92a879205e34218d5b833c80ff0b77656906fd207f96f9777a9464ea75c0d2d0

Sharing

Copy URL Twitter E-mail

General

Target

92a879205e34218d5b833c80ff0b77656906fd207f96f9777a9464ea75c0d2d0
Size

349KB
MD5

4f4f7f468c2d1f4e1681b8ff99d1c986
SHA1

ef9d2184245948765771c04830e72f429d0a875d
SHA256

92a879205e34218d5b833c80ff0b77656906fd207f96f9777a9464ea75c0d2d0
SHA512

706b92c2752403e071c648450272ccbcef2baf02e204bc2e066c4fa31adce3137df7192897bbcdbe5be2fb4e36b0c6cfac5f3204bf4f67271d8df294655b5186
SSDEEP

6144:GdNiVPgu0Hs2DPTctFPP9AoKuX3LnQPzPsNQAcxqf5TE:GdNSPgu0XDNuX3sPuNcx+TE

Score

N/A

Malware Config

Signatures

Files

92a879205e34218d5b833c80ff0b77656906fd207f96f9777a9464ea75c0d2d0
.exe windows x86

bc6250be77cfebd6ee422408fe0a18a4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

recv
send
connect
WSAStartup
WSAGetLastError
inet_addr
select
htons
socket
__WSAFDIsSet
ioctlsocket
getsockopt
closesocket

kernel32

Sleep
LocalAlloc
LocalFree
GetLastError
GetLocalTime
GetModuleHandleA
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
GetFullPathNameW
FindFirstFileW
WaitForSingleObject
GetVolumeInformationA
GetConsoleWindow
GetFileAttributesA
GetSystemDirectoryA
lstrcatA
CopyFileA
FindClose
MoveFileA
GetModuleFileNameA
CreateMutexA
FindNextFileW
ReleaseMutex
GetVersionExA
CompareStringW
GetTempPathA
DeleteFileA
CreateThread
lstrcpyA
GetFullPathNameA
FreeLibrary
FormatMessageA
OpenProcess
GetProcAddress
LoadLibraryA
GetCurrentProcessId
lstrcmpiW
FileTimeToSystemTime
LoadLibraryW
OutputDebugStringW
SetFilePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetDriveTypeW
FindFirstFileExW
FileTimeToLocalFileTime
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteConsoleW
GetStringTypeW
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
CreateFileW
GetTimeZoneInformation
SetEndOfFile
CloseHandle
SetEnvironmentVariableA
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
AreFileApisANSI
GetModuleHandleExW
ExitProcess
InterlockedDecrement
MultiByteToWideChar
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapSize
GetStdHandle
WriteFile
GetModuleFileNameW
RaiseException
GetFileType
DeleteCriticalSection
InterlockedIncrement
GetCurrentThreadId
RtlUnwind
ReadFile
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
IsValidCodePage

user32

CallNextHookEx
GetKeyboardState
ToAscii
DispatchMessageA
TranslateMessage
GetMessageA
MapVirtualKeyA
SetWindowsHookExA
GetKeyState
UnhookWindowsHookEx
ShowWindow

advapi32

GetUserNameA
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptGetKeyParam
CryptSetKeyParam
CryptAcquireContextW
CryptGetHashParam

shell32

SHGetFolderPathA
ShellExecuteA
ShellExecuteExA

libeay32

ord161
ord140
ord294
ord983
ord2927
ord3155
ord2996
ord304
ord329
ord323
ord333
ord1252
ord2784
ord963
ord964
ord965
ord156
ord110
ord111
ord399
ord396
ord400
ord213
ord1336
ord1335
ord1334
ord498
ord495
ord497
ord486
ord281
ord1935
ord2034
ord315
ord509
ord2720
ord2862
ord2644
ord3019
ord256
ord961
ord258
ord276
ord275
ord3874
ord3819
ord3889
ord120
ord118
ord123
ord150
ord151
ord52
ord82
ord464
ord209
ord484
ord316
ord267
ord268
ord269
ord3212
ord66

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntry

gdiplus

GdipLoadImageFromStream
GdipFree
GdipAlloc
GdipDisposeImage
GdipSaveImageToFile
GdipCloneImage

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

libssh2_banner_set
libssh2_base64_decode
libssh2_channel_close
libssh2_channel_direct_tcpip_ex
libssh2_channel_eof
libssh2_channel_flush_ex
libssh2_channel_forward_accept
libssh2_channel_forward_cancel
libssh2_channel_forward_listen_ex
libssh2_channel_free
libssh2_channel_get_exit_signal
libssh2_channel_get_exit_status
libssh2_channel_handle_extended_data
libssh2_channel_handle_extended_data2
libssh2_channel_open_ex
libssh2_channel_process_startup
libssh2_channel_read_ex
libssh2_channel_receive_window_adjust
libssh2_channel_receive_window_adjust2
libssh2_channel_request_pty_ex
libssh2_channel_request_pty_size_ex
libssh2_channel_send_eof
libssh2_channel_set_blocking
libssh2_channel_setenv_ex
libssh2_channel_wait_closed
libssh2_channel_wait_eof
libssh2_channel_window_read_ex
libssh2_channel_window_write_ex
libssh2_channel_write_ex
libssh2_channel_x11_req_ex
libssh2_exit
libssh2_free
libssh2_hostkey_hash
libssh2_init
libssh2_keepalive_config
libssh2_keepalive_send
libssh2_poll
libssh2_poll_channel_read
libssh2_session_abstract
libssh2_session_banner_get
libssh2_session_banner_set
libssh2_session_block_directions
libssh2_session_callback_set
libssh2_session_disconnect_ex
libssh2_session_flag
libssh2_session_free
libssh2_session_get_blocking
libssh2_session_get_timeout
libssh2_session_handshake
libssh2_session_hostkey
libssh2_session_init_ex
libssh2_session_last_errno
libssh2_session_last_error
libssh2_session_method_pref
libssh2_session_methods
libssh2_session_set_blocking
libssh2_session_set_timeout
libssh2_session_startup
libssh2_session_supported_algs
libssh2_sftp_close_handle
libssh2_sftp_fstat_ex
libssh2_sftp_fstatvfs
libssh2_sftp_get_channel
libssh2_sftp_init
libssh2_sftp_last_error
libssh2_sftp_mkdir_ex
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_rename_ex
libssh2_sftp_rmdir_ex
libssh2_sftp_seek
libssh2_sftp_seek64
libssh2_sftp_shutdown
libssh2_sftp_stat_ex
libssh2_sftp_statvfs
libssh2_sftp_symlink_ex
libssh2_sftp_tell
libssh2_sftp_tell64
libssh2_sftp_unlink_ex
libssh2_sftp_write
libssh2_trace
libssh2_trace_sethandler
libssh2_userauth_authenticated
libssh2_userauth_hostbased_fromfile_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_userauth_list
libssh2_userauth_password_ex
libssh2_userauth_publickey
libssh2_userauth_publickey_fromfile_ex

Sections

.text
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc6250be77cfebd6ee422408fe0a18a4

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

advapi32

shell32

libeay32

urlmon

wininet

gdiplus

psapi

Exports

Exports

Sections

.text Size: 240KB - Virtual size: 240KB

.rdata Size: 58KB - Virtual size: 58KB

.data Size: 7KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 240KB - Virtual size: 240KB

.rdata
Size: 58KB - Virtual size: 58KB

.data
Size: 7KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 41KB - Virtual size: 40KB