1364290865e2cc59c1e3f0a45e5d8166638326f904b06f189c902f3428dd4583

Sharing

Copy URL Twitter E-mail

General

Target

1364290865e2cc59c1e3f0a45e5d8166638326f904b06f189c902f3428dd4583
Size

846KB
MD5

0ac05518a09369ae18af00f90dc93d91
SHA1

c6d742ee1fbf66e77d8862a36725913e6b63f524
SHA256

1364290865e2cc59c1e3f0a45e5d8166638326f904b06f189c902f3428dd4583
SHA512

c796397175ab6873f343e0c3e1d012d9c116d739925719742b45508c82421282b474eb0d6fdf4a4ebf256f99d75630aa699269c39bd42e85cbbe8acd43facf67
SSDEEP

24576:TpmCZR/zT4HkDbvZWFdul3hwkcNNSU7WiSYMEbos2Ibg:UCZR/zT4MrZOhZV+YMEbtg

Score

N/A

Malware Config

Signatures

Files

1364290865e2cc59c1e3f0a45e5d8166638326f904b06f189c902f3428dd4583
.dll windows x86

cb4274f58d8ceea647a8f3ec9bd574e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
Process32First
GetCurrentProcessId
Process32Next
GetSystemInfo
CreateToolhelp32Snapshot
Module32First
Module32Next
GetLastError
GetCurrentProcess
GetModuleFileNameA
GetProcAddress
CreateThread
CloseHandle
GetCurrentThread
GetThreadContext
VirtualFree
GetVersionExA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DeviceIoControl
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
SetFileAttributesA
WriteProcessMemory
CreateEventA
GetCurrentThreadId
TerminateThread
CreateMutexA
WaitForSingleObject
ReleaseMutex
Sleep
CopyFileA
CreateFileA
GetSystemDirectoryA
ReadFile

user32

GetFocus
GetGUIThreadInfo
MapVirtualKeyA
GetKeyboardState
SwapMouseButton
WindowFromPoint
GetCursorPos
ScreenToClient
GetAncestor
keybd_event
GetWindowThreadProcessId
SetTimer
KillTimer
GetKeyState
ToAscii
GetForegroundWindow
AttachThreadInput

ws2_32

htonl
ntohs
ntohl
htons

advapi32

CloseServiceHandle
OpenSCManagerA
RegCloseKey
RegOpenKeyA
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
CreateServiceA
ControlService
DeleteService
OpenServiceA

ole32

CoCreateGuid

msvcrt

_itoa
_except_handler3
memmove
_purecall
_mbsnbcat
_getpid
srand
free
malloc
strrchr
sprintf
fopen
fseek
ftell
fread
fclose
rand
_getcwd
_mbsnbcpy
strncat
memset
memcmp
memcpy
time
_memicmp
_access
??2@YAPAXI@Z
__CxxFrameHandler
strncpy

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

shell32

ShellExecuteA

Exports

Exports

CreateObj

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text$t0
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text$t1
Size: 585KB - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb4274f58d8ceea647a8f3ec9bd574e5

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

advapi32

ole32

msvcrt

version

shell32

Exports

Exports

Sections

.text Size: 150KB - Virtual size: 149KB

.rdata Size: 63KB - Virtual size: 63KB

.data Size: 24KB - Virtual size: 24KB

.rsrc Size: 1024B - Virtual size: 968B

.text$t0 Size: 14KB - Virtual size: 13KB

.text$t1 Size: 585KB - Virtual size: 585KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 150KB - Virtual size: 149KB

.rdata
Size: 63KB - Virtual size: 63KB

.data
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 1024B - Virtual size: 968B

.text$t0
Size: 14KB - Virtual size: 13KB

.text$t1
Size: 585KB - Virtual size: 585KB

.reloc
Size: 6KB - Virtual size: 6KB