2e21e04cd5946a54304e6d563c8ab7131b1521783b11e5a9cdb922c704c86056

Sharing

Copy URL Twitter E-mail

General

Target

2e21e04cd5946a54304e6d563c8ab7131b1521783b11e5a9cdb922c704c86056
Size

264KB
MD5

8864be4de16ced5a4f3f1bb3a3423532
SHA1

2c8a5d085ba212a746e0cef5c403565b321a6df3
SHA256

2e21e04cd5946a54304e6d563c8ab7131b1521783b11e5a9cdb922c704c86056
SHA512

6f100eee0c9e04950617dea1d6c03915d783090bedc879eabe29b8fa7622bed48bf8cf9e5e49f21180f89d787676a60cfe86106e8354010d430b5eb5af758b64
SSDEEP

6144:86j8EIMnRwFbDx/d0St0z3WOVAoKQ+96ydBIRsopOg6+r8gXs7L6:86dRwFbd/l0SOafAQlIOx+r8gX26

Score

N/A

Malware Config

Signatures

Files

2e21e04cd5946a54304e6d563c8ab7131b1521783b11e5a9cdb922c704c86056
.rar
kok.exe
.exe windows x86

e999d3d60ce8872d6668d5bd4111ebdd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

ole32

CoAddRefServerProcess
HMENU_UserSize
CreateDataAdviseHolder
HGLOBAL_UserSize
HPALETTE_UserMarshal
CreateStdProgressIndicator
OleLoad
OleUninitialize

urlmon

GetClassFileOrMime
CreateURLMoniker
FindMediaType
IsValidURL
RegisterMediaTypeClass
UrlMkSetSessionOption
RegisterMediaTypes
HlinkGoForward
GetClassURL
CreateFormatEnumerator
FindMediaTypeClass
WriteHitLogging
RevokeFormatEnumerator
URLOpenBlockingStreamW
URLDownloadToFileA
SetSoftwareUpdateAdvertisementState
HlinkSimpleNavigateToMoniker
CoInternetCreateZoneManager
CoInternetCompareUrl
IsLoggingEnabledA
CoInternetGetSession
CopyBindInfo
RegisterFormatEnumerator
CopyStgMedium
URLDownloadToCacheFileW
HlinkSimpleNavigateToString
CoInternetGetSecurityUrl

shell32

FindExecutableW
SHEmptyRecycleBinW
SHAppBarMessage

wininet

InternetQueryDataAvailable
GopherCreateLocatorA
InternetCheckConnectionA
GetUrlCacheEntryInfoA
HttpEndRequestA
GopherGetLocatorTypeW
GopherOpenFileA
FtpOpenFileW
FindFirstUrlCacheEntryExW
InternetConnectA
GopherFindFirstFileW
CreateUrlCacheEntryW
InternetConnectW
InternetTimeFromSystemTime
InternetReadFile
InternetSetFilePointer
HttpQueryInfoA
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryExA
HttpSendRequestA
InternetSetOptionW
InternetCanonicalizeUrlA
InternetCombineUrlA
GopherGetAttributeA
RetrieveUrlCacheEntryStreamA
FtpCreateDirectoryA

msvcrt

_except_handler3

imm32

ImmGetConversionListA

pdh

PdhGetLogFileSize
PdhSetCounterScaleFactor
PdhValidatePathA
PdhOpenLogA
PdhCollectQueryData
PdhGetRawCounterArrayA
PdhGetDefaultPerfObjectA
PdhParseInstanceNameA
PdhUpdateLogA
PdhSelectDataSourceW
PdhLookupPerfIndexByNameA
PdhOpenQueryW
PdhLookupPerfNameByIndexA

oleacc

GetStateTextA
LresultFromObject
AccessibleObjectFromPoint

kernel32

FindFirstFileA
GetPrivateProfileSectionNamesA

comdlg32

GetFileTitleA
GetOpenFileNameA
GetFileTitleW
GetSaveFileNameW
ReplaceTextA
ChooseColorA
PageSetupDlgA
CommDlgExtendedError

resutils

ResUtilSetPropertyTable
ResUtilGetDwordProperty
ResUtilEnumPrivateProperties
ResUtilAddUnknownProperties
ResUtilStartResourceService
ResUtilIsPathValid
ResUtilDupParameterBlock
ResUtilDupString
ResUtilStopService

shlwapi

SHDeleteKeyW
PathFindNextComponentW
PathStripPathW
PathGetArgsA
PathRemoveBackslashW
PathMakePrettyW
SHRegGetBoolUSValueA
PathAddExtensionW
PathQuoteSpacesW
PathSearchAndQualifyW
PathIsUNCServerShareW
StrCSpnIW
PathIsUNCServerShareA
StrTrimA
StrFormatByteSizeW
SHRegGetBoolUSValueW
SHRegEnumUSKeyA
PathFindFileNameA
PathSkipRootW
PathRemoveFileSpecA
PathIsRootW
PathCompactPathA
PathRemoveExtensionW
SHRegSetUSValueW
PathIsFileSpecW
PathParseIconLocationW
PathIsUNCServerW
PathFileExistsW
PathIsContentTypeW
PathIsUNCA
PathRelativePathToA
SHRegOpenUSKeyA
PathRemoveFileSpecW
SHEnumValueA
PathIsURLA
PathUnmakeSystemFolderA
SHRegDeleteUSValueW
PathRemoveArgsW
PathSkipRootA

oleaut32

VarI1FromDate
VarBoolFromUI1
SystemTimeToVariantTime
VarFormatCurrency
CreateErrorInfo
VarUI1FromR8

msi

ord164
ord169
ord8
ord59
ord9
ord56
ord22
ord47
ord60
ord26
ord33
ord21
ord14
ord65
ord28
ord30
ord73
ord37
ord170
ord55
ord31
ord29
ord16
ord50
ord66
ord75
ord46
ord43
ord171
ord27

clusapi

SetClusterNetworkPriorityOrder
RegisterClusterNotify
ClusterRegEnumKey
GetClusterNetworkState
ClusterEnum
GetClusterNetInterface
DeleteClusterGroup
ClusterNetInterfaceControl
GetClusterResourceState
CloseClusterGroup
SetClusterNetworkName
GetClusterNetworkKey
DeleteClusterResourceType
ClusterGroupEnum
ClusterNodeEnum
ClusterRegQueryInfoKey

advapi32

RegFlushKey
RegDeleteValueW
LsaRetrievePrivateData
OpenBackupEventLogA
CreateRestrictedToken

rpcrt4

NdrPointerMarshall
RpcServerUseProtseqIfExW
NdrServerContextMarshall
UuidHash
NdrInterfacePointerBufferSize
RpcMgmtEnableIdleCleanup
NdrEncapsulatedUnionMarshall
NdrComplexStructFree
UuidCompare
double_from_ndr
MIDL_wchar_strcpy
NdrConformantStructUnmarshall
NdrComplexStructMarshall
I_RpcIfInqTransferSyntaxes
NdrEncapsulatedUnionMemorySize
RpcEpRegisterNoReplaceA
NdrPointerBufferSize
RpcBindingCopy
RpcMgmtInqIfIds
tree_peek_ndr
NdrServerInitialize
NdrComplexArrayUnmarshall
NdrNonConformantStringUnmarshall
NdrNonConformantStringMarshall
RpcBindingSetAuthInfoA
NdrClientContextMarshall
NdrRpcSsEnableAllocate
RpcSsDontSerializeContext
RpcBindingServerFromClient
NdrNonEncapsulatedUnionMemorySize
I_RpcReallocPipeBuffer
NdrComplexStructMemorySize
IUnknown_Release_Proxy
NdrVaryingArrayMarshall
NdrPointerUnmarshall
NdrXmitOrRepAsUnmarshall
I_RpcFree
RpcMgmtInqServerPrincNameW
NdrClientContextUnmarshall
NdrMesSimpleTypeDecode
I_RpcMapWin32Status
NdrConformantVaryingStructBufferSize
NdrVaryingArrayFree
I_RpcAllocate
RpcBindingReset
RpcMgmtSetServerStackSize
NdrServerMarshall
RpcRevertToSelfEx
I_RpcBindingInqTransportType
I_RpcRequestMutex
NdrFixedArrayBufferSize
NdrServerInitializeUnmarshall
RpcBindingInqAuthInfoA
NdrInterfacePointerMarshall
I_RpcConnectionInqSockBuffSize
RpcServerUseProtseqIfW
MesIncrementalHandleReset
NDRSContextUnmarshall
double_array_from_ndr
RpcMgmtInqDefaultProtectLevel
NdrNonEncapsulatedUnionMarshall
RpcMgmtInqStats
RpcSmAllocate
MesHandleFree
I_RpcGetCurrentCallHandle
I_RpcSsDontSerializeContext
I_RpcClearMutex
NDRcopy
RpcServerUseProtseqEpExW
RpcAsyncAbortCall
NdrConformantArrayMemorySize
NdrServerUnmarshall
enum_from_ndr
NdrServerCall
UuidCreateNil
RpcBindingSetAuthInfoW
NdrServerInitializePartial
RpcSsGetThreadHandle
NDRCContextBinding
RpcSsDisableAllocate
RpcBindingFromStringBindingW
I_RpcNsBindingSetEntryNameA
NdrServerInitializeNew
NdrAsyncServerCall
NdrFullPointerQueryRefId
RpcSsAllocate
NdrXmitOrRepAsMemorySize
RpcRevertToSelf
NdrRpcSmSetClientToOsf
NdrFixedArrayMarshall
RpcServerRegisterAuthInfoA
NdrMesSimpleTypeAlignSize
NdrGetDcomProtocolVersion
NdrConvert
I_RpcSend
short_array_from_ndr
I_RpcBindingCopy
NdrConformantVaryingArrayBufferSize

setupapi

SetupDiDrawMiniIcon
SetupDiDestroyDriverInfoList
SetupGetStringFieldA
SetupQueryDrivesInDiskSpaceListW

user32

GetDlgItemInt
ChangeClipboardChain
VkKeyScanExA
SendMessageW
ReuseDDElParam
FrameRect

rasapi32

RasGetErrorStringW
RasSetEntryDialParamsA
RasValidateEntryNameW
RasGetCountryInfoA
RasEnumConnectionsW
RasSetEntryDialParamsW
RasRenameEntryA
RasValidateEntryNameA
RasDeleteEntryW

gdi32

GetTextAlign
LineTo
GetBitmapDimensionEx
ExtSelectClipRgn
CreateBitmap
DPtoLP

version

VerFindFileW
GetFileVersionInfoSizeA

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 728KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e999d3d60ce8872d6668d5bd4111ebdd

Headers

File Characteristics

Imports

ole32

urlmon

shell32

wininet

msvcrt

imm32

pdh

oleacc

kernel32

comdlg32

resutils

shlwapi

oleaut32

msi

clusapi

advapi32

rpcrt4

setupapi

user32

rasapi32

gdi32

version

Sections

.text Size: 60KB - Virtual size: 57KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 4KB - Virtual size: 728KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 60KB - Virtual size: 57KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 4KB - Virtual size: 728KB

.rsrc
Size: 4KB - Virtual size: 1KB