2890947917fc0074902903eaf3b8e73cf051c9a96a7c53a821e36e3ebfc19ea2

Sharing

Copy URL Twitter E-mail

General

Target

2890947917fc0074902903eaf3b8e73cf051c9a96a7c53a821e36e3ebfc19ea2
Size

163KB
MD5

153b61a11a1dec31d773ddec2aa58256
SHA1

5059de6e6d33831893d80d9650bdff0f6bf525be
SHA256

2890947917fc0074902903eaf3b8e73cf051c9a96a7c53a821e36e3ebfc19ea2
SHA512

8775a439a3b407aad7234e587c18f7ccb5506669d3fecc980b911c612451afddc94ea1e15bd53fb239db213979006fb81d35452c7010abf47b5f5069fde36a05
SSDEEP

3072:AeStyDTQuuDHnUdya0TjeOLRwzOkmujXhR9Mfrcpd9C/TjVRplrf7y1VqRdq5UHv:NSk/Q1Hk+eIRkRXhv+rcgrrplrAqdj+K

Score

N/A

Malware Config

Signatures

Files

2890947917fc0074902903eaf3b8e73cf051c9a96a7c53a821e36e3ebfc19ea2
.exe windows x86

9eaadf3fd7b906b2636e4a55fe69c059

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysStringLen
VariantChangeType
OleLoadPicture
SafeArrayUnaccessData
VariantInit
GetActiveObject
SafeArrayPutElement
VariantCopyInd
SafeArrayCreate
SafeArrayGetUBound
VariantChangeTypeEx
SafeArrayPtrOfIndex
SafeArrayGetLBound
CreateErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantClear
SysFreeString
SysReAllocStringLen
SafeArrayAccessData
VariantCopy
SafeArrayGetElement
SysAllocStringLen

kernel32

TlsFree
DeleteCriticalSection
ReleaseSemaphore
GetStartupInfoA
GetSystemTimeAsFileTime
WideCharToMultiByte
GetFileType
DeleteFileW
LeaveCriticalSection
lstrcpynA
InterlockedExchange
GetStdHandle
HeapCreate
GetConsoleMode
VirtualAlloc
GetFullPathNameW
CreateProcessW
OpenMutexW
GetModuleHandleW
UnhandledExceptionFilter
LoadLibraryExW
GetFileAttributesW
GetFileAttributesA
GetVersion
GetLastError
GetCommandLineA
InterlockedCompareExchange
CreateFileMappingA
SetStdHandle
GetThreadLocale
GetProcessHeap
GetCurrentProcess
GetExitCodeThread
Sleep
GetSystemTime
HeapAlloc
RtlUnwind
QueryPerformanceCounter
CreateDirectoryW
LockResource
FindResourceA
HeapDestroy
GetCPInfo
ExitProcess
GetACP
GetWindowsDirectoryW
GetComputerNameW
SetThreadPriority
GetEnvironmentStringsW
GetStringTypeA
GetCurrentProcessId
GetDriveTypeW
ResumeThread
SetEvent
VirtualQuery
TlsSetValue
InitializeCriticalSectionAndSpinCount
GetDriveTypeA
Thread32Next
SetFilePointer
FindResourceW
OutputDebugStringW
GetEnvironmentStrings
GetOEMCP

shell32

SHGetPathFromIDListW
SHBindToParent
SHChangeNotify
SHGetSpecialFolderLocation
SHGetDesktopFolder
CommandLineToArgvW
DragQueryFileW
SHGetFileInfoW
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExW
SHFileOperationW
DragQueryFileA
SHGetSpecialFolderPathW
SHGetFolderPathW

ntdll

RtlCopyUnicodeString
RtlCreateTimerQueue
swprintf
RtlInitUnicodeString
RtlInitializeResource
RtlInitializeGenericTable
RtlxAnsiStringToUnicodeSize
NtOpenProcess
RtlDestroyEnvironment
RtlxUnicodeStringToOemSize
RtlEqualSid
NtOpenProcessToken
RtlCreateAcl
RtlGetOwnerSecurityDescriptor
RtlAddAccessAllowedAce
NtDeleteValueKey
wcscat
RtlUpcaseUnicodeString
RtlDestroyHeap
RtlFreeSid
NtRequestWaitReplyPort
NtReadFile
RtlLookupElementGenericTable
NtCancelIoFile
wcscmp

ole32

MkParseDisplayName
CreateBindCtx
PropVariantClear
ProgIDFromCLSID
StgCreateDocfile
OleRegEnumVerbs
CLSIDFromString
GetHGlobalFromStream
OleInitialize
StringFromGUID2
CoInitializeEx
ReleaseStgMedium
CoFreeUnusedLibraries
CoRevokeClassObject
CoMarshalInterface
StgOpenStorage
CoSetProxyBlanket
PropVariantCopy
CoDisconnectObject
CoGetObjectContext
StgCreateDocfileOnILockBytes
CoUnmarshalInterface
CoTaskMemFree
StgIsStorageFile
CoGetClassObject
CLSIDFromProgID
CoInitializeSecurity
CoImpersonateClient

msvcrt

_rotl
__p__osver
toupper
wcscmp
_iob
_ftol
_cexit
_tell
memset
_vsnwprintf
wcscpy
_access
malloc
_finite
printf
wcsstr
fprintf
srand
rand
??2@YAPAXI@Z
_commit
calloc
__p__commode
swprintf
??3@YAXPAX@Z
_errno
_stat
ctime
fclose
__p__iob
strrchr
wcsncat
_write
_vsnprintf

rpcrt4

NdrDllUnregisterProxy
NdrCStdStubBuffer2_Release
RpcServerUnregisterIf
RpcBindingToStringBindingW
RpcRaiseException
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrOleFree
NdrDllRegisterProxy
RpcServerInqBindings
RpcServerUseProtseqEpW
RpcStringFreeW
RpcBindingSetAuthInfoW
NdrStubForwardingFunction
RpcServerRegisterAuthInfoW
UuidFromStringW
NdrDllGetClassObject
RpcServerRegisterIfEx
CStdStubBuffer_Disconnect
RpcRevertToSelf
UuidCreate
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
UuidToStringW
NdrOleAllocate
CStdStubBuffer_QueryInterface
RpcBindingSetAuthInfoExW
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_CountRefs

advapi32

IsValidSecurityDescriptor
RegDeleteValueA
SetEntriesInAclW
RegDeleteValueW
CryptAcquireContextW
CryptGenRandom
RegEnumValueA
FreeSid
UnlockServiceDatabase
StartServiceW
GetSecurityDescriptorDacl
GetAce
GetSidIdentifierAuthority
GetLengthSid
SetSecurityDescriptorDacl
RegCreateKeyExA
AdjustTokenPrivileges
RegOpenKeyA
SetServiceStatus
GetTraceEnableFlags
UnregisterTraceGuids
OpenSCManagerA
RegQueryInfoKeyA
RegQueryValueExA
LsaOpenPolicy
RegEnumKeyW
RegSetValueW
RegCreateKeyW
GetSecurityDescriptorControl
GetTokenInformation
GetSecurityDescriptorLength
LookupAccountNameW
ConvertStringSidToSidW
RegDeleteKeyW
GetSidSubAuthorityCount
RevertToSelf
RegNotifyChangeKeyValue

shlwapi

PathStripToRootW
StrCmpNIW
StrCmpNW
StrStrIA
SHSetValueW
PathRemoveFileSpecW
SHDeleteKeyW
PathIsUNCW
PathIsDirectoryW
StrRChrW
PathCreateFromUrlW
StrChrW
PathAppendA
StrCpyNW
PathRemoveFileSpecA
PathIsRelativeW
UrlUnescapeW
StrToIntW
PathAddBackslashW

gdi32

GetObjectA
DeleteMetaFile
ExtTextOutA
ExtTextOutW
PatBlt
GetTextAlign
RealizePalette
CreateDCW
EnumFontFamiliesExW
ExtSelectClipRgn
SelectObject
SetROP2
StretchDIBits
GetStockObject
StartPage
StretchBlt
GetNearestColor
CreateDIBSection
OffsetRgn
TextOutW
SetWindowExtEx
GetClipRgn
GetWindowExtEx
CreateBitmap
ScaleViewportExtEx
EndPage
LineTo
DPtoLP
TranslateCharsetInfo
GetTextMetricsA
CreateRectRgn
CombineRgn
CreatePatternBrush
GetObjectType
CreatePalette
GetDeviceCaps
Polyline
Ellipse
FillRgn
SetTextColor
CreateMetaFileA

user32

LoadBitmapW
DialogBoxParamW
GetWindowRect
PostQuitMessage
SetWindowTextA
IsWindowVisible
GetFocus
GetClassNameA
CallNextHookEx
InvalidateRect
GetWindowDC
CharPrevW
SetCursor
SetDlgItemTextA

comctl32

CreatePropertySheetPageW
PropertySheetW
InitCommonControlsEx
PropertySheetA
InitCommonControls
ImageList_Draw
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon

Sections

.textbss
Size: 4KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9eaadf3fd7b906b2636e4a55fe69c059

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

kernel32

shell32

ntdll

ole32

msvcrt

rpcrt4

advapi32

shlwapi

gdi32

user32

comctl32

Sections

.textbss Size: 4KB - Virtual size: 86KB

.text Size: 156KB - Virtual size: 156KB

.rsrc Size: 1KB - Virtual size: 1KB

.textbss
Size: 4KB - Virtual size: 86KB

.text
Size: 156KB - Virtual size: 156KB

.rsrc
Size: 1KB - Virtual size: 1KB