fb12523b8300788f14c351a071c57da8dff793316916980510cf7feef4f83a8b

Sharing

Copy URL

Twitter E-mail

General

Target

fb12523b8300788f14c351a071c57da8dff793316916980510cf7feef4f83a8b
Size

138KB
MD5

9f8a279291750bb97d5c1eae362238b8
SHA1

f069f5a50bc586b7f4c42e5d1ea092d9e742181f
SHA256

fb12523b8300788f14c351a071c57da8dff793316916980510cf7feef4f83a8b
SHA512

4b8ff0daa8278e5c02e5dcd4cf6302d04bb18dce278056aa51b07761068f6e119f50c3c18748c0dfd388486757624f507780e81644450227fd42f498bbdbfb88
SSDEEP

3072:8zE81egey1vlx3KiIbf7g3qJFjysgycTxgmipEoKrCyt0lxFVsrT:8zE81Xllx3Kpj0qebycdgmiWWN+rT

Score

N/A

Malware Config

Signatures

Files

fb12523b8300788f14c351a071c57da8dff793316916980510cf7feef4f83a8b
.exe windows x86

2bfd5dde7317b33490c61538e798cb6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForMultipleObjects
lstrcmpiW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
CreateEventW
GetNativeSystemInfo
GetVersionExW
GetLocalTime
ExitProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
SetEvent
GetModuleFileNameW
Thread32First
OpenEventW
RemoveDirectoryW
GetCurrentProcessId
lstrcmpiA
WTSGetActiveConsoleSessionId
SetThreadPriority
TlsGetValue
TlsSetValue
TerminateProcess
ResetEvent
CreateRemoteThread
Process32FirstW
Process32NextW
GetCurrentThreadId
MoveFileExW
GetUserDefaultUILanguage
GlobalLock
GlobalUnlock
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetThreadContext
SetThreadContext
GetProcessId
OpenProcess
VirtualQueryEx
LoadLibraryA
FindClose
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
SetFileTime
IsBadReadPtr
GetTempPathW
MultiByteToWideChar
GetTimeZoneInformation
ReadFile
Thread32Next
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
LoadLibraryW
VirtualFreeEx
DuplicateHandle
WideCharToMultiByte
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
WaitForSingleObject
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
CloseHandle
EnterCriticalSection
GetProcAddress
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
GetModuleHandleW
GetFileAttributesExW
GetSystemTime

user32

DefFrameProcW
RegisterClassA
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
CallWindowProcW
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
GetWindowInfo
DrawEdge
BeginPaint
GetUserObjectInformationW
IntersectRect
GetDCEx
PostThreadMessageW
EqualRect
PrintWindow
CreateDesktopW
SetProcessWindowStation
HiliteMenuItem
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
GetSystemMetrics
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
OpenDesktopW
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
EndMenu
GetShellWindow
RegisterClassW
GetKeyboardState
GetMenuItemCount
EndPaint
ToUnicode
CallWindowProcA
DefDlgProcW
DefFrameProcA
CharLowerW
DispatchMessageW
OpenInputDesktop
RegisterClassExW
GetClipboardData
DefWindowProcA
SendMessageW
DefWindowProcW
IsRectEmpty
CharLowerBuffA
ExitWindowsEx
DrawIcon
GetIconInfo
GetCursorPos
MapVirtualKeyW
PostMessageW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
TranslateMessage
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
GetUpdateRect
GetWindow
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
CharLowerA
GetWindowLongW
RegisterClassExA

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
InitiateSystemShutdownExW
IsWellKnownSid
GetLengthSid
EqualSid
RegEnumKeyExW

shlwapi

wvnsprintfW
StrStrIW
StrStrIA
PathQuoteSpacesW
StrCmpNIW
PathRenameExtensionW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

SetRectRgn
SelectObject
CreateCompatibleDC
DeleteDC
SetViewportOrgEx
SaveDC
RestoreDC
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

ws2_32

WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
WSASend
getpeername
recvfrom
sendto
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2bfd5dde7317b33490c61538e798cb6d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB