671d8020c550a528e6556995c70de20c329667d10f3e81652dca36e89d619357

Sharing

Copy URL Twitter E-mail

General

Target

671d8020c550a528e6556995c70de20c329667d10f3e81652dca36e89d619357
Size

86KB
MD5

62b3008e87647af5b8e4aff42cedc6cd
SHA1

be4bd5c95ca11f2ab92317f64edb0100ba4eed10
SHA256

671d8020c550a528e6556995c70de20c329667d10f3e81652dca36e89d619357
SHA512

4b15519ae07fe9e35ad897041593f26a3fb8fa3455c21218d8def7f12eb25adb7ba9a1c0e483cf1099fdc19c91b37fdadfb982f0dd93389e0bd09f9ffb711f9d
SSDEEP

1536:F6iMZkEmKSw9/BOfgmWyz5VmThM6uDB6nlPjtSLAVgP6M:IiMZVmZw9ofgmWg5VmThM6uuljgCM

Score

N/A

Malware Config

Signatures

Files

671d8020c550a528e6556995c70de20c329667d10f3e81652dca36e89d619357
.exe windows x86

d89df491142436c9e25f20e71b53c4cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
FindNextFileW
FindFirstFileW
CreateDirectoryA
GetComputerNameA
DeviceIoControl
GetFileAttributesA
CreateProcessA
ResumeThread
SetFileAttributesA
SetPriorityClass
GetShortPathNameA
GetEnvironmentVariableA
GetProcAddress
GetModuleHandleA
Module32Next
Module32First
CreateToolhelp32Snapshot
ReadProcessMemory
OpenProcess
WriteProcessMemory
lstrlenA
GetCurrentProcessId
GetProcessId
ExitThread
WideCharToMultiByte
WaitForSingleObject
ReadFile
GetSystemInfo
VirtualFree
VirtualFreeEx
VirtualAlloc
VirtualAllocEx
Process32Next
Process32First
SetFileTime
CheckRemoteDebuggerPresent
GetWindowsDirectoryA
CreateEventA
GetLastError
CopyFileA
GlobalUnlock
GlobalLock
WaitForMultipleObjects
TerminateProcess
MoveFileExA
lstrcmpA
lstrcatA
ExpandEnvironmentStringsA
VirtualQuery
CreateMutexA
SetUnhandledExceptionFilter
LocalAlloc
OutputDebugStringA
MultiByteToWideChar
lstrcmpiA
VirtualQueryEx
UnhandledExceptionFilter
RtlUnwind
GetStartupInfoA
VirtualProtect
HeapFree
Thread32First
HeapAlloc
HeapReAlloc
Thread32Next
GetThreadContext
SetThreadContext
OpenThread
SuspendThread
HeapCreate
GetLocalTime
IsDebuggerPresent
GetVersionExA
GetEnvironmentVariableW
CreateProcessW
GetCurrentThreadId
DeleteFileA
GetModuleFileNameA
GetDriveTypeA
FindFirstFileA
SetCurrentDirectoryA
GetFullPathNameA
Sleep
GetTickCount
FindNextFileA
FindClose
CreateFileA
GetFileSize
CloseHandle
WriteFile
SetFilePointer
CreateFileMappingA
MapViewOfFile
ExitProcess
UnmapViewOfFile
GlobalAlloc
GlobalFree
GetFileTime

user32

CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
SetClipboardViewer
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
GetKeyNameTextW
MapVirtualKeyA
ReleaseDC
wsprintfW
GetIconInfo
GetSystemMetrics
GetAsyncKeyState
GetKeyState
ToUnicodeEx
GetKeyboardState
GetKeyboardLayout
GetWindowThreadProcessId
GetForegroundWindow
CharLowerBuffW
GetWindowTextW
DefWindowProcA
CharLowerA
wsprintfA
MessageBoxA
GetCursorInfo
ChangeClipboardChain
PostMessageA
GetCursorPos
DrawIcon

gdi32

CreateDCA
GetDIBits
GetObjectA
StretchBlt
SelectObject
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC

advapi32

RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegDeleteValueA
GetUserNameA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
RegNotifyChangeKeyValue
SetSecurityInfo
InitializeAcl

ole32

CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitializeEx

oleaut32

VariantClear

msvcrt

_wcslwr
_strrev
_controlfp
_wcsupr
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
clock
wcsstr
wcscmp
wcstok
_beginthreadex
sscanf
strncmp
toupper
rand
srand
memcmp
_endthreadex
printf
getenv
memset
wcscat
wcscpy
wcslen
strlen
sprintf
_stricmp

ntdll

RtlAdjustPrivilege
RtlImageNtHeader
NtOpenProcess
RtlCreateUserThread

urlmon

URLDownloadToFileA

ws2_32

sendto
WSAStartup
gethostname
inet_ntoa
htons
gethostbyname
socket
connect
closesocket
send
recv
inet_addr
WSASend
setsockopt

wininet

HttpSendRequestA
InternetOpenA
HttpSendRequestW
InternetCloseHandle
InternetReadFile
HttpOpenRequestA
InternetConnectA

shlwapi

PathFindExtensionA

iphlpapi

GetIpForwardTable

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d89df491142436c9e25f20e71b53c4cf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcrt

ntdll

urlmon

ws2_32

wininet

shlwapi

iphlpapi

psapi

Sections

.text Size: 59KB - Virtual size: 59KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 7KB - Virtual size: 19KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 59KB - Virtual size: 59KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 7KB - Virtual size: 19KB

.reloc
Size: 4KB - Virtual size: 3KB