427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec

Sharing

Copy URL

Twitter E-mail

General

Target

427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec
Size

93KB
MD5

079ba434001a1d9d2425a5a7b18700c9
SHA1

5654f1fb464984098c615d91059e4bd328cec508
SHA256

427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec
SHA512

0ebb562406174c10db1b1c9db1cbb5cb574e133ca803319ebddadafb514a4d614b5e38062688ee3b4b3e0687d9f636fbf1d206587e8f53c5730239d8029e7fc8
SSDEEP

1536:VJLg6/ZRSN0CAk1M4Bgke5GZFVnTh1jjVBFjtSLA/lylHwc:PV/L4081MSZe5GZFVnTh1jj5xlyhL

Score

N/A

Malware Config

Signatures

Files

427c199c6cbbfff3a02c0f589338756771195f2f7f5b69acede3b3511b6ffdec
.exe windows x86

635eafad6c3865d7429e63de8db50bc2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
lstrcmpiA
FindNextFileW
FindFirstFileW
CreateDirectoryA
GetLocalTime
DeviceIoControl
GetFileAttributesA
CreateProcessA
ResumeThread
SetFileAttributesA
SetPriorityClass
GetShortPathNameA
GetEnvironmentVariableA
GetProcAddress
GetModuleHandleA
OutputDebugStringA
lstrlenA
GetCurrentProcessId
GetProcessId
ExitThread
WaitForSingleObject
LoadLibraryA
ReadFile
GetComputerNameA
GetSystemInfo
VirtualFree
VirtualFreeEx
WriteProcessMemory
VirtualAlloc
VirtualAllocEx
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateEventA
GetLastError
SetFileTime
CheckRemoteDebuggerPresent
GetWindowsDirectoryA
CopyFileA
GlobalUnlock
GlobalLock
WaitForMultipleObjects
TerminateProcess
OpenProcess
MoveFileExA
lstrcmpA
lstrcatA
ExpandEnvironmentStringsA
VirtualQuery
CreateMutexA
SetUnhandledExceptionFilter
LocalAlloc
Module32Next
Module32First
ReadProcessMemory
MultiByteToWideChar
WideCharToMultiByte
VirtualQueryEx
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoA
VirtualProtect
HeapFree
Thread32First
HeapAlloc
HeapReAlloc
Thread32Next
GetThreadContext
SetThreadContext
OpenThread
SuspendThread
HeapCreate
GetVersionExA
IsDebuggerPresent
GetEnvironmentVariableW
CreateProcessW
GetCurrentThreadId
DeleteFileA
GetModuleFileNameA
GetDriveTypeA
FindFirstFileA
SetCurrentDirectoryA
GetFullPathNameA
Sleep
GetTickCount
FindNextFileA
FindClose
CreateFileA
GetFileSize
CloseHandle
WriteFile
SetFilePointer
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalFree
GetFileTime
ExitProcess

user32

CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
SetClipboardViewer
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
GetKeyNameTextW
wsprintfW
ReleaseDC
DrawIcon
GetIconInfo
GetSystemMetrics
GetAsyncKeyState
GetKeyState
ToUnicodeEx
GetKeyboardState
GetKeyboardLayout
GetWindowThreadProcessId
GetForegroundWindow
CharLowerBuffW
GetWindowTextW
DefWindowProcA
wsprintfA
CharLowerA
MessageBoxA
GetCursorInfo
ChangeClipboardChain
PostMessageA
GetCursorPos
MapVirtualKeyA

gdi32

CreateDCA
CreateCompatibleDC
GetDIBits
GetObjectA
DeleteObject
StretchBlt
CreateCompatibleBitmap
SelectObject

advapi32

RegCloseKey
RegCreateKeyExA
RegEnumKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
RegSetValueExA
RegNotifyChangeKeyValue
SetSecurityInfo
InitializeAcl

shell32

ord680
SHGetSpecialFolderPathA

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitializeEx

oleaut32

VariantClear

msvcrt

__set_app_type
_wcslwr
_strrev
_controlfp
_except_handler3
_wcsupr
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strlen
clock
_endthreadex
wcsstr
wcscmp
wcstok
tolower
printf
_beginthreadex
memcpy
strncmp
rand
sprintf
srand
memcmp
memset
getenv
toupper
wcscat
wcscpy
wcslen
isspace
_vsnprintf
sscanf

ntdll

RtlAdjustPrivilege
RtlImageNtHeader
NtOpenProcess
RtlCreateUserThread

urlmon

URLDownloadToFileA

ws2_32

sendto
WSAStartup
gethostname
setsockopt
gethostbyname
socket
connect
recv
inet_addr
send
getpeername
htons
gethostbyaddr
inet_ntoa
WSASend
closesocket

wininet

InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestW
InternetCloseHandle
HttpSendRequestA

shlwapi

PathFindExtensionA

iphlpapi

GetIpForwardTable

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

635eafad6c3865d7429e63de8db50bc2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcrt

ntdll

urlmon

ws2_32

wininet

shlwapi

iphlpapi

psapi

Sections

.text Size: 61KB - Virtual size: 61KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 13KB - Virtual size: 27KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 61KB - Virtual size: 61KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 13KB - Virtual size: 27KB

.reloc
Size: 4KB - Virtual size: 3KB