12b5553569ea2586e8263dde54f89face8284ba3846576ccee4c18617a8372f2

Sharing

Copy URL Twitter E-mail

General

Target

12b5553569ea2586e8263dde54f89face8284ba3846576ccee4c18617a8372f2
Size

117KB
MD5

735c2954e6ce0403d9415fc3e8d8bf96
SHA1

43f37b901b5193470a321c70f8c9d2192bfc0545
SHA256

12b5553569ea2586e8263dde54f89face8284ba3846576ccee4c18617a8372f2
SHA512

4f9b44ae05aba8faea15dd02afecbe785bfa5f8cc1faff2f47d5eaf783d80dc44e6f1dae8e8f6c587a9b19a7bce6a27e8c17c81060305b86b3864f727ce01fd5
SSDEEP

1536:QeCVTd5dCDHDOnA3h9DtcjXIrPzc4pSttMTiQHApfdhtp2ZjNyI6gjTRkPHE8ucP:ZAdMqoED0I1ttnjX29NydGTRk8u7/7

Score

N/A

Malware Config

Signatures

Files

12b5553569ea2586e8263dde54f89face8284ba3846576ccee4c18617a8372f2
.exe windows x86

4b0349cb5dde091c2fb0e50a02be5440

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetDeviceCaps
D3DKMTSetProcessSchedulingPriorityClass
GetRandomRgn
GetStockObject
CreateCompatibleBitmap
DeleteObject
GetDIBits
BitBlt
DeleteDC
GetRgnBox
SelectObject
SelectClipRgn
CreateCompatibleDC
CombineRgn
OffsetRgn
GdiAlphaBlend
CreateRectRgn
CreateDIBSection

user32

GetClassNameW
UpdateWindow
SetWindowTextW
DestroyIcon
GetWindowThreadProcessId
GetWindowRect
OffsetRect
SetClassLongW
MonitorFromWindow
AdjustWindowRectEx
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsW
GetSystemMetrics
MsgWaitForMultipleObjectsEx
PostMessageW
RegisterErrorReportingDialog
RegisterGhostWindow
HungWindowFromGhostWindow
InternalGetWindowIcon
GhostWindowFromHungWindow
RegisterFrostWindow
OpenThreadDesktop
GetWindow
CloseDesktop
GetPropW
UnregisterSessionPort
RegisterSessionPort
CheckDesktopByThreadId
DwmStopRedirection
DwmStartRedirection
SetForegroundWindow
IsHungAppWindow
MessageBeep
IsWindowEnabled
EnumWindows
FlashWindowEx
SendMessageTimeoutW
IsWindow
GetCaretBlinkTime
EndTask
OpenDesktopW
IsDialogMessageW
GetAncestor
SetThreadDesktop
EndPaint
ClientToScreen
InternalGetWindowText
GetUpdateRgn
SetTimer
IsIconic
FillRect
KillTimer
IsZoomed
GetTitleBarInfo
GetWindowInfo
LogicalToPhysicalPoint
GetClientRect
BeginPaint
ChangeWindowMessageFilterEx
InvalidateRect
GetWindowLongW
GetWindowTextW
GetDCEx
SetWindowLongW
ShowWindow
GetSysColorBrush
CreateDialogParamW
PostThreadMessageW
IsWindowVisible
GetGuiResources
SetWindowPos
LoadStringW
LoadIconW
RegisterWindowMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterPowerSettingNotification
ReleaseDC
GetDC
PostQuitMessage
DestroyWindow
UnregisterPowerSettingNotification
DefWindowProcW
CreateWindowExW
RegisterClassExW
GetThreadDesktop
GetUserObjectInformationW
SystemParametersInfoW
SendMessageW

msvcrt

memset
_unlock
__dllonexit
_wcsnicmp
_onexit
_except_handler4_common
_CIsqrt
memcpy
_wcsupr_s
wcschr
wcsncpy_s
wcsrchr
??_U@YAPAXI@Z
??_V@YAXPAX@Z
rand
srand
_wcsicmp
_purecall
_lock
_vsnwprintf
_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memmove
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
_ftol2

ntdll

DbgPrompt
NtQuerySystemInformation
DbgPrintEx
RtlCaptureStackBackTrace
WinSqmAddToStreamEx
WinSqmIsOptedIn
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtRequestPort
NtConnectPort
NtRequestWaitReplyPort
RtlUpcaseUnicodeChar
WinSqmIncrementDWORD
RtlNtStatusToDosError
EtwEventWriteNoRegistration
NtClose
NtWaitForSingleObject
NtOpenEvent
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
RtlAllocateAndInitializeSid
NtQueryInformationProcess
NtReplyPort
NtCreateWaitablePort
RtlInitUnicodeString
RtlInsertElementGenericTable
RtlIsGenericTableEmpty
RtlLookupElementGenericTable
RtlInitializeGenericTable
EtwEventEnabled
EtwEventRegister
EtwEventUnregister
RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
WinSqmAddToStream
EtwEventWrite

uxtheme

CloseThemeData
OpenThemeData

imm32

ImmDisableIME

dwmredir

DwmRedirectionManagerLockMemoryAllocations
DwmRedirectionManagerEnableMMCSS
DwmRedirectionManagerPlayingVideo
DwmInitializeTransport
DwmShutdownTransport
DwmRedirectionManagerShutdown
DwmRedirectionManagerShouldRemainOnHibernate
DwmRedirectionManagerDispatchMessage
DwmRedirectionManagerFailMessage
DwmRedirectionManagerWaitForMultipleObjects
DwmVersionCheck

dwmcore

MilChannel_CommitChannel
MilComposition_WaitForNextMessage
MilCompositionEngine_UpdateSchedulerSettings
MilResource_SendCommand
MilChannel_GetMarshalType
MilConnection_CreateChannel
MilConnection_HandleSfmEventOnPartition
MilConnection_ClearSfmEventOnPartition
MilConnection_DestroyChannel
MilComposition_PeekNextMessage

kernel32

InterlockedExchange
GetStartupInfoA
GetModuleHandleA
LocalAlloc
LocalFree
ResumeThread
DuplicateHandle
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
WaitForMultipleObjectsEx
IsWow64Process
RegSetValueExW
RegCreateKeyExW
QueryPerformanceCounter
SetThreadPriority
CreateThread
OpenProcess
ReleaseMutex
CreateMutexW
SetEvent
OpenEventW
SignalObjectAndWait
UnhandledExceptionFilter
GetCurrentThread
TerminateThread
TerminateProcess
DebugBreak
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
IsDebuggerPresent
GetModuleHandleW
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
DelayLoadFailureHook
Sleep
GetUserDefaultLangID
FormatMessageW
GetExitCodeThread
WaitForSingleObject
RegisterWaitForSingleObject
GetThreadId
GetTickCount
ProcessIdToSessionId
CreateEventW
GetCurrentProcessId
SetProcessWorkingSetSize
GetSystemTimeAsFileTime
RegGetValueW
GetSystemInfo
GetCurrentProcess
GetProcAddress
LoadLibraryW
SetErrorMode
QueryFullProcessImageNameW
ExitProcess
GetCurrentThreadId
SetProcessShutdownParameters
SetUnhandledExceptionFilter
HeapSetInformation
WerSetFlags
SetLastError
CloseHandle
GetLastError
GetTickCount64
DeleteCriticalSection
InitializeCriticalSection
QueueUserWorkItem
LeaveCriticalSection
EnterCriticalSection

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xpyzgds
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4b0349cb5dde091c2fb0e50a02be5440

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

ntdll

uxtheme

imm32

dwmredir

dwmcore

kernel32

Sections

.text Size: 75KB - Virtual size: 75KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 31KB - Virtual size: 32KB

xpyzgds Size: - Virtual size: 4KB

.text
Size: 75KB - Virtual size: 75KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 31KB - Virtual size: 32KB

xpyzgds
Size: - Virtual size: 4KB