cb1a74086432bd6bff8b6af928c10c2c998f8062eada807c41686a2066c227c1

Sharing

Copy URL Twitter E-mail

General

Target

cb1a74086432bd6bff8b6af928c10c2c998f8062eada807c41686a2066c227c1
Size

164KB
MD5

003ea41c745a25c401a263f55ac26915
SHA1

7babc02377071bea85b4efabc71ccebeebcb29a1
SHA256

cb1a74086432bd6bff8b6af928c10c2c998f8062eada807c41686a2066c227c1
SHA512

cbd6cfa30bf3dbcb8295fa036087829c7f7c5dd26b0b02341a18d06766facb3df5c64152a4c047edf74f98b327662699bf0c780998042ad5205e0fadb5866a78
SSDEEP

3072:ODZ8mWDGuoKSfvkdq7r59pihxkzaWzfRxBmtjCyLV+WTB7zDTnw0c0AQ9/QPLW1v:OjWw3G9zvc9k4PLW1ZMoNOKgH

Score

N/A

Malware Config

Signatures

Files

cb1a74086432bd6bff8b6af928c10c2c998f8062eada807c41686a2066c227c1
.exe windows x86

6d08233989dd392d33222c5a1439f7d8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_decode_pointer
_onexit
_invoke_watson
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_strnicmp
_lock
?terminate@@YAXXZ
_stricmp
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
calloc
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_beginthreadex
realloc
free
_errno
strncmp
atoi
??_U@YAPAXI@Z
malloc
strrchr
strncat
strchr
memmove
ceil
strstr
strncpy
??3@YAXPAX@Z
memcpy
memset
_CxxThrowException
__CxxFrameHandler3
??2@YAPAXI@Z

shlwapi

SHDeleteKeyA

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
GetPrivateProfileStringA
lstrlenA
CreateFileA
lstrcatA
GetProcAddress
LoadLibraryA
GetLocalTime
Sleep
LocalFree
LocalAlloc
DeleteFileA
WaitForSingleObject
InterlockedExchange
lstrcpyA
GetModuleFileNameA
GetLastError
SetLastError
CloseHandle
SetEvent
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
OpenProcess
TerminateThread
ExitProcess
SetFileAttributesA
MoveFileExA
GetTickCount
GetTempPathA
CreateThread
GlobalFree
GlobalLock
GlobalSize
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
CreatePipe
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
OpenEventA
SetErrorMode
lstrcmpiA
GetCurrentThreadId
GetFileAttributesA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindFirstFileA
RemoveDirectoryA
GetPrivateProfileSectionNamesA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA

user32

ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
SetRect
GetDesktopWindow
GetDC
ReleaseDC
GetCursorInfo
SystemParametersInfoA
OpenClipboard
GetWindowThreadProcessId
OpenInputDesktop
CloseClipboard
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
DestroyCursor
LoadCursorA
GetAsyncKeyState
IsWindowVisible
EnumWindows
CloseDesktop
GetForegroundWindow
GetWindowTextA
wsprintfA
EmptyClipboard
GetKeyState
SetThreadDesktop
GetUserObjectInformationA
OpenDesktopA
GetThreadDesktop
PostMessageA
CharNextA
CloseWindow
IsWindow
SendMessageA
CreateWindowExA
SetClipboardData

gdi32

DeleteDC
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject

advapi32

ControlService
DeleteService
CloseServiceHandle
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
LookupAccountSidA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
QueryServiceStatus
OpenServiceA
RegCloseKey
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueA
CloseEventLog
ClearEventLogA
OpenEventLogA

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

ws2_32

recvfrom
__WSAFDIsSet
getpeername
sendto
listen
WSACleanup
gethostname
bind
getsockname
accept
ntohs
inet_addr
inet_ntoa
socket
gethostbyname
htons
connect
WSAIoctl
select
recv
send
setsockopt
closesocket
WSAStartup

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA

msvfw32

ICSeqCompressFrameStart
ICOpen
ICSeqCompressFrame
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSendMessage

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Sections

TTTT
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

UUU
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RRRR
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.6632
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6d08233989dd392d33222c5a1439f7d8

Headers

File Characteristics

Imports

msvcr80

shlwapi

kernel32

user32

gdi32

advapi32

shell32

msvcp80

ws2_32

wininet

msvfw32

psapi

wtsapi32

Sections

TTTT Size: 8KB - Virtual size: 4KB

.text Size: 100KB - Virtual size: 97KB

UUU Size: 8KB - Virtual size: 4KB

RRRR Size: 4KB - Virtual size: 1KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.6632 Size: 4KB - Virtual size: 4KB

TTTT
Size: 8KB - Virtual size: 4KB

.text
Size: 100KB - Virtual size: 97KB

UUU
Size: 8KB - Virtual size: 4KB

RRRR
Size: 4KB - Virtual size: 1KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.6632
Size: 4KB - Virtual size: 4KB