8e0c553e6b5a8d861735c9dfafd39addf28534fd14abf364ef22155d8afd5b04

Sharing

Copy URL Twitter E-mail

General

Target

8e0c553e6b5a8d861735c9dfafd39addf28534fd14abf364ef22155d8afd5b04
Size

138KB
MD5

3de0c0b6a2f291e319998eccea029bde
SHA1

628a4542916a76f5050386b93b26aeaeaa16c6a4
SHA256

8e0c553e6b5a8d861735c9dfafd39addf28534fd14abf364ef22155d8afd5b04
SHA512

cf4a0d1486ac591f2ec150987a6753f354f4b45cdf7fd4a31d87ed0a5cad95faea8ce73afc8713c234ddc82159f347272b10452918c1616fb4dd18e00c8e3666
SSDEEP

3072:HAVcBenFMa35H2Plc0hQYffyoXCbMQKZwTo/TEIKNGWwW21Nq8ys/N:HA5MEH8QYffCTo/AIyGWw7tysV

Score

N/A

Malware Config

Signatures

Files

8e0c553e6b5a8d861735c9dfafd39addf28534fd14abf364ef22155d8afd5b04
.exe windows x86

b2685bbad9a3307875dbb970d0fb5317

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
LoadLibraryW
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
MoveFileExW
GetVolumeNameForVolumeMountPointW
Thread32First
GetFileInformationByHandle
GetSystemTime
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
lstrcmpiA
TlsGetValue
TlsSetValue
TerminateProcess
ResetEvent
GlobalLock
GlobalUnlock
CreateRemoteThread
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetLocalTime
WTSGetActiveConsoleSessionId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
SetThreadPriority
GetCurrentThread
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
CreateDirectoryW
HeapFree
SetFilePointerEx
GetNativeSystemInfo
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
ReleaseMutex
GetCurrentThreadId
GetUserDefaultUILanguage
GetFileAttributesW
DeleteFileW
GetTickCount
LoadLibraryA
FreeLibrary
GetProcessId
EnterCriticalSection
VirtualAlloc
LeaveCriticalSection
InitializeCriticalSection
SetThreadContext
GetThreadContext
WriteProcessMemory
LocalFree
GetCurrentProcessId
CloseHandle
DuplicateHandle
OpenEventW
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetVersionExW
Sleep
VirtualFreeEx
VirtualFree
SetEvent
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetCommandLineW
ExitProcess
GetFileAttributesExW
lstrcmpiW
GetProcAddress
FileTimeToLocalFileTime
GetModuleHandleW

user32

GetClassLongW
GetWindowRect
CharToOemW
GetWindowLongW
CharLowerA
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
GetSystemMetrics
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
GetAncestor
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
DrawIcon
GetIconInfo
ExitWindowsEx
GetKeyboardState
GetMessageA
GetUpdateRgn
GetMessageW
RegisterClassExA
GetWindowDC
SetCapture
DefDlgProcW
SetWindowPos
MapVirtualKeyW
IsWindow
MapWindowPoints
RegisterWindowMessageW
GetMenuItemID
SetKeyboardState
GetSubMenu
MenuItemFromPoint
GetMenu
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
EndMenu
GetWindowThreadProcessId
GetShellWindow
SendInput
GetParent
GetForegroundWindow
InvalidateRect
MsgWaitForMultipleObjects
ToUnicode
FillRect
PostMessageW
CharLowerW
OpenDesktopW
WindowFromPoint
DrawEdge
IntersectRect
PostThreadMessageW
RegisterClassA
DefFrameProcW
EqualRect
PrintWindow
SendMessageW
IsRectEmpty
DefFrameProcA
OpenInputDesktop
BeginPaint
GetUpdateRect
GetDC
GetCapture
TranslateMessage
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
GetDCEx
PeekMessageA
ReleaseDC
DefWindowProcA
GetCursorPos
DefMDIChildProcW
SwitchDesktop
CharLowerBuffA
GetTopWindow
LoadImageW
EndPaint
GetMessagePos
DefWindowProcW
CallWindowProcW
SetWindowTextW
CallWindowProcA
RegisterClassW
ReleaseCapture
DefMDIChildProcA
DefDlgProcA
GetWindowInfo

advapi32

IsWellKnownSid
GetLengthSid
ConvertSidToStringSidW
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
RegEnumKeyExW
EqualSid
InitiateSystemShutdownExW

shlwapi

PathRemoveBackslashW
PathQuoteSpacesW
PathIsURLW
StrCmpNIW
StrStrIW
StrStrIA
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveFileSpecW
PathRenameExtensionW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleDC
SetRectRgn
SaveDC
DeleteDC
SetViewportOrgEx
RestoreDC
CreateDIBSection
GetDeviceCaps
GetDIBits
CreateCompatibleBitmap
GdiFlush
SelectObject
DeleteObject

ws2_32

accept
listen
WSASetLastError
freeaddrinfo
socket
bind
recv
WSAEventSelect
recvfrom
sendto
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
getsockname
shutdown
WSAGetLastError
getpeername
WSASend
closesocket
send
setsockopt

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2685bbad9a3307875dbb970d0fb5317

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 5KB - Virtual size: 5KB