5a426e56b9210a5ef00b7d52dc5bb8e8b98d492fe584710fe6eb3b3ab0c8b2a9

Sharing

Copy URL Twitter E-mail

General

Target

5a426e56b9210a5ef00b7d52dc5bb8e8b98d492fe584710fe6eb3b3ab0c8b2a9
Size

457KB
MD5

20945f66fd1a8946d8868767ab1eed91
SHA1

93603a6c044d54d28570d6d12ef0c2578bae3bf5
SHA256

5a426e56b9210a5ef00b7d52dc5bb8e8b98d492fe584710fe6eb3b3ab0c8b2a9
SHA512

d98f6cabc6e509ab5ee31d5ce257a38177162103de594b99bc9f25ae4a47753f3f2fc79fdc6d7d919a2e6962a363988a25869c4a14885178888ed596bf31b085
SSDEEP

12288:QJKJ1OdFTdcpSH2qMTKtQQoWgYDsABTA:QJKv0xWqMTIzHFDsABTA

Score

N/A

Malware Config

Signatures

Files

5a426e56b9210a5ef00b7d52dc5bb8e8b98d492fe584710fe6eb3b3ab0c8b2a9
.dll regsvr32 windows x86

a2a4138336d645a01636abd177e42c35

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
WideCharToMultiByte
lstrlenW
FindResourceW
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
lstrcmpiW
RaiseException
SetThreadLocale
LoadLibraryW
GetWindowsDirectoryW
WinExec
CloseHandle
WriteFile
CreateFileW
OpenProcess
lstrlenA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
IsValidCodePage
GetProcAddress
CreateThread
LoadLibraryExW
FreeLibrary
SizeofResource
LoadResource
LockResource
GetTickCount
LeaveCriticalSection
GetThreadLocale
EnterCriticalSection
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
SetHandleCount
Sleep
VirtualAlloc
FatalAppExitA
VirtualFree
HeapCreate
HeapDestroy
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetProcessHeap
GetVersionExA
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
LCMapStringA
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter

user32

CharLowerW
PostMessageW
CharLowerA
CharNextW
UnregisterClassA
MessageBoxW

advapi32

IsTextUnicode
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CoTaskMemRealloc
CoGetClassObject
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

oleaut32

UnRegisterTypeLi
SysFreeString
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
VarUI4FromStr
LoadTypeLi
SysStringLen
VariantClear
VarBstrCat
RegisterTypeLi
LoadRegTypeLi

rpcrt4

NdrStubForwardingFunction
NdrOleFree
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy

wininet

InternetCloseHandle
InternetSetCookieW
InternetGetCookieW
InternetCrackUrlW
InternetReadFile
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW

urlmon

CoInternetGetSession

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shr
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2a4138336d645a01636abd177e42c35

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

rpcrt4

wininet

urlmon

Exports

Exports

Sections

.text Size: 289KB - Virtual size: 289KB

.orpc Size: 512B - Virtual size: 148B

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 14KB - Virtual size: 17KB

.shr Size: 512B - Virtual size: 1B

.rsrc Size: 92KB - Virtual size: 92KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 289KB - Virtual size: 289KB

.orpc
Size: 512B - Virtual size: 148B

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 14KB - Virtual size: 17KB

.shr
Size: 512B - Virtual size: 1B

.rsrc
Size: 92KB - Virtual size: 92KB

.reloc
Size: 10KB - Virtual size: 10KB