f8a42d662a9ccc0ea1fee961c9786c2749ce8c79ced221db4d3cdc4b2679f584

Sharing

Copy URL Twitter E-mail

General

Target

f8a42d662a9ccc0ea1fee961c9786c2749ce8c79ced221db4d3cdc4b2679f584
Size

188KB
MD5

8dc25f5e987414590c51a6f5ea123535
SHA1

b9863f5e59d87a0278c9ef856035b61867443db1
SHA256

f8a42d662a9ccc0ea1fee961c9786c2749ce8c79ced221db4d3cdc4b2679f584
SHA512

cd1ffd44322d3dc2208e099d0d0600c782cc7b9da549974f6d0095aef7b67a390fc9d09aa3c30be01b88f6b3e72554ff2883e28345438fef58dc6e381f3f3c33
SSDEEP

3072:VL6coxamOUNmCm9j+dJpkT4QfM9KRpSIcqw/lLltQoyPjrnx40OCehUH:VLocmIMdidfnT1nxhOBU

Score

N/A

Malware Config

Signatures

Files

f8a42d662a9ccc0ea1fee961c9786c2749ce8c79ced221db4d3cdc4b2679f584
.exe windows x86

98868446825da5558bdbc3f4785982be

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_onexit
_decode_pointer
_invoke_watson
_controlfp_s
_lock
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_strnicmp
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
calloc
_snprintf
_beginthreadex
atol
sprintf
mbstowcs
wcstombs
_errno
strncmp
_mbscmp
_mbsstr
atoi
realloc
strncat
srand
rand
_time64
strncpy
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
strrchr
??_U@YAPAXI@Z
free
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
malloc
strchr
memmove
ceil
strstr
memcpy
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
??2@YAPAXI@Z
memset

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
Sleep
WaitForSingleObject
LoadLibraryA
GetProcAddress
TerminateThread
CreateThread
SetEvent
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
ResetEvent
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
lstrcpyA
GetWindowsDirectoryA
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
GetLastError
GetFileAttributesA
CreateProcessA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
DeleteFileA
CloseHandle
GetFileSize
CreateFileA
SetFilePointer
MoveFileA
ReadFile
GetModuleFileNameA
GetCurrentProcess
CreateRemoteThread
OpenProcess
ExitThread
GetTickCount
ExitProcess
GetLocalTime
LocalSize
GlobalAlloc
GlobalSize
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetStartupInfoA
CreatePipe
GetSystemInfo
SetFileAttributesA
MoveFileExA
DefineDosDeviceA
CreateMutexA
lstrcpyW
Process32Next
lstrcmpiA
Process32First
Module32First
GetModuleHandleA
GetCurrentThreadId
InterlockedCompareExchange
UnhandledExceptionFilter

user32

GetClipboardData
EmptyClipboard
SetClipboardData
CloseClipboard
WindowFromPoint
SetCapture
MapVirtualKeyA
DestroyCursor
GetSystemMetrics
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
CharNextA
wsprintfA
GetMessageA
SystemParametersInfoA
SendMessageA
GetCursorInfo
ReleaseDC
GetDC
GetDesktopWindow
SetRect
OpenWindowStationA
GetProcessWindowStation
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
ExitWindowsEx
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
PostMessageA
CloseWindow
IsWindow
OpenClipboard
CreateWindowExA
LoadCursorA
DispatchMessageA
TranslateMessage

gdi32

DeleteDC
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject

advapi32

OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
GetTokenInformation
LookupAccountSidA
GetUserNameA
AbortSystemShutdownA
EnumServicesStatusA
StartServiceA
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryInfoKeyA
QueryServiceConfigA

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

winmm

waveOutPrepareHeader
waveOutGetNumDevs
waveInAddBuffer
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutOpen

ws2_32

WSAIoctl
select
recv
inet_addr
sendto
connect
gethostbyname
htons
send
closesocket
WSAStartup
ioctlsocket
listen
accept
getpeername
__WSAFDIsSet
recvfrom
bind
ntohs
getsockname
WSAGetLastError
WSACleanup
htonl
gethostname
inet_ntoa
socket
WSASocketA
setsockopt

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

msvfw32

ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd

netapi32

NetUserGetInfo
NetApiBufferFree
NetUserEnum
NetUserGetLocalGroups
NetUserSetInfo
NetLocalGroupAddMembers
NetUserAdd
NetUserDel

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSLogoffSession
WTSDisconnectSession
WTSFreeMemory
WTSQuerySessionInformationA

Sections

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RRT
Size: 4KB - Virtual size: 715B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

SSD
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

MMN
Size: 4KB - Virtual size: 875B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TTH
Size: 4KB - Virtual size: 699B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

FFG
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98868446825da5558bdbc3f4785982be

Headers

File Characteristics

Imports

msvcr80

kernel32

user32

gdi32

advapi32

shell32

winmm

ws2_32

msvcp80

wininet

msvfw32

netapi32

psapi

wtsapi32

Sections

.text Size: 128KB - Virtual size: 124KB

RRT Size: 4KB - Virtual size: 715B

SSD Size: 4KB - Virtual size: 1KB

MMN Size: 4KB - Virtual size: 875B

TTH Size: 4KB - Virtual size: 699B

FFG Size: 4KB - Virtual size: 1KB

.rdata Size: 24KB - Virtual size: 22KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 128KB - Virtual size: 124KB

RRT
Size: 4KB - Virtual size: 715B

SSD
Size: 4KB - Virtual size: 1KB

MMN
Size: 4KB - Virtual size: 875B

TTH
Size: 4KB - Virtual size: 699B

FFG
Size: 4KB - Virtual size: 1KB

.rdata
Size: 24KB - Virtual size: 22KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 1KB