e5c4010dd0ba1f721f08c2386d23578b3254a9b5c08742bbfc8ea7957370af7f

Sharing

Copy URL Twitter E-mail

General

Target

e5c4010dd0ba1f721f08c2386d23578b3254a9b5c08742bbfc8ea7957370af7f
Size

140KB
MD5

a77276398af8ef92842b6b4b666bffcb
SHA1

9f2f5f5b6ec8d98289ed379ce756ac312c478365
SHA256

e5c4010dd0ba1f721f08c2386d23578b3254a9b5c08742bbfc8ea7957370af7f
SHA512

57280ad330cc67f01474db950496dc7bc9104bb42b2d781523475095684f9a8c687e4a51875d452c76fde730d30bfe968ca32f56645bba77449852af75e84365
SSDEEP

3072:VHBo78fSWOxj/MVs+qohNVhsAOTuQsW5wO4ucIYMmI:Vho7jDj/cbBOTu1W51cI9m

Score

N/A

Malware Config

Signatures

Files

e5c4010dd0ba1f721f08c2386d23578b3254a9b5c08742bbfc8ea7957370af7f
.dll windows x86

4d2091c0349865aa2d8e1601ea4228f5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
WritePrivateProfileStringA
GlobalDeleteAtom
GlobalAddAtomA
UnmapViewOfFile
GetPrivateProfileStringA
GetTempPathA
MapViewOfFile
GetCurrentThreadId
GetCurrentProcessId
GlobalAlloc
GlobalFree
FreeLibrary
GetProfileStringA
LoadLibraryA
CreateFileMappingA
WriteFile
GetProfileIntA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetProcessHeap
GetVersion
GetVersionExA
LocalAlloc
LocalFree
LoadLibraryExA
DeviceIoControl
GetPrivateProfileIntA
InitializeCriticalSection
DeleteCriticalSection
GetSystemDirectoryA
ReadFile
EnterCriticalSection
CloseHandle
CreateFileA
DisableThreadLibraryCalls
LeaveCriticalSection
Sleep
SetLastError
GetModuleHandleA
GetProcAddress
WriteProfileStringA
lstrlenA
GetLastError
GetFileType
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
RtlUnwind
GetStdHandle
SetHandleCount
GetCurrentProcess
TerminateProcess
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
ExitProcess
VirtualFree
HeapCreate
HeapDestroy
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCommandLineA
GetFileAttributesA
CreateDirectoryA

user32

FindWindowA
GetActiveWindow
PostMessageA
SendMessageA
MessageBeep
LoadStringA
wsprintfA
PeekMessageA
DispatchMessageA
TranslateMessage

winspool.drv

EnumPrintersA
StartDocPrinterA
EndDocPrinter
StartPagePrinter
GetPrintProcessorDirectoryA
DeletePrintProcessorA
EnumPrintProcessorDatatypesA
EnumPrintProcessorsA
AddPrintProcessorA
PrinterProperties
DeviceCapabilitiesA
DocumentPropertiesA
GetPrinterDataW
GetPrinterDataA
SetPrinterDataW
SetPrinterDataA
DeletePrinterConnectionA
ConnectToPrinterDlg
AbortPrinter
DeletePrinter
EndPagePrinter
SetPrinterA
GetPrinterA
AddPrinterA
ClosePrinter
EnumMonitorsA
DeleteMonitorA
AddMonitorA
ConfigurePortA
DeletePortA
AddPortA
EnumPortsA
EnumJobsA
SetJobA
GetJobA
AddJobA
ScheduleJob
FindClosePrinterChangeNotification
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
EnumPrinterDriversA
GetPrinterDriverDirectoryA
DeletePrinterDriverA
GetPrinterDriverA
AddPrinterDriverA
ReadPrinter
WritePrinter
OpenPrinterA

advapi32

RegCreateKeyA
RegCreateKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegSetValueExA
RegOpenKeyA
RegEnumValueA
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyA
RegDeleteValueA
GetUserNameA

Exports

Exports

AbortPrinter
AddJobA
AddMonitorA
AddPortA
AddPrintProcessorA
AddPrinterA
AddPrinterDriverA
ClosePrinter
ConfigurePortA
ConnectToPrinterDlg
DeleteMonitorA
DeletePortA
DeletePrintProcessorA
DeletePrinter
DeletePrinterConnectionA
DeletePrinterDataExA
DeletePrinterDriverA
DeletePrinterKeyA
DeviceCapabilitiesA
DeviceIoControl
DocumentPropertiesA
EndDocPrinter
EndPagePrinter
EnumJobsA
EnumMonitorsA
EnumPortsA
EnumPrintProcessorDatatypesA
EnumPrintProcessorsA
EnumPrinterDataExA
EnumPrinterDriversA
EnumPrinterKeyA
EnumPrintersA
FindClosePrinterChangeNotification
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
GetJobA
GetPrintProcessorA
GetPrintProcessorDirectoryA
GetPrinterA
GetPrinterDataA
GetPrinterDataExA
GetPrinterDriverA
GetPrinterDriverDirectoryA
GetUserNameA
InitializeMonitorEx
IsProcessorFeaturePresent
OpenPrinterA
PrinterProperties
ReadPrinter
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ScheduleJob
SetJobA
SetPrinterA
SetPrinterDataA
SetPrinterDataExA
StartDocPrinterA
StartPagePrinter
WritePrinter
ZSP_BrowseDialog
ZSP_GetMonitor
ZSP_GetObjectType
ZSP_GetSharePath
ZSP_InitializeMonitor
ZSP_LoadDriverLibraryEx
ZSP_MakeSpoolFilePath
ZSP_ShareAsDialog
ZSP_StructCopy
s2ANSI
s2ByteLength
s2ClosePrinter
s2Disable
s2Enable
s2EnumLocalPrinterDrivers
s2EnumLocalPrinters
s2GetJob
s2GetModuleHandle
s2GetPrinter
s2GetPrinterData
s2GetPrinterDriver
s2IsJobCancelled
s2Native
s2OpenPrinter
s2Set
s2SetJob
s2SetPort
s2SetPrinterData
s2Something
s2StartDocPrinter
zlmGetControlInt
zlmGetControlString

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d2091c0349865aa2d8e1601ea4228f5

Headers

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 48KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 64KB - Virtual size: 62KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 52KB - Virtual size: 48KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 64KB - Virtual size: 62KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 4KB