b7ea4546293baf1a4a0fb138b545089f223059fd6d83dcddc12daf2dfc8e3f7e

Sharing

Copy URL

Twitter E-mail

General

Target

b7ea4546293baf1a4a0fb138b545089f223059fd6d83dcddc12daf2dfc8e3f7e
Size

138KB
MD5

81acd36cb47af586862023e03b13195b
SHA1

55e4e2787d037dc5b295507ff301a567e676d218
SHA256

b7ea4546293baf1a4a0fb138b545089f223059fd6d83dcddc12daf2dfc8e3f7e
SHA512

8b6182b7a775f3cd7ea3fdc5a569f270f483d5e8d2f424aacfdcc58536ed4522cb04bc7de147575c451a6be1964f2ab4a7fa078c8e5a0946c20e994c167e26ae
SSDEEP

3072:Vk4aHyx7DCgdHaAtFhqDEDzgeeoqCOWG4F5ehpB3tBoxhsDEBy+BKrJit:y4aShDCgdHaAtiEDEeYS5SBMyD8+rQt

Score

N/A

Malware Config

Signatures

Files

b7ea4546293baf1a4a0fb138b545089f223059fd6d83dcddc12daf2dfc8e3f7e
.exe windows x86

0bfca9e30adf89aeb624f197b7903615

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileW
VirtualProtect
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
GetNativeSystemInfo
GetVersionExW
TlsGetValue
SetEvent
TlsSetValue
TerminateProcess
SetThreadPriority
ResetEvent
GetThreadContext
SetThreadContext
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetFileAttributesExW
WaitForMultipleObjects
GetPrivateProfileIntW
MoveFileExW
GetModuleFileNameW
GetUserDefaultUILanguage
ExitProcess
lstrcmpiA
WTSGetActiveConsoleSessionId
GetCurrentThreadId
CreateEventW
GetLocalTime
GetCommandLineW
SetErrorMode
GetComputerNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GlobalLock
GlobalUnlock
WideCharToMultiByte
Thread32First
RemoveDirectoryW
FindClose
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
WriteFile
VirtualQueryEx
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
ReadFile
Thread32Next
GetFileAttributesW
HeapCreate
HeapDestroy
ReadProcessMemory
GetPrivateProfileStringW
Sleep
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetCurrentThread
GetTickCount
GetModuleHandleW
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
lstrcmpiW
LoadLibraryA
GetProcAddress
FreeLibrary
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
GetProcessId
WaitForSingleObject

user32

OpenInputDesktop
GetCapture
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageA
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
DefDlgProcA
DefMDIChildProcA
ReleaseCapture
RegisterClassW
CallWindowProcA
CallWindowProcW
GetMessagePos
DefFrameProcW
DefFrameProcA
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
GetWindowInfo
DrawEdge
GetWindowThreadProcessId
GetUpdateRect
IntersectRect
GetDCEx
PostThreadMessageW
EqualRect
GetKeyboardState
ToUnicode
MapWindowPoints
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetShellWindow
GetWindowRect
GetParent
GetClassLongW
GetAncestor
SetWindowPos
CharLowerBuffA
CreateDesktopW
SetCapture
SetProcessWindowStation
IsWindow
RegisterClassA
GetThreadDesktop
DefDlgProcW
CreateWindowStationW
GetProcessWindowStation
GetCursorPos
GetIconInfo
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
PrintWindow
SendMessageW
DefWindowProcW
IsRectEmpty
MapVirtualKeyW
PostMessageW
CharLowerW
ExitWindowsEx
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
TranslateMessage
GetWindowLongW
CharLowerA
OpenWindowStationW
GetSystemMetrics
GetMessageA
RegisterClassExA
BeginPaint
DrawIcon
DispatchMessageW
GetWindow
SendMessageTimeoutW
SetWindowLongW
CharUpperW
ReleaseDC
PeekMessageW
CloseWindowStation

advapi32

GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
InitiateSystemShutdownExW
RegEnumKeyExW
EqualSid
IsWellKnownSid

shlwapi

wvnsprintfW
PathQuoteSpacesW
StrCmpNIW
PathRenameExtensionW
StrStrIW
StrStrIA
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
UrlUnescapeA

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

SetRectRgn
SelectObject
CreateCompatibleDC
DeleteDC
SetViewportOrgEx
SaveDC
RestoreDC
CreateDIBSection
GetDeviceCaps
GetDIBits
DeleteObject
GdiFlush
CreateCompatibleBitmap

ws2_32

WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
getsockname
getpeername
recvfrom
sendto
WSAEventSelect
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
closesocket
send
listen
accept
WSAGetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0bfca9e30adf89aeb624f197b7903615

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB