloseHandle
WriteFile
SizeofResource
CreateFileW
LockResource
LoadResource
FindResourceW
SetFileAttributesW
GetFileAttributesW
Sleep
GetTickCount
CreateProcessW
DeleteFileW
lstrcmpW
FindFirstFileExW
FindClose
FindNextFileW
FindFirstFileW
SetCurrentDirectoryW
FreeLibrary
GetShortPathNameW
GetSystemDefaultUILanguage
CreateDirectoryW
WaitForSingleObject
ExpandEnvironmentStringsW
CompareStringOrdinal
InterlockedDecrement
GetTempFileNameW
GetTempPathW
SetLastError
FindResourceExW
IsWow64Process
GetNativeSystemInfo
GetPrivateProfileStringW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetModuleFileNameW
LocalFree
LocalAlloc
GetModuleHandleW
GetProcAddress
GetVersion
GetEnvironmentVariableW
GetLastError
lstrlenW
GetCurrentDirectoryW
MapViewOfFile
CreateFileMappingW
GetLocaleInfoW
UnmapViewOfFile
GetUserDefaultUILanguage
SearchPathW
LoadLibraryExW

user32

BlockInput
UnhookWinEvent
SetTimer
GetShellWindow
LoadStringW
PostMessageW
GetMenuItemInfoW
GetMenuItemCount
DestroyMenu
CreatePopupMenu
SendInput
GetCursorPos
SystemParametersInfoW
PostQuitMessage
SetWinEventHook
KillTimer
DispatchMessageW
GetMessageW

msvcrt

??1type_info@@UAE@XZ
iswalpha
wcschr
??3@YAXPAX@Z
??2@YAPAXI@Z
_time64
_vsnwprintf
iswctype
memcpy
wcsncmp
_wcsnicmp
_wcsicmp
bsearch
memcpy_s
wcsrchr
fclose
swscanf_s
fgetws
_controlfp
_except_handler4_common
?terminate@@YAXXZ
memset
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_CxxThrowException
_wfopen_s

shell32

SHGetSpecialFolderPathW
SHSetLocalizedName
SHParseDisplayName
SHGetFolderPathW
SHBindToParent
ord190
ord526
ord165
SHChangeNotify
SHGetSpecialFolderLocation
ord155
SHGetDesktopFolder

ole32

OleUninitialize
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoUninitialize
CoInitializeEx
OleInitialize

ieadvpack

RegRestoreAllW
ExecuteCabW
RunSetupCommandW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

SHRegGetUSValueW
PathIsNetworkPathW
PathCombineW
SHRegGetValueW
SHRegDeleteUSValueW
ord388
StrStrW
ord225
PathRemoveExtensionW
PathFindFileNameW
PathRemoveBlanksW
SHDeleteValueW
SHSetValueW
StrCmpIW
SHGetValueW
SHStrDupW
SHRegSetUSValueW
PathFileExistsW
StrStrIW
ord158
ord437
StrCmpNIW
SHDeleteKeyW
SHCopyKeyW

iertutil

ord650
ord39
ord33
ord57
ord654

oleacc

AccessibleObjectFromEvent

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

39ffd653303861b3373fdacc91301f95

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

ieadvpack

version

shlwapi

iertutil

oleacc

oleaut32

Sections

.text Size: 63KB - Virtual size: 63KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 3KB

.vmp0 Size: 508KB - Virtual size: 1.6MB

.text
Size: 63KB - Virtual size: 63KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 3KB

.vmp0
Size: 508KB - Virtual size: 1.6MB