69f17284459ff62eb0409023a320cdd4022128f09d3969f90df087d10d89df85

Sharing

Copy URL Twitter E-mail

General

Target

69f17284459ff62eb0409023a320cdd4022128f09d3969f90df087d10d89df85
Size

90KB
MD5

2a54b01a58c6a2f69304440e96318d4a
SHA1

3bc9f2b6675642c05e7870eb2b893cb064dbce53
SHA256

69f17284459ff62eb0409023a320cdd4022128f09d3969f90df087d10d89df85
SHA512

72176d0f890b94573a5dc6fcc66ca0f6c8ccfd25a2271d809eccf181e329c9278591de49e7516529cef5f946bbdaa0e2daf9d8cc51cd88e9b2bb85e42c959ffd
SSDEEP

1536:u/aAc36W2cJp1tAy363UEuBezLtSLAGthavE:PAc3mc5tAy363UE3cthavE

Score

N/A

Malware Config

Signatures

Files

69f17284459ff62eb0409023a320cdd4022128f09d3969f90df087d10d89df85
.exe windows x86

a07e183318e98039793b2a8ce57bba82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
lstrcmpiA
FindNextFileW
FindFirstFileW
CreateDirectoryA
GetLocalTime
DeviceIoControl
GetFileAttributesA
CreateProcessA
ResumeThread
SetFileAttributesA
SetPriorityClass
GetShortPathNameA
GetEnvironmentVariableA
GetProcAddress
GetModuleHandleA
OutputDebugStringA
lstrlenA
GetCurrentProcessId
GetProcessId
ExitThread
WaitForSingleObject
LoadLibraryA
ReadFile
GetComputerNameA
GetSystemInfo
VirtualFree
VirtualFreeEx
WriteProcessMemory
VirtualAlloc
VirtualAllocEx
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateEventA
GetLastError
CheckRemoteDebuggerPresent
GetFileTime
GetWindowsDirectoryA
CopyFileA
GlobalUnlock
GlobalLock
WaitForMultipleObjects
TerminateProcess
OpenProcess
MoveFileExA
lstrcmpA
lstrcatA
ExpandEnvironmentStringsA
VirtualQuery
CreateMutexA
SetUnhandledExceptionFilter
LocalAlloc
Module32Next
Module32First
ReadProcessMemory
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoA
VirtualProtect
HeapFree
Thread32First
HeapAlloc
HeapReAlloc
Thread32Next
GetThreadContext
SetThreadContext
OpenThread
SuspendThread
HeapCreate
GetVersionExA
IsDebuggerPresent
GetEnvironmentVariableW
CreateProcessW
GetCurrentThreadId
DeleteFileA
GetModuleFileNameA
GetDriveTypeA
FindFirstFileA
SetCurrentDirectoryA
GetFullPathNameA
Sleep
GetTickCount
FindNextFileA
FindClose
CreateFileA
GetFileSize
CloseHandle
WriteFile
SetFilePointer
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalFree
SetFileTime
ExitProcess

user32

CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
SetClipboardViewer
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
GetKeyNameTextW
wsprintfW
ReleaseDC
DrawIcon
GetIconInfo
GetSystemMetrics
GetAsyncKeyState
GetKeyState
ToUnicodeEx
GetKeyboardState
GetKeyboardLayout
GetWindowThreadProcessId
GetForegroundWindow
CharLowerBuffW
GetWindowTextW
DefWindowProcA
wsprintfA
CharLowerA
MessageBoxA
GetCursorInfo
ChangeClipboardChain
PostMessageA
GetCursorPos
MapVirtualKeyA

gdi32

CreateDCA
CreateCompatibleDC
GetDIBits
GetObjectA
DeleteObject
StretchBlt
CreateCompatibleBitmap
SelectObject

advapi32

RegCloseKey
RegCreateKeyExA
RegEnumKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
RegSetValueExA
RegNotifyChangeKeyValue
SetSecurityInfo
InitializeAcl

shell32

ord680
SHGetSpecialFolderPathA

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitializeEx

oleaut32

VariantClear

msvcrt

__set_app_type
_wcslwr
_strrev
_controlfp
_except_handler3
_wcsupr
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strlen
clock
_endthreadex
printf
wcsstr
wcscmp
wcstok
tolower
_beginthreadex
strncmp
sscanf
rand
sprintf
srand
memcmp
memset
getenv
toupper
wcscat
wcscpy
wcslen
isspace
_vsnprintf

ntdll

RtlAdjustPrivilege
RtlImageNtHeader
NtOpenProcess
RtlCreateUserThread

urlmon

URLDownloadToFileA

ws2_32

sendto
WSAStartup
gethostname
setsockopt
gethostbyname
socket
connect
recv
inet_addr
send
getpeername
htons
gethostbyaddr
inet_ntoa
WSASend
closesocket

wininet

InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestW
InternetCloseHandle
HttpSendRequestA

shlwapi

PathFindExtensionA

iphlpapi

GetIpForwardTable

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a07e183318e98039793b2a8ce57bba82

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcrt

ntdll

urlmon

ws2_32

wininet

shlwapi

iphlpapi

psapi

Sections

.text Size: 58KB - Virtual size: 57KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 13KB - Virtual size: 27KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 58KB - Virtual size: 57KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 13KB - Virtual size: 27KB

.reloc
Size: 4KB - Virtual size: 3KB