bde8f16b5f54c6a55355af025dda1fe0623f8361eb09d7783df201ea64f2d2a0

Sharing

Copy URL

Twitter E-mail

General

Target

bde8f16b5f54c6a55355af025dda1fe0623f8361eb09d7783df201ea64f2d2a0
Size

107KB
MD5

31257716c7d6782356cf803a221b33c0
SHA1

ac109d7ffcf1a2cfec586c027b983702611f1954
SHA256

bde8f16b5f54c6a55355af025dda1fe0623f8361eb09d7783df201ea64f2d2a0
SHA512

6c6d6d6b817ee25c4e24b431ea79decf4a12c43869c42bdb54f7cf80b85b09afb078d19cdbe6566c43d93f1e010bd4261c81e16776c13a35cd32f48717562aa9
SSDEEP

3072:Oe1YG16yOPrYo6ACNASXnYykkSNfpgrntFkX:SG16yaWNZYASNCrnC

Score

N/A

Malware Config

Signatures

Files

bde8f16b5f54c6a55355af025dda1fe0623f8361eb09d7783df201ea64f2d2a0
.exe windows x86

6dad8c6487c3395570e1fae2de335c3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
VirtualQueryEx
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
CreateThread
ExpandEnvironmentStringsW
SetThreadPriority
CreateRemoteThread
Process32FirstW
Process32NextW
ResetEvent
CreateEventW
GetLocalTime
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
GetModuleFileNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
MoveFileExW
GetUserDefaultUILanguage
GetNativeSystemInfo
GlobalLock
GlobalUnlock
GetPrivateProfileStringW
WriteFile
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
HeapFree
SetFilePointerEx
InitializeCriticalSection
LeaveCriticalSection
SystemTimeToFileTime
DeleteFileW
HeapAlloc
GetFileAttributesW
CreateFileW
FlushFileBuffers
GetPrivateProfileIntW
GetProcAddress
EnterCriticalSection
CloseHandle
ExitProcess
FreeLibrary
CreateDirectoryW
WaitForSingleObject
SetEvent
LoadLibraryW
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetFileAttributesExW
GetProcessId
VirtualAlloc
VirtualFreeEx
SetThreadContext
GetThreadContext
SetFileAttributesW
lstrcmpiW
WTSGetActiveConsoleSessionId
lstrcmpiA
Sleep
GetModuleHandleW

user32

CharLowerW
LoadImageW
CharToOemW
DispatchMessageW
GetClipboardData
ExitWindowsEx
GetCursorPos
GetIconInfo
MsgWaitForMultipleObjects
TranslateMessage
DrawIcon
CharLowerBuffA
ToUnicode
GetKeyboardState
CharUpperW
PeekMessageW
CharLowerA

advapi32

CryptAcquireContextW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
ConvertSidToStringSidW
RegEnumKeyExW
IsWellKnownSid
GetLengthSid
InitiateSystemShutdownExW
CryptHashData
RegSetValueExW
RegCloseKey
AdjustTokenPrivileges
CryptDestroyHash
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptCreateHash
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegQueryValueExW
CryptReleaseContext
RegCreateKeyExW
GetTokenInformation
GetSidSubAuthorityCount
EqualSid

shlwapi

PathFindFileNameW
PathAddBackslashW
SHDeleteValueW
PathSkipRootW
SHDeleteKeyW
PathCombineW
PathIsDirectoryW
PathUnquoteSpacesW
PathRemoveBackslashW
PathMatchSpecW
StrCmpNIA
wvnsprintfA
wvnsprintfW
PathIsURLW
PathRenameExtensionW
StrStrIA
StrStrIW
PathQuoteSpacesW
UrlUnescapeA
StrCmpNIW
PathRemoveFileSpecW
PathAddExtensionW

shell32

SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

ws2_32

socket
bind
recv
setsockopt
shutdown
WSAGetLastError
getsockname
WSAEventSelect
recvfrom
sendto
getpeername
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
freeaddrinfo
closesocket
send
listen
accept
WSASetLastError

crypt32

PFXImportCertStore
PFXExportCertStoreEx
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

wininet

HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6dad8c6487c3395570e1fae2de335c3e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 100KB - Virtual size: 100KB

.data Size: 512B - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 100KB - Virtual size: 100KB

.data
Size: 512B - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 4KB