ef8fa32606da62e19d4bdd28d6d598f14413f066c2dd81e4db52772678291548

Sharing

Copy URL Twitter E-mail

General

Target

ef8fa32606da62e19d4bdd28d6d598f14413f066c2dd81e4db52772678291548
Size

168KB
MD5

27546287ed9a8ced5fc280efac8c1776
SHA1

0fbb74b297d3323b21fd17a55121bd6c22c9128f
SHA256

ef8fa32606da62e19d4bdd28d6d598f14413f066c2dd81e4db52772678291548
SHA512

0399e01c7e05fac0bc77e47ce0c4582796fbf6a7062c02245339e6763fbaa92d6223269a7bfc53f6297f6adc8c73334f8674a2bb5874c94b5a794732a3066175
SSDEEP

3072:WHaSDeo1Jer7Y7I31TGpvJtoMHWUoVvhmDQ05OZLkE2xT:oaVMeQs318+vhmDQgOj

Score

N/A

Malware Config

Signatures

Files

ef8fa32606da62e19d4bdd28d6d598f14413f066c2dd81e4db52772678291548
.dll windows x86

99c2adbe9b84a4325b9ba742a2c51936

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
WriteFile
ReadFile
GlobalLock
GlobalAlloc
FlushFileBuffers
WritePrivateProfileStringA
GetPrivateProfileStringA
GetVersionExA
GetCurrentProcess
GetCurrentThread
GetComputerNameA
GetDriveTypeA
HeapFree
HeapAlloc
GetProcessHeap
GlobalUnlock
SetLastError
OpenProcess
Sleep
SetStdHandle
LCMapStringW
LCMapStringA
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetProfileStringA
WriteProfileStringA
CreateFileA
GetFileSize
SetFilePointer
CloseHandle
FindNextFileA
FindFirstFileA
SetFileAttributesA
FindClose
GetLastError
MoveFileExA
GetWindowsDirectoryA
GetSystemDirectoryA
DeleteFileA
lstrcatA
FreeLibrary
lstrcpyA
lstrcmpiA
lstrlenA
LoadLibraryA
GetProcAddress
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
RtlUnwind
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCPInfo
GetACP
GetOEMCP
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc

user32

SendDlgItemMessageA
wsprintfA
GetDlgItem
SendMessageA
PostMessageA
SendNotifyMessageA
RegisterWindowMessageA
FindWindowA
SetWindowTextA

winspool.drv

EnumPrintersA
OpenPrinterA
DeletePrinter
ClosePrinter
SetPrinterA
EnumMonitorsA
EnumPortsA
AddPortA

advapi32

OpenServiceA
CreateServiceA
DeleteService
QueryServiceStatus
ControlService
OpenSCManagerA
CloseServiceHandle
StartServiceA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA

wsock32

gethostbyname
socket
WSAStartup
inet_addr
WSACleanup
closesocket

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

AddSvc9x
BrowseNetworkPrinters
CheckSharingService
DeleteRegistry
DeleteRegistryUSB
DeleteRegistryUSB98
GetCDROMDrive
GetMyPCName
GetMyPCName2
GetMyPcAddress
GetPrinterIPAddress
MyAddPort
MyCheckExeProcess
MyCheckExistService
MyCreateService
MyDeleteMonitor
MyDeletePrinterReBoot
MyDeleteService
MyEnumPorts
MyEnumPrinterName
MyEnumSharedPrinterName
MyGetFileVersion
MyGetPortOfPrinter
MyPostStopMessage
MyPostStopMessageTrapMon
MyRemoveLastFolder
MySetDefaultPrinter
MySetSharedPrinter
MyStartService
MyStopService
RegUtilAmIAdministrator
SetAvailablePortMonitors
StartCleanUp

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99c2adbe9b84a4325b9ba742a2c51936

Headers

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

shell32

wsock32

version

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 56KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 84KB - Virtual size: 88KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 60KB - Virtual size: 56KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 84KB - Virtual size: 88KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB