7987c57559573086fcc0b5e426b2a3ea96178c2d039a1d8bf2794f09d7e0f6aa

Sharing

Copy URL Twitter E-mail

General

Target

7987c57559573086fcc0b5e426b2a3ea96178c2d039a1d8bf2794f09d7e0f6aa
Size

312KB
MD5

9cbf5bd2547a743f242f4820936f4e58
SHA1

32d9977b95a24d963319708c1424a39d0294399a
SHA256

7987c57559573086fcc0b5e426b2a3ea96178c2d039a1d8bf2794f09d7e0f6aa
SHA512

f12b110de076a438f1a0e3e0b404bc3cbd270f0378c282eb764bf86aea1bc4322df7614442b7881856d7d186f55f15789eb641e7d11b76211f50ccba97405a21
SSDEEP

6144:qsf2ENbRvWYxw57aOPLBJSpnJqAn6aWYqqOVM1HXLqN7fiFV:HfrNdvTwNXPL+963Yq0lWNju

Score

N/A

Malware Config

Signatures

Files

7987c57559573086fcc0b5e426b2a3ea96178c2d039a1d8bf2794f09d7e0f6aa
.exe windows x86

63e837baa16c04016fc0e20e211f9dba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrChrA
PathIsUNCServerA
PathIsRelativeW
SHGetValueW
StrNCatA
StrPBrkA
PathFindNextComponentA
PathIsSystemFolderW
PathCanonicalizeA
StrIsIntlEqualA
PathFindFileNameW
StrRStrIA
SHSetValueA
PathRenameExtensionW
PathGetArgsW

kernel32

VirtualAllocEx
ExitProcess
LoadLibraryA
GetProcAddress
GetModuleHandleA
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetLastError
HeapFree
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapAlloc
HeapReAlloc
Sleep
IsProcessorFeaturePresent
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId

aclui

ord1
ord2

avifil32

AVIFileCreateStreamW
AVIStreamAddRef
AVIStreamGetFrameClose
AVIFileGetStream
AVIFileInit

msvfw32

ICClose
DrawDibProfileDisplay

uxtheme

GetThemeBackgroundRegion
GetThemeColor
GetThemeAppProperties
SetWindowTheme
OpenThemeData
DrawThemeText

setupapi

SetupDiGetSelectedDevice
SetupGetInfFileListW
SetupSetSourceListW
SetupQueueRenameW
SetupDiGetClassDevsW
SetupAddToSourceListA
SetupDiInstallDevice

comdlg32

GetFileTitleW
GetOpenFileNameA
GetSaveFileNameW
ReplaceTextA
CommDlgExtendedError
ChooseColorW
PrintDlgA
GetOpenFileNameW
PrintDlgW

Sections

.wectyy
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hxdr
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.erudf
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63e837baa16c04016fc0e20e211f9dba

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

aclui

avifil32

msvfw32

uxtheme

setupapi

comdlg32

Sections

.wectyy Size: 55KB - Virtual size: 54KB

.rdata Size: 242KB - Virtual size: 241KB

.data Size: 8KB - Virtual size: 27KB

.hxdr Size: 5KB - Virtual size: 5KB

.erudf Size: 512B - Virtual size: 32B

.rsrc Size: 512B - Virtual size: 16B

.wectyy
Size: 55KB - Virtual size: 54KB

.rdata
Size: 242KB - Virtual size: 241KB

.data
Size: 8KB - Virtual size: 27KB

.hxdr
Size: 5KB - Virtual size: 5KB

.erudf
Size: 512B - Virtual size: 32B

.rsrc
Size: 512B - Virtual size: 16B