5a270a41b035ebf1b90e85840e7ca0e4fbf706bafd44fa5882805b1a21e1d9a4

Sharing

Copy URL

Twitter E-mail

General

Target

5a270a41b035ebf1b90e85840e7ca0e4fbf706bafd44fa5882805b1a21e1d9a4
Size

148KB
MD5

37627448513abd86310e961c3356c87c
SHA1

e900060e077e13b806452485275cdd85bc6ea495
SHA256

5a270a41b035ebf1b90e85840e7ca0e4fbf706bafd44fa5882805b1a21e1d9a4
SHA512

eb4df7be6dcec7f91e99a2bf6ab7534b4960651d59f45427bce5a19e28506ee143e8f558034bc087bb3eeef8d849b872094e3538bf6a324159e25e9cd719d6da
SSDEEP

3072:kgRceJcD/eK6V4YCfo5updOaE8LzbmM95eOBu1z:dRjJcD/eK6DCg2OzKbBbeOBy

Score

N/A

Malware Config

Signatures

Files

5a270a41b035ebf1b90e85840e7ca0e4fbf706bafd44fa5882805b1a21e1d9a4
.exe windows x86

d8b98ec92f5bf7677fabf7ea7d682a2e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
GetModuleFileNameA
CreateMutexA
CreateThread
GetCurrentThreadId
CopyFileA
GetWindowsDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
LocalSize
GetSystemDirectoryA
Process32Next
lstrcmpiA
Process32First
Module32Next
Module32First
OpenProcess
FreeLibrary
TerminateThread
GetStartupInfoA
GetLocalTime
ExitProcess
CreateRemoteThread
OpenEventA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetProcAddress
GetDriveTypeA
lstrcatA
CreateProcessA
lstrlenA
lstrcpyA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
CancelIo
InterlockedExchange
SetEvent
ResetEvent
GetTickCount
ReleaseMutex
GetVersionExA
GetModuleHandleA
GlobalUnlock
GlobalFree
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
VirtualFree
DeleteCriticalSection
Sleep
LoadLibraryA
GlobalMemoryStatusEx

user32

ReleaseDC
SetRect
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
LoadCursorA
PostThreadMessageA
GetInputState
RegisterClassA
LoadIconA
SendMessageA
GetWindowThreadProcessId
IsWindowVisible
IsWindow
CharNextA
GetSystemMetrics
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursorPos
WindowFromPoint
SetCapture
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
wsprintfA
GetMessageA
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
CloseDesktop
EnumWindows

gdi32

DeleteDC
CreateDIBSection
SelectObject
BitBlt
CreateCompatibleBitmap
GetDIBits
DeleteObject
GetStockObject

advapi32

OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumKeyExA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
StartServiceA
UnlockServiceDatabase
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
AbortSystemShutdownA
GetUserNameA
RegSetValueExA

shell32

ShellExecuteA
SHGetFileInfoA

msvcrt

_snprintf
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
atol
_mbscmp
_mbsstr
wcscpy
wcstombs
wcslen
strncpy
mbstowcs
realloc
_errno
strncmp
sprintf
rand
atoi
printf
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
memcpy
memmove
ceil
_ftol
strlen
strstr
memset
??2@YAPAXI@Z
memcmp
free
malloc
_except_handler3
strrchr
strcmp
strcpy
strcat
strchr
strncat

ws2_32

__WSAFDIsSet
recvfrom
sendto
listen
accept
getpeername
bind
WSACleanup
recv
select
WSAIoctl
setsockopt
connect
htons
WSAStartup
ioctlsocket
ntohs
inet_ntoa
gethostname
getsockname
send
closesocket
socket
gethostbyname
inet_addr

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

wtsapi32

WTSEnumerateSessionsA
WTSQuerySessionInformationW
WTSFreeMemory
WTSLogoffSession
WTSQuerySessionInformationA
WTSDisconnectSession

msvfw32

ICSeqCompressFrameEnd
ICSendMessage

netapi32

NetLocalGroupAddMembers
NetUserAdd
NetUserDel
NetUserSetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum

iphlpapi

GetIfTable
GetAdaptersInfo

psapi

EnumProcessModules

Exports

Exports

QQ841374296
aaaaaaaaaaaaaaaaaaaaa
ggggggggg
hk3600
wwwwwwwww
xxxxxxxxx
zxsahduo

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d8b98ec92f5bf7677fabf7ea7d682a2e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

ws2_32

msvcp60

wtsapi32

msvfw32

netapi32

iphlpapi

psapi

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 87KB

PAGE Size: 8KB - Virtual size: 8KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 11KB - Virtual size: 23KB

.rsrc Size: 25KB - Virtual size: 25KB

.text
Size: 88KB - Virtual size: 87KB

PAGE
Size: 8KB - Virtual size: 8KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 11KB - Virtual size: 23KB

.rsrc
Size: 25KB - Virtual size: 25KB