009d3346b682496a6835a66cc5d3d9a24e3a21006ec576f55fc5ce310c4099bf

Sharing

Copy URL

Twitter E-mail

General

Target

009d3346b682496a6835a66cc5d3d9a24e3a21006ec576f55fc5ce310c4099bf
Size

161KB
MD5

506778d135b98d06f901ded7776b0e76
SHA1

cfbe8983fc0a2a50dd52fcf2ba303930fffb000b
SHA256

009d3346b682496a6835a66cc5d3d9a24e3a21006ec576f55fc5ce310c4099bf
SHA512

c05d8efd7034d9cb22c475ef341c2d74f64b0dc47e472b5dd12aed96332cabbb889fd90fa4bab6a1ac6aee24c712f5293b0b238f71d7b731324bdb1c32617d28
SSDEEP

3072:O1UqeDPErbBYTN6jZ4fReG6NkHqQTtwRc6GCCT/oQXbTlOf/mdQgUfd:OuqeDPE/BYGkV6NkHq4wpGsYbTi/8Qgw

Score

N/A

Malware Config

Signatures

Files

009d3346b682496a6835a66cc5d3d9a24e3a21006ec576f55fc5ce310c4099bf
.exe windows x86

26ad5e61373998943ddbc30739153e5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GlobalUnlock
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
CreateDirectoryW
GetProcessHeap
SetFileTime
VirtualQueryEx
WriteFile
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
GetFileAttributesW
Thread32Next
ReadFile
GetTimeZoneInformation
CreateFileW
DuplicateHandle
FlushFileBuffers
GlobalLock
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
FindClose
RemoveDirectoryW
FindNextFileW
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
lstrcmpiA
WTSGetActiveConsoleSessionId
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetThreadContext
SetThreadContext
GetDriveTypeW
GetLogicalDrives
MoveFileExW
GetUserDefaultUILanguage
CreateToolhelp32Snapshot
Process32NextW
GetNativeSystemInfo
ResetEvent
TerminateProcess
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
CreateMutexW
GetCurrentThreadId
CreateFileMappingW
GetProcessId
GetCurrentProcessId
OpenEventW
GetFileAttributesExW
VirtualProtect
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetVersionExW
VirtualFree
GetModuleHandleW
SetEvent
GetComputerNameW
SetErrorMode
GetCommandLineW
GetTempPathW
WriteProcessMemory
Process32FirstW
VirtualAllocEx
VirtualFreeEx
OpenProcess
CreateRemoteThread
IsBadReadPtr
CreateProcessW
UnmapViewOfFile
MapViewOfFile
ExitProcess
CreateThread
GetSystemTime
CloseHandle
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetThreadPriority
Sleep
GetCurrentThread
WaitForSingleObject
ExpandEnvironmentStringsW
LocalFree
GetPrivateProfileIntW
LoadLibraryW
GetPrivateProfileStringW
lstrcmpiW
LoadLibraryA
GetProcAddress
MultiByteToWideChar
FreeLibrary

user32

BeginPaint
GetUpdateRect
IntersectRect
GetDCEx
EqualRect
PrintWindow
IsRectEmpty
RegisterClassExA
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
GetDC
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
PeekMessageW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
GetSystemMetrics
CharLowerBuffA
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
GetAncestor
PeekMessageA
SetWindowPos
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetWindowLongW
CharUpperW
SetWindowLongW
GetWindowInfo
SendMessageTimeoutW
CharLowerA
RegisterClassExW
GetWindow
DispatchMessageW
CharLowerW
TranslateMessage
GetCursorPos
GetIconInfo
DrawEdge
GetClipboardData
ToUnicode
EndPaint
HiliteMenuItem
RegisterClassW
SendMessageW
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
RegisterClassA
GetShellWindow
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
DefMDIChildProcW
DrawIcon
GetWindowThreadProcessId
FindWindowA
PostMessageW
MapVirtualKeyW
ExitWindowsEx
OpenWindowStationW
GetUserObjectInformationW
SetThreadDesktop
GetKeyboardState

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
GetLengthSid
IsWellKnownSid
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
EqualSid
InitiateSystemShutdownExW

shlwapi

StrStrIW
PathRemoveFileSpecW
PathIsURLW
StrCmpNIW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
PathRenameExtensionW
PathQuoteSpacesW
StrStrIA

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

SetViewportOrgEx
GdiFlush
CreateDIBSection
SetRectRgn
SaveDC
RestoreDC
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
GetDIBits
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

recv
sendto
getsockname
select
getaddrinfo
recvfrom
accept
listen
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
freeaddrinfo
getpeername
WSASend
closesocket
send
WSASetLastError

crypt32

CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData
PFXExportCertStoreEx

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetSetOptionA
InternetReadFile
InternetQueryOptionW
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26ad5e61373998943ddbc30739153e5c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 150KB - Virtual size: 149KB

.data Size: 1KB - Virtual size: 9KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 150KB - Virtual size: 149KB

.data
Size: 1KB - Virtual size: 9KB

.reloc
Size: 6KB - Virtual size: 6KB