cbab7f5ba36203673c4da22193ef753913a9dfcca2d1b94fc01de16d46a28059

Sharing

Copy URL Twitter E-mail

General

Target

cbab7f5ba36203673c4da22193ef753913a9dfcca2d1b94fc01de16d46a28059
Size

171KB
MD5

dfbb7b0130c1a8d9a888420a2fb84325
SHA1

ee9b6a83861562fb3ea4110f7d86950ced79064e
SHA256

cbab7f5ba36203673c4da22193ef753913a9dfcca2d1b94fc01de16d46a28059
SHA512

68292e3dcc97f60d2bff745ea4e9356aa44a01e4a09004821402508b2281fba7f877c25642dff1447176914d8a2e3bb28643e923690614761b1cdeafc3155ca5
SSDEEP

3072:pleAPTdua5lF+hK2MaTMn9OkEYGT67dyuCgkFUFCEVcZUOkpT/OfRdm/07lRZrhn:pleA7YYGT6MmoEVcZUOFfIqXZNwriT

Score

N/A

Malware Config

Signatures

Files

cbab7f5ba36203673c4da22193ef753913a9dfcca2d1b94fc01de16d46a28059
.exe windows x86

01acab14383dc92ffdce4309cb8f04e5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEndOfFile
CreateProcessW
HeapAlloc
SetUnhandledExceptionFilter
SystemTimeToFileTime
SetFilePointerEx
HeapFree
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
WriteFile
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
ExitProcess
OpenMutexW
SetFilePointer
VirtualProtectEx
VirtualAllocEx
FindClose
GetLocalTime
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
GetSystemTime
CreateThread
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateRemoteThread
Process32FirstW
Process32NextW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
LoadLibraryA
FreeLibrary
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
WriteProcessMemory
GetCurrentProcessId
DuplicateHandle
GlobalUnlock
OpenEventW
WaitForMultipleObjects
CreateEventW
VirtualFree
GetComputerNameW
GetCommandLineW
ReleaseMutex
GetCurrentThreadId
SetLastError
SetFileAttributesW
WTSGetActiveConsoleSessionId
lstrcmpiA
CreateFileW
LoadLibraryW
GetLastError
CreateDirectoryW
GlobalLock
GetUserDefaultUILanguage
GetModuleFileNameW
GetFileAttributesW
Sleep
GetTickCount
MoveFileExW
ExpandEnvironmentStringsW
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
SetEvent
WaitForSingleObject
TlsGetValue
LocalFree
GetVersionExW
GetNativeSystemInfo
CloseHandle
GetProcessId
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
VirtualFreeEx
InitializeCriticalSection
SetThreadContext
GetThreadContext
GetFileAttributesExW
lstrcmpiW
GetProcAddress
GetFileSizeEx
GetModuleHandleW

user32

GetClassLongW
GetWindowLongW
GetAncestor
SetWindowPos
SendMessageTimeoutW
IsWindow
MapWindowPoints
GetWindowThreadProcessId
CharToOemW
DrawIcon
GetIconInfo
GetKeyboardState
ToUnicode
ExitWindowsEx
FillRect
PostMessageW
GetWindowInfo
CreateDesktopW
IntersectRect
GetClassNameW
PostThreadMessageW
EqualRect
PrintWindow
SendMessageW
IsRectEmpty
CharLowerBuffA
GetMessageA
GetUpdateRgn
GetMessageW
RegisterClassExA
GetWindowDC
SetCapture
SetProcessWindowStation
CloseWindowStation
CharLowerW
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
OpenDesktopW
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetMenuState
GetMenuItemCount
HiliteMenuItem
GetUserObjectInformationW
EndMenu
GetWindowRect
GetTopWindow
LoadImageW
GetShellWindow
DrawEdge
MsgWaitForMultipleObjects
GetParent
CharLowerA
RegisterClassA
DefFrameProcW
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
DefDlgProcW
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
GetDC
GetCapture
TranslateMessage
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
GetDCEx
PeekMessageA
ReleaseDC
DefWindowProcA
GetCursorPos
DefMDIChildProcW
GetSystemMetrics
MapVirtualKeyW
MessageBeep
MessageBoxW
EndPaint
GetMessagePos
DefWindowProcW
CallWindowProcW
CallWindowProcA
RegisterClassW
ReleaseCapture
DefMDIChildProcA
DefDlgProcA
SwitchDesktop
WindowFromPoint

advapi32

ConvertSidToStringSidW
InitiateSystemShutdownExW
EqualSid
IsWellKnownSid
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegEnumKeyExW

shlwapi

PathRenameExtensionW
PathRemoveFileSpecW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathQuoteSpacesW
PathRemoveBackslashW
StrCmpNIW
PathIsURLW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDeviceCaps
RestoreDC
SaveDC

ws2_32

listen
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
WSAEventSelect
recvfrom
sendto
getpeername
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
getsockname
accept
WSAGetLastError
WSASend
closesocket
send
shutdown

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01acab14383dc92ffdce4309cb8f04e5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 161KB - Virtual size: 161KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 161KB - Virtual size: 161KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 7KB - Virtual size: 7KB