4422a5e0f94ac9cfe57db508a26c51b2f77618d0a4e9bb7bdccdf8faa56d6750

Sharing

Copy URL

Twitter E-mail

General

Target

4422a5e0f94ac9cfe57db508a26c51b2f77618d0a4e9bb7bdccdf8faa56d6750
Size

138KB
MD5

5f9b6ca5c3233da82ef473bf1755652f
SHA1

909a2f87e4896c1171f98e7b5c9ed7219256b40c
SHA256

4422a5e0f94ac9cfe57db508a26c51b2f77618d0a4e9bb7bdccdf8faa56d6750
SHA512

b05c0613106c7b9b03862e4f4bec043822de63614fd8f1129cd20c19527ad127b59edae4d9d1082f9c2acd802e295ae641409649c55cd45c811bf2f76d66ee58
SSDEEP

3072:2sFsdtt6DWjD7YAegvJkmYqgY8wP7uCsZFo6GhEjXMkgIgUKu8fKRaAlSGr7:29dttVIAegvJkn416JRKtKpr7

Score

N/A

Malware Config

Signatures

Files

4422a5e0f94ac9cfe57db508a26c51b2f77618d0a4e9bb7bdccdf8faa56d6750
.exe windows x86

38c1601d00e8423f58f78eb420c4bd96

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
HeapDestroy
ResetEvent
MoveFileExW
GetUserDefaultUILanguage
GetThreadContext
SetThreadContext
GetProcessId
GetLocalTime
GlobalLock
GlobalUnlock
TlsGetValue
TlsSetValue
TerminateProcess
SetThreadPriority
CreateRemoteThread
Process32FirstW
Process32NextW
GetNativeSystemInfo
lstrcmpiA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
WTSGetActiveConsoleSessionId
LoadLibraryA
FreeLibrary
ReadProcessMemory
LoadLibraryW
WideCharToMultiByte
Thread32First
OpenProcess
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetSystemTime
GetProcessHeap
GetCurrentThread
GetTickCount
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
GetCurrentThreadId
FileTimeToDosDateTime
EnterCriticalSection
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
WriteProcessMemory
LocalFree
GetCurrentProcessId
CloseHandle
DuplicateHandle
OpenEventW
GetFileAttributesExW
lstrcmpiW
WaitForMultipleObjects
CreateEventW
GetProcAddress
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetCommandLineW
CreateThread
ExitProcess

user32

DefWindowProcW
GetKeyboardState
GetClipboardData
ToUnicode
MapVirtualKeyW
GetSystemMetrics
GetMessageA
GetWindowRect
GetMessageW
SetCapture
PostMessageW
GetParent
GetWindowInfo
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PrintWindow
SetWindowPos
IsWindow
ReleaseCapture
SendMessageW
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
CallWindowProcA
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
RegisterClassExA
RegisterWindowMessageW
RegisterClassW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
DefMDIChildProcA
EndMenu
CallWindowProcW
PostThreadMessageW
DefFrameProcW
HiliteMenuItem
PeekMessageA
RegisterClassA
EqualRect
CharLowerBuffA
EndPaint
ExitWindowsEx
CharLowerW
GetUpdateRgn
GetWindowDC
FillRect
DrawEdge
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
TranslateMessage
GetWindowLongW
CharLowerA
PeekMessageW
BeginPaint
GetUpdateRect
IntersectRect
GetDCEx
IsRectEmpty
GetCursorPos
GetIconInfo
DrawIcon
DispatchMessageW
GetWindow
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
GetShellWindow

advapi32

IsWellKnownSid
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
InitiateSystemShutdownExW
RegEnumKeyExW
EqualSid

shlwapi

wvnsprintfW
PathRemoveBackslashW
StrCmpNIW
StrStrIW
StrStrIA
PathIsURLW
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA
PathRenameExtensionW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleDC
SetRectRgn
SaveDC
DeleteDC
SetViewportOrgEx
RestoreDC
SelectObject
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

ws2_32

listen
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
recvfrom
sendto
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
WSAGetLastError
getsockname
accept
getpeername
WSASend
closesocket
send
shutdown

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38c1601d00e8423f58f78eb420c4bd96

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB