6bc9605ec18f2e40781d414acdf8a8efb3af89618fd35717534f8ef6ca28c7fa

Sharing

Copy URL

Twitter E-mail

General

Target

6bc9605ec18f2e40781d414acdf8a8efb3af89618fd35717534f8ef6ca28c7fa
Size

126KB
MD5

7418c356f684dec2a73ad2abfc0f8c5b
SHA1

329fb708ead821cdddf2d24d037b966d52e92126
SHA256

6bc9605ec18f2e40781d414acdf8a8efb3af89618fd35717534f8ef6ca28c7fa
SHA512

8690872c0f094f48e315614816120634ed6c970e094ca34987bf9abf1eba42d078348ab6156a00512cb6ba8c997c1009f6681e1ef456e1302a83973c6b457673
SSDEEP

3072:1DniqOrqe808NGVJYU3uL5OidUaE8ouOU45e5BT:ZnNOrqe808UGU3SDUztNe5B

Score

N/A

Malware Config

Signatures

Files

6bc9605ec18f2e40781d414acdf8a8efb3af89618fd35717534f8ef6ca28c7fa
.exe windows x86

d8b98ec92f5bf7677fabf7ea7d682a2e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
GetModuleFileNameA
CreateMutexA
CreateThread
GetCurrentThreadId
CopyFileA
GetWindowsDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
LocalSize
GetSystemDirectoryA
Process32Next
lstrcmpiA
Process32First
Module32Next
Module32First
OpenProcess
FreeLibrary
TerminateThread
GetStartupInfoA
GetLocalTime
ExitProcess
CreateRemoteThread
OpenEventA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetProcAddress
GetDriveTypeA
lstrcatA
CreateProcessA
lstrlenA
lstrcpyA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
CancelIo
InterlockedExchange
SetEvent
ResetEvent
GetTickCount
ReleaseMutex
GetVersionExA
GetModuleHandleA
GlobalUnlock
GlobalFree
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
VirtualFree
DeleteCriticalSection
Sleep
LoadLibraryA
GlobalMemoryStatusEx

user32

ReleaseDC
SetRect
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
LoadCursorA
PostThreadMessageA
GetInputState
RegisterClassA
LoadIconA
SendMessageA
GetWindowThreadProcessId
IsWindowVisible
IsWindow
CharNextA
GetSystemMetrics
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursorPos
WindowFromPoint
SetCapture
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
wsprintfA
GetMessageA
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
CloseDesktop
EnumWindows

gdi32

DeleteDC
CreateDIBSection
SelectObject
BitBlt
CreateCompatibleBitmap
GetDIBits
DeleteObject
GetStockObject

advapi32

OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumKeyExA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
StartServiceA
UnlockServiceDatabase
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
AbortSystemShutdownA
GetUserNameA
RegSetValueExA

shell32

ShellExecuteA
SHGetFileInfoA

msvcrt

_snprintf
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
atol
_mbscmp
_mbsstr
wcscpy
wcstombs
wcslen
strncpy
mbstowcs
realloc
_errno
strncmp
sprintf
rand
atoi
printf
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
memcpy
memmove
ceil
_ftol
strlen
strstr
memset
??2@YAPAXI@Z
memcmp
free
malloc
_except_handler3
strrchr
strcmp
strcpy
strcat
strchr
strncat

ws2_32

__WSAFDIsSet
recvfrom
sendto
listen
accept
getpeername
bind
WSACleanup
recv
select
WSAIoctl
setsockopt
connect
htons
WSAStartup
ioctlsocket
ntohs
inet_ntoa
gethostname
getsockname
send
closesocket
socket
gethostbyname
inet_addr

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

wtsapi32

WTSEnumerateSessionsA
WTSQuerySessionInformationW
WTSFreeMemory
WTSLogoffSession
WTSQuerySessionInformationA
WTSDisconnectSession

msvfw32

ICSeqCompressFrameEnd
ICSendMessage

netapi32

NetLocalGroupAddMembers
NetUserAdd
NetUserDel
NetUserSetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum

iphlpapi

GetIfTable
GetAdaptersInfo

psapi

EnumProcessModules

Exports

Exports

QQ841374296
aaaaaaaaaaaaaaaaaaaaa
ggggggggg
hk3600
wwwwwwwww
xxxxxxxxx
zxsahduo

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d8b98ec92f5bf7677fabf7ea7d682a2e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

ws2_32

msvcp60

wtsapi32

msvfw32

netapi32

iphlpapi

psapi

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 87KB

PAGE Size: 8KB - Virtual size: 8KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 11KB - Virtual size: 23KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 88KB - Virtual size: 87KB

PAGE
Size: 8KB - Virtual size: 8KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 11KB - Virtual size: 23KB

.rsrc
Size: 4KB - Virtual size: 3KB