cced69f7fbd6160797077b1236418cf4e8912b332650092a7a2254f0bbda0247

Sharing

Copy URL Twitter E-mail

General

Target

cced69f7fbd6160797077b1236418cf4e8912b332650092a7a2254f0bbda0247
Size

312KB
MD5

516379623451a5a3b6001481cc39e7c4
SHA1

e55dc6c6eecf0a9fc7363f15d328f27828f510fc
SHA256

cced69f7fbd6160797077b1236418cf4e8912b332650092a7a2254f0bbda0247
SHA512

947e367a0468ac4dd21626dd1f2d320c50d0e2a46051f8a782c87837e6830cf9e067568a6e47d9e74aba39288959f4e7991023e05ae605cb1da2359ccdb751e1
SSDEEP

6144:DszKTtARe4aTgcta6Qm2fQnxNpHyN3RsjstG+IR2Vu8HIid:oz4tXT746QnaSo0Grsbd

Score

N/A

Malware Config

Signatures

Files

cced69f7fbd6160797077b1236418cf4e8912b332650092a7a2254f0bbda0247
.exe windows x86

63e837baa16c04016fc0e20e211f9dba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrChrA
PathIsUNCServerA
PathIsRelativeW
SHGetValueW
StrNCatA
StrPBrkA
PathFindNextComponentA
PathIsSystemFolderW
PathCanonicalizeA
StrIsIntlEqualA
PathFindFileNameW
StrRStrIA
SHSetValueA
PathRenameExtensionW
PathGetArgsW

kernel32

VirtualAllocEx
ExitProcess
LoadLibraryA
GetProcAddress
GetModuleHandleA
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetLastError
HeapFree
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapAlloc
HeapReAlloc
Sleep
IsProcessorFeaturePresent
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId

aclui

ord1
ord2

avifil32

AVIFileCreateStreamW
AVIStreamAddRef
AVIStreamGetFrameClose
AVIFileGetStream
AVIFileInit

msvfw32

ICClose
DrawDibProfileDisplay

uxtheme

GetThemeBackgroundRegion
GetThemeColor
GetThemeAppProperties
SetWindowTheme
OpenThemeData
DrawThemeText

setupapi

SetupDiGetSelectedDevice
SetupGetInfFileListW
SetupSetSourceListW
SetupQueueRenameW
SetupDiGetClassDevsW
SetupAddToSourceListA
SetupDiInstallDevice

comdlg32

GetFileTitleW
GetOpenFileNameA
GetSaveFileNameW
ReplaceTextA
CommDlgExtendedError
ChooseColorW
PrintDlgA
GetOpenFileNameW
PrintDlgW

Sections

.wectyy
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hxdr
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.erudf
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63e837baa16c04016fc0e20e211f9dba

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

aclui

avifil32

msvfw32

uxtheme

setupapi

comdlg32

Sections

.wectyy Size: 55KB - Virtual size: 54KB

.rdata Size: 242KB - Virtual size: 241KB

.data Size: 8KB - Virtual size: 27KB

.hxdr Size: 5KB - Virtual size: 5KB

.erudf Size: 512B - Virtual size: 32B

.rsrc Size: 512B - Virtual size: 16B

.wectyy
Size: 55KB - Virtual size: 54KB

.rdata
Size: 242KB - Virtual size: 241KB

.data
Size: 8KB - Virtual size: 27KB

.hxdr
Size: 5KB - Virtual size: 5KB

.erudf
Size: 512B - Virtual size: 32B

.rsrc
Size: 512B - Virtual size: 16B