f3a50795c7fbcb3084a525e2b9665c79adc576ecab024b9995fc8cfa420f4651

Sharing

Copy URL Twitter E-mail

General

Target

f3a50795c7fbcb3084a525e2b9665c79adc576ecab024b9995fc8cfa420f4651
Size

1.4MB
MD5

c239ce3aad9c2bb42c879ce13cdafb47
SHA1

181b0adfa39fef418ceb2f42650004095df7bdeb
SHA256

f3a50795c7fbcb3084a525e2b9665c79adc576ecab024b9995fc8cfa420f4651
SHA512

5caa8a691e682a43d59f38e6e8dc7c8e8cb8c1cb16c50c786e3a5e35bfb82c9c4619ad62f9f838ee5bc09118e3bb75aa93a03fa0f572f9590bfbfe752ac89c00
SSDEEP

12288:0kR/DIzvwdzHeeQQHFEq1HcP7IrunGqPtdy5HThwt9Mso2/ygcjQdTM4b:0kR/czvmzHeeFlEq18P0YtcFerXc064b

Score

N/A

Malware Config

Signatures

Files

f3a50795c7fbcb3084a525e2b9665c79adc576ecab024b9995fc8cfa420f4651
.exe windows x86

d732d2363b125182f26e997ca5a2c4fe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileExW
ConvertThreadToFiber
GetStringTypeExA
FlushViewOfFile
GetDiskFreeSpaceA
GetThreadContext
GetConsoleCursorInfo
ChangeTimerQueueTimer
Module32Next
ExpandEnvironmentStringsA
FlushFileBuffers
GetCurrentConsoleFont
SetFilePointerEx
CompareStringA
DeleteTimerQueueEx
GetExitCodeThread
SetTapeParameters
CreateTimerQueue
ReleaseMutex
FoldStringA
Toolhelp32ReadProcessMemory
MoveFileW
GetFileTime
FormatMessageA
ReleaseSemaphore
GlobalMemoryStatus
CreateFileW
OpenEventA
GetFullPathNameW
SetSystemPowerState
OpenSemaphoreW
ExpandEnvironmentStringsW
AreFileApisANSI
SetConsoleOutputCP
CreateMutexA
CompareStringW
OpenProcess
GetTimeFormatW
DeleteAtom
GetComputerNameExW
GetCurrentDirectoryA
IsValidCodePage
SetFileAttributesW
GetUserDefaultUILanguage
GetTempPathW
GetSystemDefaultLangID
GetVersion
GetProfileStringW
LoadResource
GetACP
GetTapeStatus
GetBinaryTypeA
LCMapStringA
SetCurrentDirectoryW
GetConsoleCP
GetDriveTypeW
SetLocaleInfoW
ReadFile
GetSystemDefaultLCID
GetLongPathNameA
GetFileType
CreateFileMappingA
Module32First
CreateProcessA
SetMailslotInfo
OpenWaitableTimerW
GetBinaryTypeW
CreateSemaphoreA
GetDateFormatW
GetSystemDirectoryW
GetPrivateProfileStringW
GetStringTypeW
FindAtomW
SetStdHandle
SetConsoleTextAttribute
LCMapStringW
FindResourceExW
DeleteTimerQueueTimer
SetProcessWorkingSetSize
GetFileAttributesA
GetCPInfo
OpenJobObjectA
GetConsoleScreenBufferInfo
GetFileAttributesExA
GetEnvironmentStrings
ResetWriteWatch
SetThreadPriority
GetCalendarInfoA
ReplaceFileA
FindResourceW
GetCompressedFileSizeA
GetUserDefaultLCID
GetConsoleMode
GetPrivateProfileSectionA
SetConsoleCP
MapViewOfFileEx
ProcessIdToSessionId
IsDBCSLeadByteEx
GetCPInfoExA
GetShortPathNameW
GetDriveTypeA
OpenMutexA
DefineDosDeviceA
CreateTapePartition
GetStdHandle
OpenWaitableTimerA
GetPrivateProfileSectionNamesA
GetVolumeInformationA
TryEnterCriticalSection
CreateEventW
OpenJobObjectW
FindFirstVolumeA
DefineDosDeviceW
GetConsoleWindow
DnsHostnameToComputerNameW
GetConsoleAliasExesA
GetCalendarInfoW
FreeEnvironmentStringsA
SetCalendarInfoW
ResetEvent
GetFileSize
lstrcpynA
FlushInstructionCache
GetThreadTimes
FoldStringW
FindFirstVolumeMountPointA
GetWindowsDirectoryA
GetNamedPipeHandleStateW
SetFileAttributesA
SetFileTime
SystemTimeToTzSpecificLocalTime
GetMailslotInfo
FindAtomA
FindFirstVolumeW
GetVolumeInformationW
DeviceIoControl
PrepareTape
GetTimeFormatA
GetPriorityClass
GetConsoleAliasA
RemoveDirectoryA
SetEnvironmentVariableA
GetProcessAffinityMask
CreateDirectoryExA
GetProcessPriorityBoost
CancelIo
FreeLibraryAndExitThread
GetStringTypeA
FindResourceExA
GetTempFileNameA
GetPrivateProfileStructW
GetModuleHandleA
GetProcAddress
GetConsoleAliasExesLengthW
HeapCreate
IsDebuggerPresent
CreateNamedPipeA
MapUserPhysicalPages
MapViewOfFile
GetUserDefaultLangID
SetPriorityClass
SetConsoleDisplayMode
GetDiskFreeSpaceExW
FindVolumeMountPointClose
GetLogicalDrives
GetVolumeNameForVolumeMountPointW
DeleteTimerQueue
ReplaceFileW
SetProcessAffinityMask
GetDateFormatA
EnumCalendarInfoExA
CancelWaitableTimer
GetProfileIntA
GetModuleHandleW
EraseTape
VirtualAlloc

rpcrt4

RpcServerUseProtseqW
NdrConformantStringUnmarshall
RpcUserFree
RpcEpUnregister
RpcStringFreeA
RpcAsyncCancelCall
RpcSsGetContextBinding
RpcBindingReset
RpcNetworkIsProtseqValidW
RpcBindingSetObject
RpcMgmtWaitServerListen
RpcBindingSetOption
RpcStringBindingParseW
NdrFullPointerXlatFree
RpcMgmtInqComTimeout
RpcServerTestCancel
RpcBindingInqAuthClientW
RpcServerRegisterIf2
NdrGetUserMarshalInfo
RpcErrorAddRecord
RpcServerUnregisterIf
NdrMesTypeFree2
RpcServerRegisterAuthInfoW
RpcBindingServerFromClient
RpcErrorStartEnumeration
RpcErrorEndEnumeration
RpcServerUseProtseqIfW
RpcIfInqId
NdrPointerBufferSize
NdrConformantArrayUnmarshall
RpcServerUseProtseqEpExW
UuidHash
RpcCertGeneratePrincipalNameA
RpcErrorGetNextRecord
NdrPointerUnmarshall
RpcMgmtEnableIdleCleanup
RpcAsyncGetCallStatus
RpcServerListen
RpcServerRegisterAuthInfoA
RpcMgmtInqStats
NdrAsyncServerCall
NdrSimpleTypeUnmarshall
RpcServerRegisterIfEx
UuidCreateNil
RpcSmDestroyClientContext
UuidToStringA
I_RpcBindingInqTransportType
NdrGetDcomProtocolVersion
RpcEpResolveBinding
RpcCancelThreadEx
RpcGetAuthorizationContextForClient
NdrMesTypeDecode2
NdrClientCall2
NdrClientCall
RpcServerInqBindings
NdrPointerMarshall
RpcBindingInqAuthClientExA
NdrMesTypeAlignSize2
RpcBindingVectorFree
UuidToStringW
RpcMgmtEpEltInqBegin
RpcBindingSetAuthInfoExA

user32

GetAltTabInfoA
SetDlgItemInt
GetProcessWindowStation
LoadStringW
LoadAcceleratorsW
GetDCEx
RegisterClassExA
ScreenToClient
wvsprintfW
IsRectEmpty
GetMessagePos
IsWindow
CharToOemA
SetCapture
MsgWaitForMultipleObjectsEx
ActivateKeyboardLayout
GetScrollInfo
KillTimer
RegisterWindowMessageW
SendInput
GetMessageW
LoadCursorA
LockWindowUpdate
PeekMessageW
CharUpperW
GetClientRect
IsWindowVisible
GetWindowTextLengthW
IsDialogMessageA
DestroyCursor
RegisterClassExW
PostQuitMessage
SendMessageTimeoutW
EqualRect
DrawFrameControl
SetThreadDesktop
wsprintfA
DrawEdge
DrawIconEx
MapDialogRect
MonitorFromRect
CreateAcceleratorTableW
DestroyAcceleratorTable
ValidateRect
GetKeyboardLayoutList
MapWindowPoints
DeleteMenu
ClientToScreen
SetMenuDefaultItem
LoadCursorW
SetDlgItemTextW
TrackPopupMenuEx
GetCursorPos
OemToCharBuffA
GetParent
GetMessageTime
CloseDesktop
MessageBeep
EndDialog
SetActiveWindow
FindWindowExW
MsgWaitForMultipleObjects

comctl32

ImageList_Remove
ImageList_EndDrag
ImageList_SetBkColor
ImageList_SetDragCursorImage
FlatSB_GetScrollPos
DestroyPropertySheetPage
ImageList_GetImageCount
ImageList_Copy
FlatSB_SetScrollInfo
PropertySheetW
ImageList_ReplaceIcon
ImageList_DragLeave
ImageList_SetImageCount
CreateToolbarEx
_TrackMouseEvent
InitCommonControlsEx
ImageList_LoadImageA
ImageList_SetOverlayImage
ImageList_DrawEx

advapi32

RegQueryValueExA
RegOpenKeyW
RegEnumKeyW
InitializeSecurityDescriptor
RegDeleteKeyA
MakeSelfRelativeSD
OpenThreadToken
RegDeleteKeyW
StartServiceA
SetServiceStatus
CryptAcquireContextW
RegDeleteValueW
OpenProcessToken
AdjustTokenPrivileges
CryptGetHashParam
CopySid
GetSecurityDescriptorLength
OpenServiceA
StartServiceW
RegSetKeySecurity
GetTokenInformation
GetAclInformation
FreeSid
RegOpenKeyA
ControlService
RegCreateKeyExA
GetSidSubAuthority
RegOpenKeyExW
RegNotifyChangeKeyValue
OpenSCManagerA
AddAce
QueryServiceStatus
RegSetValueW
RegCreateKeyA
RegSetValueExW
CloseServiceHandle
RegEnumKeyA
ChangeServiceConfigW
DeregisterEventSource
GetSecurityDescriptorSacl
RegisterEventSourceW
CryptHashData
GetLengthSid
ImpersonateLoggedOnUser
QueryServiceConfigW
LookupAccountSidW
SetSecurityDescriptorOwner
RegCreateKeyW
RegQueryInfoKeyA
ReportEventW
DuplicateTokenEx
CheckTokenMembership
IsValidSid
SetEntriesInAclW
RegSetValueExA

shell32

SHGetFolderPathW
SHBindToParent
SHBrowseForFolderW
CommandLineToArgvW
ShellExecuteExW
SHFileOperationW
SHChangeNotify
SHGetSpecialFolderPathW
SHGetDesktopFolder
SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderLocation
ShellExecuteW

ole32

StgCreatePropStg
StgCreateStorageEx
HACCEL_UserMarshal
CoAllowSetForegroundWindow
CoRegisterMessageFilter
OleSetMenuDescriptor
CoEnableCallCancellation
CoFileTimeToDosDateTime
OleSetAutoConvert
StgCreateDocfile
GetHGlobalFromStream
CoCreateInstance
CoGetMarshalSizeMax
CoLoadLibrary
HBITMAP_UserUnmarshal
HMENU_UserSize
RevokeDragDrop
CoCreateGuid
HWND_UserSize
OleCreateDefaultHandler
HICON_UserMarshal
CoGetCallerTID
CoFreeAllLibraries
CoTaskMemAlloc
StringFromCLSID
OleGetAutoConvert

oleaut32

SafeArrayGetUBound
SysAllocStringByteLen
VariantChangeTypeEx
SysFreeString
SysAllocStringLen
VariantChangeType
GetErrorInfo
SysReAllocStringLen
VariantCopy
VariantInit
SafeArrayCreate
VariantCopyInd
VariantClear
SysStringLen
SafeArrayPtrOfIndex
GetActiveObject
SafeArrayGetLBound

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_except_handler3

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d732d2363b125182f26e997ca5a2c4fe

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

rpcrt4

user32

comctl32

advapi32

shell32

ole32

oleaut32

msvcrt

Sections

.text Size: 121KB - Virtual size: 121KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 15KB - Virtual size: 14KB

.text
Size: 121KB - Virtual size: 121KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 15KB - Virtual size: 14KB