3950ca68e36f7b4dcc332b37262bc56cbb7f1340c3af32ff018bda0e75212dbd

Sharing

Copy URL Twitter E-mail

General

Target

3950ca68e36f7b4dcc332b37262bc56cbb7f1340c3af32ff018bda0e75212dbd
Size

15KB
MD5

430db2ef8a65cabd5a41f90da61c79a0
SHA1

6fa07a7e76b07f570563990ec8a4f31892554a3a
SHA256

3950ca68e36f7b4dcc332b37262bc56cbb7f1340c3af32ff018bda0e75212dbd
SHA512

f99b63e9d4bb0a99391728f0db2aa70a4401c3b930b0dfdb78e095a6f936f109d77fab75515aa0be8e17608367476f70416474c2d23ec6a9ec1c52a156c1a00c
SSDEEP

384:l7dIn8BqVX2hhtK4d1ij5bzR2LrLdSpo+8dmlX8K:l7Sz9WhcrbzR2L1Uo+84v

Score

N/A

Malware Config

Signatures

Files

3950ca68e36f7b4dcc332b37262bc56cbb7f1340c3af32ff018bda0e75212dbd
.exe windows x86

a8a254011495b0f1253f19e3f6a7df92

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapFree
LoadLibraryA
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MultiByteToWideChar
OpenProcess
ReadFile
RtlMoveMemory
RtlZeroMemory
FindNextFileA
GlobalUnlock
SetFilePointer
SizeofResource
Sleep
UnmapViewOfFile
VirtualAlloc
VirtualFree
WriteFile
lstrcatA
lstrcmpW
lstrcmpiA
lstrcpyA
lstrlenA
FindFirstFileA
GlobalLock
GetVersionExA
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetLocalTime
GetFileSize
GetFileAttributesA
GetEnvironmentVariableA
GetCommandLineA
FindClose
FreeResource
FreeLibrary
SetFileAttributesA
FindResourceA
ExitProcess
DeleteFileA
CreateThread
CreateProcessA
CreateMutexA
CreateFileMappingA
CreateFileA
CreateDirectoryA
CopyFileA
SetEndOfFile
CloseHandle

user32

UpdateWindow
TranslateMessage
ToAsciiEx
ShowWindow
SetTimer
SetClipboardViewer
SendMessageA
RegisterRawInputDevices
RegisterClassExA
OpenClipboard
MapVirtualKeyExA
LoadIconA
LoadCursorA
IsClipboardFormatAvailable
GetWindowThreadProcessId
wsprintfA
ChangeClipboardChain
CloseClipboard
CreateWindowExA
DefWindowProcA
GetMessageA
DispatchMessageA
GetClassNameA
GetClipboardData
GetDC
GetForegroundWindow
GetKeyNameTextA
GetKeyboardLayout
GetWindowTextA
GetWindowLongA
GetSystemMetrics
GetRawInputData
GetKeyboardState

shlwapi

PathRenameExtensionA
PathMatchSpecA
PathAddBackslashA
PathFindFileNameA

advapi32

AllocateAndInitializeSid
CryptEncrypt
CryptExportKey
CryptGenKey
CryptReleaseContext
FreeSid
RegCreateKeyExA
RegNotifyChangeKeyValue
RegSetValueExA
CryptAcquireContextA
CheckTokenMembership
CryptDestroyKey

ws2_32

socket
recv
gethostbyname
connect
closesocket
WSAStartup
send

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
FtpPutFileA

gdi32

CreateCompatibleDC
DeleteDC
DeleteObject
GetDIBits
SelectObject
StretchBlt
CreateDIBSection

gdiplus

GdipDisposeImage
GdipGetImageEncodersSize
GdipLoadImageFromFile
GdipSaveImageToFile
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders

psapi

GetProcessImageFileNameA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a8a254011495b0f1253f19e3f6a7df92

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

advapi32

ws2_32

wininet

gdi32

gdiplus

psapi

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 59KB

.rsrc Size: 512B - Virtual size: 496B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 59KB

.rsrc
Size: 512B - Virtual size: 496B