357abfa43cc84aefa8e10726ea8981b618b8d17ccd1d21964f05e9f13a0b55c9

Sharing

Copy URL Twitter E-mail

General

Target

357abfa43cc84aefa8e10726ea8981b618b8d17ccd1d21964f05e9f13a0b55c9
Size

148KB
MD5

0a56bd379013caccf6178f733e88c5c1
SHA1

922b078424ed6db6b63e9906ec1e7ca5825f59c1
SHA256

357abfa43cc84aefa8e10726ea8981b618b8d17ccd1d21964f05e9f13a0b55c9
SHA512

8dec89fd956d2004516466b14384a192856dab4ef98bb04547d2c77dff82b0c476c5bc2e04b3b1a63e43ec45c68844ab27aa4422daab60e57992f7c0323c6593
SSDEEP

3072:BWQCxo+FFqkpTZlP60vVABARnwoWvXp52oD2S+j:abD1diAF/WvXp52oD2h

Score

N/A

Malware Config

Signatures

Files

357abfa43cc84aefa8e10726ea8981b618b8d17ccd1d21964f05e9f13a0b55c9
.exe windows x86

bdfae1a2e41a4c9ea622f5519e05885f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileA
ReleaseMutex
GetTickCount
OpenEventA
SetErrorMode
CreateThread
OutputDebugStringA
lstrcpyA
MultiByteToWideChar
lstrcatA
WideCharToMultiByte
lstrcpyW
LocalSize
GetVersionExA
WinExec
SetFilePointer
GetSystemDirectoryA
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
Module32Next
Module32First
GetModuleHandleA
GetCurrentThreadId
WriteFile
GetStartupInfoA
GetProcessHeap
HeapAlloc
HeapFree
GetModuleFileNameA
MoveFileA
ExitProcess
GetWindowsDirectoryA
InitializeCriticalSection
TerminateThread
OpenProcess
FreeLibrary
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
ReadFile
CreateFileA
LocalAlloc
LocalReAlloc
FindNextFileA
LocalFree
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
lstrlenA
GetFileAttributesA
DeleteFileA
Sleep
CancelIo
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
GlobalMemoryStatusEx

user32

EnumWindows
GetWindowTextA
PostMessageA
OpenDesktopA
IsWindowVisible
GetWindowThreadProcessId
SendMessageA
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
wsprintfA
CharNextA
ExitWindowsEx
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop

advapi32

RegCreateKeyExA
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCreateKeyA
RegSetValueExA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
AbortSystemShutdownA
StartServiceA
GetUserNameA
LookupAccountSidA
GetTokenInformation
InitializeSecurityDescriptor

shell32

SHGetFileInfoA

shlwapi

SHDeleteKeyA

msvcrt

_strrev
_strnicmp
__getmainargs
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_strupr
_acmdln
exit
_XcptFilter
_exit
??3@YAXPAX@Z
memcpy
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
strlen
strstr
memset
??2@YAPAXI@Z
free
strcpy
malloc
strrchr
strcmp
rename
strcat
_except_handler3
strncpy
strtok
strncat
strchr
atoi
strncmp
_errno
realloc
mbstowcs
wcslen
wcstombs
wcscpy
atol
sprintf
_mbsstr
_mbscmp
_beginthreadex
_snprintf
calloc
??1type_info@@UAE@XZ

ws2_32

__WSAFDIsSet
ioctlsocket
inet_ntoa
recvfrom
getsockname
send
getpeername
accept
sendto
inet_addr
gethostname
WSAStartup
listen
WSACleanup
WSAIoctl
setsockopt
connect
htons
select
bind
closesocket
recv
ntohs
socket
gethostbyname

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSQuerySessionInformationA
WTSDisconnectSession
WTSQueryUserToken
WTSLogoffSession

userenv

CreateEnvironmentBlock

netapi32

NetUserSetInfo
NetUserDel
NetUserAdd
NetLocalGroupAddMembers
NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum

Sections

.text
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdfae1a2e41a4c9ea622f5519e05885f

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

msvcrt

ws2_32

msvcp60

wininet

wtsapi32

userenv

netapi32

Sections

.text Size: 104KB - Virtual size: 100KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 16KB - Virtual size: 14KB

.text
Size: 104KB - Virtual size: 100KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 16KB - Virtual size: 14KB