734669872b5a65c3103e22f3927e59377901b6fed7b47861c6023e66d6574505

Sharing

Copy URL Twitter E-mail

General

Target

734669872b5a65c3103e22f3927e59377901b6fed7b47861c6023e66d6574505
Size

235KB
MD5

0a97247867cb3c85518e31732bd4aac8
SHA1

4c5f926c29ec5ce0e85799455ec2ffbe6016d7aa
SHA256

734669872b5a65c3103e22f3927e59377901b6fed7b47861c6023e66d6574505
SHA512

87a280f93cfab6698f4e24026d8d954c4a50ae52bc7d4120da628c223cdfbf75539e43ccc5b53aad05a49af7986ffee58033c736725e262f19cf58b4c27f15d6
SSDEEP

6144:iV3X6ClgZL0b6dDNaeP+j6AW8K9LH3ON:OX6e0DNB+VWN9H2

Score

N/A

Malware Config

Signatures

Files

734669872b5a65c3103e22f3927e59377901b6fed7b47861c6023e66d6574505
.exe windows x86

479916778c0bb1961e6e3a85c43e6d3e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

strstr
_close
_tzset
_ecvt
strchr
signal
atoi
fopen
strrchr
rewind
_pctype
_cexit
memcpy
_isatty
memset
_daylight
strcpy
fclose
_flsbuf
__getmainargs
__p__commode
_open
strncmp
localtime
sprintf
fwrite
atexit
_stat
abort
_fstat
_lseek
fgets
_gcvt
mktime
__mb_cur_max
puts
_fcvt
fseek
putchar
_errno
memmove
__set_app_type
exit
_write
__p__environ
setbuf
_strdup
gmtime
strncpy
_onexit
free
fflush
_iob
_read
_isctype
_setmode
strcmp
strerror
_filbuf
getenv
__p__fmode
_timezone
_fdopen
setvbuf
malloc
realloc
fputc

mswsock

AcceptEx
TransmitFile
s_perror
GetAcceptExSockaddrs

dsound

ord10

kernel32

GetStringTypeW
GetConsoleCP
Sleep
GetTickCount
GetACP
IsDebuggerPresent
InterlockedExchangeAdd
TlsAlloc
PostQueuedCompletionStatus
UnhandledExceptionFilter
SetFileAttributesW
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
DeleteFileW
ExitProcess
GetDateFormatA
HeapFree
QueryPerformanceCounter
TlsSetValue
FormatMessageW
GetProcessHeap
FlushFileBuffers
SetFilePointer
QueueUserAPC
InterlockedIncrement
OpenEventA
FindFirstFileW
ReadFile
TlsFree
InterlockedDecrement
FileTimeToLocalFileTime
EnterCriticalSection
InterlockedExchange
CreateDirectoryW
LocalAlloc
LCMapStringW
TlsGetValue
GetFileAttributesW
GetFileType
AreFileApisANSI
VirtualAlloc
SetLastError
GetCommandLineW
GetStdHandle
lstrlenW
IsValidLocale
DeviceIoControl
FormatMessageA
GetTimeZoneInformation
GetEnvironmentStringsW
CreateIoCompletionPort
GetOEMCP
SetWaitableTimer
CreateFileMappingW
CompareStringW
HeapReAlloc
OpenProcess
SetStdHandle
RemoveDirectoryW
Process32FirstW
SetHandleCount
MultiByteToWideChar
InitializeCriticalSection
GetFileAttributesExW
TerminateThread
GetQueuedCompletionStatus
InterlockedCompareExchange
SetEnvironmentVariableA
GetProcAddress
SystemTimeToFileTime
HeapSetInformation
GetModuleHandleW
HeapAlloc
CreateThread
CreateWaitableTimerA
CreateEventA
GetModuleHandleA
DeleteCriticalSection
FindClose
GetLastError
GetTimeFormatA
ResumeThread
QueryPerformanceFrequency
MoveFileExW
HeapCreate
CreateToolhelp32Snapshot
CreateFileW
GetConsoleMode
VirtualFree
IsValidCodePage
GetFileSize
GetStartupInfoW
HeapSize
WaitForSingleObject
LoadLibraryA
QueueUserWorkItem
IsProcessorFeaturePresent
EnumSystemLocalesA
RaiseException
Process32NextW
ResetEvent
TerminateProcess
LeaveCriticalSection
ExitThread
SleepEx
WaitForMultipleObjects
SetEndOfFile
CreateEventW
ReleaseSemaphore
SetUnhandledExceptionFilter
FileTimeToSystemTime
DuplicateHandle
CreateFileA
RtlUnwind
GetCPInfo
FindNextFileW
GetSystemTimeAsFileTime
CreateSemaphoreA
UnmapViewOfFile
SetEvent
GetCurrentProcess
FreeEnvironmentStringsW
MapViewOfFile
GetTempFileNameW
CloseHandle

user32

FillRect
BeginPaint
ValidateRgn
GetProcessDefaultLayout
GetNextDlgTabItem
wsprintfW
DdeAddData

ntdll

RtlGetControlSecurityDescriptor

shlwapi

ColorRGBToHLS
SHRegCloseUSKey
GetMenuPosFromID
PathRemoveFileSpecW
ord16
ColorAdjustLuma
StrChrNIW
SHSkipJunction

ws2_32

inet_ntoa
WSAGetLastError
ioctlsocket
closesocket
WSASetLastError
setsockopt
connect
inet_addr
WSACleanup
getaddrinfo
WSAStartup
freeaddrinfo
WSARecv
listen
shutdown
WSAAddressToStringA
gethostbyname
WSCUnInstallNameSpace
bind
htons
WSASocketW
WSASend
socket

advapi32

RegQueryValueExW
SetSecurityDescriptorControl
RegSetValueExW
RegOpenKeyExW
SetEntriesInAclW
InitializeSecurityDescriptor
NotifyChangeEventLog
LsaICLookupNamesWithCreds
DeregisterEventSource
LsaGetQuotasForAccount
FreeSid
CryptGetHashParam
SaferIdentifyLevel
StartServiceCtrlDispatcherW
EqualDomainSid
SetFileSecurityW
ReportEventW
RegDeleteValueW
RegDeleteKeyW
LsaFreeMemory
RegisterServiceCtrlHandlerW
RegCloseKey
LsaSetForestTrustInformation
GetTokenInformation
IsValidAcl
SystemFunction028
RegQueryInfoKeyW
AddAuditAccessAce
MakeAbsoluteSD
RegCreateKeyExW
RegisterEventSourceW
LookupAccountSidW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
OpenProcessToken
SetServiceStatus
SystemFunction033

shell32

DragFinish
SHGetFolderPathW
SHLoadInProc
DragAcceptFiles
SHSetUnreadMailCountW

wintrust

SoftpubAuthenticode
WintrustAddDefaultForUsage
CryptCATCDFEnumAttributes
WVTAsn1SpcPeImageDataDecode
WintrustRemoveActionID
WinVerifyTrust

odbc32

ord61
ord51
SearchStatusCode
ord18
ord23
ord37
CursorLibLockDesc
ord75

crypt32

CertGetNameStringW
CryptMsgClose
CryptVerifyCertificateSignature
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

479916778c0bb1961e6e3a85c43e6d3e

Headers

File Characteristics

Imports

msvcrt

mswsock

dsound

kernel32

user32

ntdll

shlwapi

ws2_32

advapi32

shell32

wintrust

odbc32

crypt32

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 30KB - Virtual size: 30KB

.rdata Size: 27KB - Virtual size: 27KB

.bss Size: - Virtual size: 8KB

.idata Size: 20KB - Virtual size: 19KB

.rsrc Size: 69KB - Virtual size: 68KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 30KB - Virtual size: 30KB

.rdata
Size: 27KB - Virtual size: 27KB

.bss
Size: - Virtual size: 8KB

.idata
Size: 20KB - Virtual size: 19KB

.rsrc
Size: 69KB - Virtual size: 68KB