5f8cc95fdefdb530ab68caa58548cde7345a9f8c6d4fa305f190885086e901c4

Sharing

Copy URL

Twitter E-mail

General

Target

5f8cc95fdefdb530ab68caa58548cde7345a9f8c6d4fa305f190885086e901c4
Size

138KB
MD5

2034adebd48b18c05e0a5d0e417743d0
SHA1

4d6832ffdf56b32a117c01bc20c6209298ff0ac1
SHA256

5f8cc95fdefdb530ab68caa58548cde7345a9f8c6d4fa305f190885086e901c4
SHA512

5dd1e4c8d3c0f735d39e2c72e2335fbf38f5d1e66e5687242aa94de6d39d7ac4d35aa28af7039c08fbed5389cab4353fe4223b844507412255b25cf4647b242b
SSDEEP

3072:2p9Hd/sCiQHwwE9CQg75o9goYd3CgXkDOXHD5fPn7NUM4+yuDTrcDZ:2rHdgQQwE9CQg2DyF7SM4+SDZ

Score

N/A

Malware Config

Signatures

Files

5f8cc95fdefdb530ab68caa58548cde7345a9f8c6d4fa305f190885086e901c4
.exe windows x86

3584b40a8b3b28d580623e0d0153d440

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
CloseHandle
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
WriteProcessMemory
SetFileAttributesW
CreateThread
lstrcmpiA
GetNativeSystemInfo
GetVersionExW
GetPrivateProfileStringW
InitializeCriticalSection
LeaveCriticalSection
GetPrivateProfileIntW
EnterCriticalSection
GetThreadContext
HeapCreate
GetProcessId
GetFileAttributesExW
GetCurrentThreadId
VirtualAlloc
GetCommandLineW
SetErrorMode
GetComputerNameW
GetModuleFileNameW
CreateEventW
OpenEventW
DuplicateHandle
GetCurrentProcessId
CreateRemoteThread
Process32FirstW
Process32NextW
GlobalLock
GlobalUnlock
GetLocalTime
MoveFileExW
GetUserDefaultUILanguage
WTSGetActiveConsoleSessionId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
HeapDestroy
ReadProcessMemory
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
GetProcAddress
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
ExitProcess
GetFileAttributesW
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetTickCount
GetModuleHandleW
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
GetSystemTime
FileTimeToDosDateTime
GetEnvironmentVariableW
ResetEvent
TerminateProcess
TlsSetValue
SetEvent
TlsGetValue
ExpandEnvironmentStringsW
lstrcmpiW
SetThreadPriority
Sleep
GetCurrentThread
WaitForSingleObject
SetThreadContext

user32

RegisterWindowMessageW
GetClipboardData
ToUnicode
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
GetCursorPos
IsWindow
GetMenuItemID
GetMessagePos
GetWindowThreadProcessId
GetSystemMetrics
MapVirtualKeyW
CharLowerBuffA
GetTopWindow
LoadImageW
SwitchDesktop
WindowFromPoint
CharToOemW
TranslateMessage
GetWindowLongW
CharLowerA
PeekMessageW
CharUpperW
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
DrawIcon
GetIconInfo
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
RegisterClassExA
DefDlgProcW
OpenInputDesktop
DefFrameProcA
RegisterClassExW
DefWindowProcA
MapWindowPoints
DefMDIChildProcW
DefDlgProcA
DefMDIChildProcA
RegisterClassW
CallWindowProcA
CallWindowProcW
DefFrameProcW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
GetDC
IntersectRect
GetDCEx
ReleaseDC
RegisterClassA
MsgWaitForMultipleObjects
GetKeyboardState
PostThreadMessageW
EqualRect
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
ExitWindowsEx
CharLowerW
ReleaseCapture

advapi32

InitiateSystemShutdownExW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
IsWellKnownSid
GetLengthSid
EqualSid
RegEnumKeyExW

shlwapi

PathUnquoteSpacesW
StrStrIW
StrStrIA
StrCmpNIW
PathRenameExtensionW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathQuoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathIsURLW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

CoUninitialize
CoCreateInstance
CLSIDFromString
StringFromGUID2
CoInitializeEx

gdi32

RestoreDC
CreateCompatibleDC
SetRectRgn
SelectObject
DeleteObject
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap
GetDIBits
GetDeviceCaps
CreateDIBSection
SaveDC

ws2_32

WSASetLastError
freeaddrinfo
send
socket
bind
recv
shutdown
setsockopt
WSASend
WSAEventSelect
getpeername
recvfrom
sendto
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
WSAGetLastError
getsockname
closesocket
listen
accept

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore

wininet

InternetReadFile
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3584b40a8b3b28d580623e0d0153d440

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB