53ac70547fa3dee56a5f039ee9d184804df1da20bb7421be822371b31471da81

Sharing

Copy URL

Twitter E-mail

General

Target

53ac70547fa3dee56a5f039ee9d184804df1da20bb7421be822371b31471da81
Size

184KB
MD5

b6dda9ea92460f237d1ffa543cf77e22
SHA1

86e07bccb3600ea788d102f7f24ccef13860b2a7
SHA256

53ac70547fa3dee56a5f039ee9d184804df1da20bb7421be822371b31471da81
SHA512

a3b6514908a63c0d6cebe5e21411a857eecd923d9431c60b866f14df1cc9b5dcf29fd0e4854c8002160a025d05fdc85759662bb5d9298cf1d8511d599bca72e9
SSDEEP

3072:DnIXEIue9GmohpSqtqdRyX3pj4nQyk4l4jSvVP8aKWyLccJs1YLIVGQGGe0OUrss:LVqm58NkJOV71wie0GQGG3O3mS

Score

N/A

Malware Config

Signatures

Files

53ac70547fa3dee56a5f039ee9d184804df1da20bb7421be822371b31471da81
.exe windows x86

01fba20cbb588b5b11fade071e4e39ae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_onexit
_decode_pointer
_invoke_watson
_controlfp_s
_lock
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_strnicmp
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
calloc
_snprintf
_beginthreadex
atol
sprintf
mbstowcs
wcstombs
_errno
strncmp
_mbscmp
_mbsstr
atoi
realloc
strncat
srand
rand
_time64
strncpy
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
strrchr
??_U@YAPAXI@Z
free
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
malloc
strchr
memmove
ceil
strstr
memcpy
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
??2@YAPAXI@Z
memset

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
WaitForSingleObject
LoadLibraryA
GetProcAddress
Sleep
TerminateThread
ResumeThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
ResetEvent
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
lstrcpyA
GetWindowsDirectoryA
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
GetLastError
CreateDirectoryA
GetFileAttributesA
CreateProcessA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
DeleteFileA
CloseHandle
GetFileSize
CreateFileA
WriteFile
SetFilePointer
MoveFileA
ReadFile
GetModuleFileNameA
GetCurrentProcess
CreateRemoteThread
OpenProcess
ExitThread
CreateThread
GetTickCount
ExitProcess
GetLocalTime
GetSystemDirectoryA
LocalSize
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetStartupInfoA
CreatePipe
GlobalMemoryStatusEx
GetSystemInfo
SetFileAttributesA
MoveFileExA
DefineDosDeviceA
OpenEventA
SetErrorMode
CreateMutexA
lstrcpyW
Process32Next
lstrcmpiA
Process32First
Module32Next
Module32First
GetModuleHandleA
GetCurrentThreadId
InterlockedCompareExchange
UnhandledExceptionFilter

user32

SystemParametersInfoA
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetCursorPos
SetCapture
SendMessageA
DestroyCursor
LoadCursorA
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
CharNextA
wsprintfA
GetMessageA
GetCursorInfo
ReleaseDC
GetDC
GetDesktopWindow
SetRect
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
ExitWindowsEx
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
PostMessageA
CloseWindow
WindowFromPoint
IsWindow
CreateWindowExA
MapVirtualKeyA
DispatchMessageA
TranslateMessage

gdi32

DeleteDC
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject

advapi32

DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
GetTokenInformation
LookupAccountSidA
GetUserNameA
AbortSystemShutdownA
EnumServicesStatusA
StartServiceA
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
ControlService
QueryServiceStatus
OpenServiceA
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryInfoKeyA
QueryServiceConfigA

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

winmm

waveOutPrepareHeader
waveOutGetNumDevs
waveInAddBuffer
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutOpen

ws2_32

WSAIoctl
select
recv
inet_addr
sendto
connect
gethostbyname
htons
send
setsockopt
WSAStartup
ioctlsocket
listen
accept
getpeername
__WSAFDIsSet
recvfrom
bind
ntohs
getsockname
WSAGetLastError
WSACleanup
htonl
gethostname
inet_ntoa
socket
WSASocketA
closesocket

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

msvfw32

ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd

netapi32

NetUserGetInfo
NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups
NetUserSetInfo
NetLocalGroupAddMembers
NetUserAdd
NetUserDel

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSLogoffSession
WTSDisconnectSession
WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

JJI
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

KKLM
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

IIKJ
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01fba20cbb588b5b11fade071e4e39ae

Headers

File Characteristics

Imports

msvcr80

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

msvcp80

wininet

msvfw32

netapi32

psapi

wtsapi32

Sections

.text Size: 116KB - Virtual size: 113KB

JJI Size: 4KB - Virtual size: 1KB

KKLM Size: 8KB - Virtual size: 4KB

IIKJ Size: 8KB - Virtual size: 4KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 12KB - Virtual size: 8KB

.text
Size: 116KB - Virtual size: 113KB

JJI
Size: 4KB - Virtual size: 1KB

KKLM
Size: 8KB - Virtual size: 4KB

IIKJ
Size: 8KB - Virtual size: 4KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 12KB - Virtual size: 8KB