cd5704989486e6f4439682418e0db4914ce06fc1fa6fe45674e802ee9281b18d

Sharing

Copy URL

Twitter E-mail

General

Target

cd5704989486e6f4439682418e0db4914ce06fc1fa6fe45674e802ee9281b18d
Size

1.6MB
MD5

05a299552f14f8c5f9fd449c60b9e7ee
SHA1

0cb1fe95a8a3444bc50e3ee8f587043d3bdc5ebb
SHA256

cd5704989486e6f4439682418e0db4914ce06fc1fa6fe45674e802ee9281b18d
SHA512

824052e41cfefcdb7e6a944f18ff264594bba5dd1b39e7139e71ef31b55eab9671204e5d53ffdc91a47d16087277f9551dd26c376effecccf3cdc73e02c4b2fc
SSDEEP

49152:TL+bXrgP0+/1y8f58bsY0ySLHkW+dCXP4sm/xtl:HObgPJBVtVLHkWA1/

Score

N/A

Malware Config

Signatures

Files

cd5704989486e6f4439682418e0db4914ce06fc1fa6fe45674e802ee9281b18d
.dll regsvr32 windows x86

6da57587bc3c27f054e9badd43e1aec5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

ObtainUserAgentString
IsValidURL
URLDownloadToFileW

wininet

InternetConnectA
InternetOpenA
InternetCrackUrlA
InternetCrackUrlW
InternetGetConnectedState
InternetGetCookieW
FindCloseUrlCache
FindNextUrlCacheEntryW
InternetQueryOptionW
FindFirstUrlCacheEntryW
InternetCloseHandle
InternetErrorDlg
HttpQueryInfoA
HttpSendRequestW
HttpOpenRequestA
InternetConnectW
InternetOpenW
InternetSetOptionW
HttpAddRequestHeadersA
DeleteUrlCacheEntryW
InternetReadFile

shlwapi

UrlEscapeA
PathIsRelativeW
PathFindFileNameW
UrlUnescapeW
SHDeleteKeyW
SHCopyKeyW
PathIsDirectoryW
PathCreateFromUrlW
PathAppendW
PathIsNetworkPathW
PathStripPathW
UrlIsW
PathRemoveFileSpecW
PathFileExistsW

rpcrt4

UuidFromStringW
RpcStringFreeW
UuidCreate
UuidToStringW

setupapi

SetupIterateCabinetW

dbghelp

SymInitialize
SymSetOptions
SymGetOptions
SymCleanup
StackWalk
SymFunctionTableAccess
SymGetModuleBase

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
WideCharToMultiByte
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
lstrcmpiW
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
Sleep
lstrcpyW
LocalFree
GlobalAlloc
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
lstrlenA
DeleteFileW
CopyFileW
GlobalFree
GlobalHandle
GetCurrentProcessId
FindNextFileW
FindClose
WaitForSingleObject
ReleaseMutex
CreateMutexA
CloseHandle
GetFullPathNameW
FindFirstFileW
GetFileAttributesExW
GetVersionExW
GetCurrentThread
RemoveDirectoryW
ExitProcess
GetTickCount
SetFileAttributesW
MoveFileW
CreateEventW
SetEvent
CreateThread
CreateMutexW
WriteFile
CreateFileW
DisableThreadLibraryCalls
LoadLibraryA
GlobalDeleteAtom
GlobalAddAtomW
GlobalGetAtomNameW
TerminateThread
ResumeThread
SetThreadPriority
LocalAlloc
GetFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
OutputDebugStringW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Module32NextW
Module32FirstW
TerminateProcess
GetShortPathNameW
GlobalGetAtomNameA
ReadFile
GetFileSize
QueueUserWorkItem
SetUnhandledExceptionFilter
ReadProcessMemory
IsBadCodePtr
IsBadReadPtr
WinExec
GetSystemTime
OpenThread
CreateProcessW
MoveFileExW
SetCurrentDirectoryW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
VirtualQuery
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GlobalAddAtomA
VirtualAlloc
InterlockedExchange
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
ExitThread
GetCommandLineA
HeapCreate
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCPInfo
GetACP
GetOEMCP
CreateFileA
IsValidCodePage
LCMapStringW
LCMapStringA
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
IsProcessorFeaturePresent
CreateDirectoryW
VirtualFree

user32

RemoveMenu
GetMenuItemCount
CreatePopupMenu
IsMenu
GetDlgCtrlID
IsWindowEnabled
GetMenu
PtInRect
GetMenuItemInfoW
GetCapture
GetAsyncKeyState
GetCursorPos
GetKeyState
TrackPopupMenu
DestroyMenu
DrawEdge
DestroyIcon
SetWindowRgn
UpdateWindow
LoadImageW
OffsetRect
FrameRect
GetWindowDC
CopyRect
MapWindowPoints
GetMessagePos
GetSystemMetrics
FindWindowW
FindWindowExW
GetIconInfo
SetCursor
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetWindowThreadProcessId
MessageBoxW
CreateAcceleratorTableW
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
GetWindowRgnBox
ValidateRect
AppendMenuW
SetActiveWindow
LoadBitmapW
GetActiveWindow
FillRect
ReleaseCapture
GetDlgItem
IsChild
SetCapture
InvalidateRgn
ScreenToClient
GetSysColor
DialogBoxIndirectParamW
IsRectEmpty
CharUpperBuffW
SetWindowsHookExW
EnumChildWindows
CallNextHookEx
UnhookWindowsHookEx
SetLayeredWindowAttributes
PeekMessageW
TranslateMessage
DispatchMessageW
UpdateLayeredWindow
GetAncestor
ClientToScreen
EnumWindows
GetClassNameW
PostMessageW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
EqualRect
LoadCursorW
IsWindow
GetParent
GetWindow
SetFocus
KillTimer
SetTimer
RedrawWindow
IsWindowVisible
ShowWindow
InvalidateRect
ReleaseDC
GetDC
GetClientRect
GetWindowRect
SetWindowPos
SendMessageW
GetWindowLongW
SetWindowLongW
DestroyWindow
CharLowerBuffW
CharNextW
DialogBoxParamW
wsprintfW
SendMessageTimeoutW
GetLayeredWindowAttributes
SubtractRect
SetRect
SetParent
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
EnableWindow
DrawTextW
SetDlgItemTextW
SetWindowContextHelpId
MapDialogRect
EndDialog
AttachThreadInput
GetMessageW
CreateDialogParamW
MonitorFromWindow
GetMonitorInfoW
SystemParametersInfoW
EndPaint
AdjustWindowRectEx
UnregisterClassA
MoveWindow

gdi32

CombineRgn
CreateBrushIndirect
GetPixel
StretchBlt
SetBkColor
SetTextColor
SetViewportOrgEx
CreatePatternBrush
GetTextMetricsW
CreateRectRgn
SelectClipRgn
CreateSolidBrush
TextOutW
SaveDC
CreatePen
GetObjectW
ExcludeClipRect
ExtTextOutW
GetTextExtentPoint32W
CreateFontW
CreateDIBSection
GetDeviceCaps
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
RestoreDC
CreateRectRgnIndirect
LineTo
MoveToEx
DeleteDC
GetTextExtentPointW
DeleteObject
SelectObject
SetBkMode
CreateFontIndirectW

shell32

DragQueryFileW
SHFileOperationW
ShellExecuteW
DoEnvironmentSubstW

ole32

StringFromGUID2
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoCreateGuid
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
ReleaseStgMedium
RegisterDragDrop
CoTaskMemFree
OleDraw

oleaut32

SysStringLen
SysFreeString
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
VarBstrCmp
VariantInit
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantCopy
VariantChangeType
OleCreateFontIndirect
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
DispCallFunc
CreateDispTypeInfo
DispGetIDsOfNames
DispInvoke
SafeArrayDestroy
SafeArrayCreateVector
UnRegisterTypeLi
RegisterTypeLi
VarBstrCat

crypt32

CertFreeCertificateContext
CryptMsgClose
CryptQueryObject
CertFindCertificateInStore
CertCompareCertificate
CryptMsgGetParam
CryptVerifyDetachedMessageSignature
CryptStringToBinaryW
CertCloseStore

wintrust

WinVerifyTrust

psapi

GetModuleBaseNameW

Exports

Exports

AfterUpdateHook
AttachProxyInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EnablePosBHO
FixToolbar1163
FixTypeLib
ShowIE9Popup
TBCOM_GetComponent
raw_CheckRedirection
raw_IsWellFormedXML
raw_ParseIndependentVars
raw_ReportError

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6da57587bc3c27f054e9badd43e1aec5

Headers

File Characteristics

Imports

urlmon

wininet

shlwapi

rpcrt4

setupapi

dbghelp

version

kernel32

user32

gdi32

shell32

ole32

oleaut32

crypt32

wintrust

psapi

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 327KB - Virtual size: 326KB

.data Size: 46KB - Virtual size: 62KB

.SHARED Size: 7KB - Virtual size: 7KB

.rsrc Size: 126KB - Virtual size: 126KB

.reloc Size: 103KB - Virtual size: 102KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 327KB - Virtual size: 326KB

.data
Size: 46KB - Virtual size: 62KB

.SHARED
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 126KB - Virtual size: 126KB

.reloc
Size: 103KB - Virtual size: 102KB