203deae3efac23e5a3f3b11256da642ecb66eb3829f0c42fd3e29ad8adf48841

Sharing

Copy URL Twitter E-mail

General

Target

203deae3efac23e5a3f3b11256da642ecb66eb3829f0c42fd3e29ad8adf48841
Size

3.6MB
MD5

00249c9fdd78b130ccd750b92b5a252e
SHA1

6eadc8c09fc98f77e7929f747c2d9737d32ed790
SHA256

203deae3efac23e5a3f3b11256da642ecb66eb3829f0c42fd3e29ad8adf48841
SHA512

3a13176e92fddffbeef5ea8ef064eb4bcf27f2c782747cb9a764c4f1408def8a59274352f7b050ad6880f8fb1cb8ead65d6136f17eebf5cd907686532289da1a
SSDEEP

49152:/Rxy/v/CBX8zPOa/4X/h6lOEyFFw9DT3EcT9YSToITFvMcU1Wei/d/xGoaj4sGq:uKZYaX5JESwpEcjje

Score

N/A

Malware Config

Signatures

Files

203deae3efac23e5a3f3b11256da642ecb66eb3829f0c42fd3e29ad8adf48841
.exe windows x86

64863bf2311d2c02f41af895d3a8d248

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetAdaptersInfo
GetNetworkParams

winmm

waveOutPrepareHeader
waveInStart
PlaySoundW
mixerGetLineInfoW
mixerClose
mixerOpen
mixerGetLineControlsW
mixerSetControlDetails
waveOutWrite
waveOutReset
waveOutOpen
waveInUnprepareHeader
waveOutUnprepareHeader
waveInReset
waveInAddBuffer
waveInOpen
waveInPrepareHeader

ws2_32

WSASetLastError
shutdown
gethostname
closesocket
ntohs
htons
htonl
inet_addr
ntohl
send
gethostbyname
freeaddrinfo
socket
recv
sendto
setsockopt
getsockname
WSAGetLastError
select
getaddrinfo
connect
recvfrom
WSAStartup

gdiplus

GdipDeleteFontFamily
GdipSetStringFormatAlign
GdipDeleteGraphics
GdipDeleteFont
GdipDeletePen
GdipFree
GdipDeleteBrush
GdipBitmapGetPixel
GdipCreateSolidFill
GdipAlloc
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDrawString
GdipCreateFromHDC
GdipDrawLineI
GdipCreateStringFormat
GdipCreatePen1
GdipDeleteStringFormat
GdipDrawImageRectI
GdipFillRectangleI
GdipGetImageHeight
GdipDrawImageRectRectI
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipLoadImageFromFile
GdipSetSmoothingMode
GdipGetImageEncodersSize
GdipDisposeImage
GdipCreateBitmapFromFile
GdipGetImageEncoders
GdipSaveImageToFile
GdipSetInterpolationMode
GdipCloneImage
GdipGetImageWidth
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipCreateFontFamilyFromName

comctl32

InitCommonControlsEx
ord17

avicap32

capGetDriverDescriptionW
capCreateCaptureWindowW

dbghelp

MiniDumpWriteDump

winhttp

WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpSetOption
WinHttpSendRequest
WinHttpWriteData
WinHttpConnect
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

crypt32

CryptUnprotectData
CryptProtectData

kernel32

HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
LCMapStringA
LCMapStringW
GetCPInfo
RtlUnwind
RaiseException
GetModuleFileNameA
GetStartupInfoW
ExitProcess
GetProcAddress
GetModuleHandleW
HeapReAlloc
GetSystemTimeAsFileTime
CreateThread
ExitThread
HeapAlloc
HeapFree
IsDebuggerPresent
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
VirtualAlloc
SetHandleCount
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetACP
GetOEMCP
IsValidCodePage
CreateFileA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleHandleA
SetStdHandle
GetStringTypeA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
GetLocaleInfoW
CreateProcessW
WaitForSingleObject
GetTickCount
GetExitCodeProcess
GetTempPathW
CloseHandle
GetCurrentProcessId
ResumeThread
HeapCreate
MoveFileExW
CompareFileTime
CopyFileW
CreateFileW
GetFileSizeEx
GetLastError
FindClose
FindNextFileW
GetFileTime
GetCurrentThreadId
DeleteFileW
SystemTimeToFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetLocalTime
ReadFile
SetFilePointer
WriteFile
MulDiv
FindResourceW
LoadResource
GlobalLock
GlobalAlloc
SizeofResource
GlobalUnlock
GlobalFree
LockResource
CreateMutexW
SetThreadPriority
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
ReleaseMutex
GetCommandLineW
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
LocalFree
Sleep
GetModuleFileNameW
lstrlenW
InitializeCriticalSection
EnterCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
WideCharToMultiByte
IsDBCSLeadByteEx
MultiByteToWideChar
GetVersion
GetFileType
GetStdHandle
SetLastError
SetEnvironmentVariableA
FindFirstFileA
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer
FileTimeToLocalFileTime
GetDriveTypeA
ReadConsoleInputA
SetConsoleMode
GetFileAttributesA
GetFullPathNameA
GetCurrentDirectoryA
FindFirstFileW
VirtualFree

user32

SetWindowLongW
IsRectEmpty
CopyRect
DestroyMenu
DeferWindowPos
EqualRect
CreatePopupMenu
SetWindowPos
SystemParametersInfoW
AppendMenuW
FlashWindowEx
TrackPopupMenuEx
SetFocus
SetActiveWindow
SetWindowRgn
ClientToScreen
GetScrollInfo
GetForegroundWindow
GetCapture
WindowFromPoint
IsChild
CreateDialogParamW
SendDlgItemMessageW
LoadIconW
OffsetRect
DispatchMessageW
GetWindowThreadProcessId
DestroyIcon
GetLastInputInfo
PeekMessageW
RegisterClassExW
IsDialogMessageW
TranslateMessage
WaitMessage
GetClassInfoExW
InvalidateRgn
GetFocus
SetForegroundWindow
IsIconic
PostQuitMessage
GetSystemMetrics
EndDeferWindowPos
BeginDeferWindowPos
SetScrollInfo
ScrollWindowEx
IsDlgButtonChecked
PostMessageW
GetDC
UpdateLayeredWindow
CharLowerW
DrawTextW
UpdateWindow
FindWindowW
KillTimer
SetTimer
IsWindow
GetDesktopWindow
GetMessageW
GetWindow
DrawFrameControl
IsWindowVisible
FindWindowExW
GetWindowTextW
IntersectRect
GetWindowTextLengthW
ScrollWindow
SetScrollPos
CreateDialogIndirectParamW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
GetSysColor
SetDlgItemTextW
SendMessageW
EnableWindow
SetWindowTextW
CallWindowProcW
MoveWindow
EndPaint
ScreenToClient
GetWindowRect
FillRect
GetParent
GetClientRect
BeginPaint
SetRect
GetDlgItem
ShowWindow
GetSysColorBrush
ReleaseCapture
DestroyWindow
SetCursor
TrackMouseEvent
LoadCursorW
PtInRect
GetClassInfoW
InvalidateRect
GetCursorPos
CreateWindowExW
SetCapture
RegisterClassW
DefWindowProcW
GetKeyState
GetKeyboardLayout
ReleaseDC
GetWindowLongW

gdi32

GetDeviceCaps
ExcludeClipRect
IntersectClipRect
CreateFontIndirectW
GetTextMetricsW
GetTextExtentPoint32W
DeleteDC
CreatePen
ExtTextOutW
GetStockObject
SelectClipRgn
SetBkMode
LineTo
MoveToEx
SetBitmapBits
SelectObject
ExtSelectClipRgn
CreateCompatibleDC
CreateCompatibleBitmap
SetTextColor
SetBkColor
CreateSolidBrush
GetRgnBox
CombineRgn
OffsetRgn
Rectangle
BitBlt
DeleteObject
CreateRectRgn

advapi32

RegOpenKeyExW
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegQueryValueExW

shell32

Shell_NotifyIconW
CommandLineToArgvW
SHGetFolderPathW
SHFileOperationW
ShellExecuteW
SHAppBarMessage

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

VariantClear
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayAccessData
SafeArrayCreateVector
SysFreeString
SysAllocString
VariantInit

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 465KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_l
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_i
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_a
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_a
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_f
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_l
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_p
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_r
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 604KB - Virtual size: 604KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 163KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

64863bf2311d2c02f41af895d3a8d248

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

winmm

ws2_32

gdiplus

comctl32

avicap32

dbghelp

winhttp

version

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 465KB - Virtual size: 464KB

.data Size: 76KB - Virtual size: 1.6MB

.debug_l Size: 1KB - Virtual size: 1KB

.debug_i Size: 6KB - Virtual size: 6KB

.debug_a Size: 2KB - Virtual size: 1KB

.debug_a Size: 512B - Virtual size: 224B

.debug_f Size: 512B - Virtual size: 288B

.debug_l Size: 3KB - Virtual size: 3KB

.debug_p Size: 512B - Virtual size: 196B

.debug_r Size: 512B - Virtual size: 392B

.rsrc Size: 604KB - Virtual size: 604KB

.reloc Size: 163KB - Virtual size: 166KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 465KB - Virtual size: 464KB

.data
Size: 76KB - Virtual size: 1.6MB

.debug_l
Size: 1KB - Virtual size: 1KB

.debug_i
Size: 6KB - Virtual size: 6KB

.debug_a
Size: 2KB - Virtual size: 1KB

.debug_a
Size: 512B - Virtual size: 224B

.debug_f
Size: 512B - Virtual size: 288B

.debug_l
Size: 3KB - Virtual size: 3KB

.debug_p
Size: 512B - Virtual size: 196B

.debug_r
Size: 512B - Virtual size: 392B

.rsrc
Size: 604KB - Virtual size: 604KB

.reloc
Size: 163KB - Virtual size: 166KB