2a3ab3ee903d885a8152defa841e6748e5ffb52ad472ad68307a3fd3840cb0dc

Sharing

Copy URL Twitter E-mail

General

Target

2a3ab3ee903d885a8152defa841e6748e5ffb52ad472ad68307a3fd3840cb0dc
Size

981KB
MD5

26862248d917731eae8f8c9ad73a6cc0
SHA1

4e836ac3b342d1490c3c415c0e4ab742c45e6feb
SHA256

2a3ab3ee903d885a8152defa841e6748e5ffb52ad472ad68307a3fd3840cb0dc
SHA512

8190969332b16040dfc654b76cd331edd1b572b73baaafce402c40706b3441ad10fc146be70cb36ab1059d549917a06795bb87a3ba5c4d9ee6d085de279cbc15
SSDEEP

24576:G6DAtqamBAfx6rp9XYXkLHgZpJEjekoCH:GKAtqamBAfx6rTIXkLHkJESkoG

Score

N/A

Malware Config

Signatures

Files

2a3ab3ee903d885a8152defa841e6748e5ffb52ad472ad68307a3fd3840cb0dc
.exe windows x86

76bfd3b866c52c1b0ab837f55d036a1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
wcscat_s
_vsnprintf
_CIsqrt
memmove
_snwprintf_s
wcsncat_s
_vsnprintf_s
bsearch
memcpy
_wtoi
_ftime64_s
_localtime64_s
_snprintf_s
_beginthreadex
_endthreadex
strncpy_s
vswprintf_s
_set_invalid_parameter_handler
swscanf_s
wcstok_s
_vsnwprintf_s
wcscpy_s
wcsstr
_ultow_s
wcstod
localeconv
wcsncmp
_wcsnicmp
calloc
wcstoul
wcstol
_set_errno
_get_errno
_ltow_s
wcspbrk
wcsrchr
_HUGE
wcschr
realloc
malloc
_beginthread
_recalloc
wcsncpy_s
memmove_s
memset
_wcslwr_s
swprintf_s
free
memcpy_s
__CxxFrameHandler3
_CxxThrowException
_wcsicmp

atl90

ord64
ord15
ord31
ord61
ord23
ord30
ord58
ord24
ord43
ord44
ord10
ord32
ord11

advapi32

FreeSid
TraceEvent
CryptAcquireContextA
RegEnumKeyW
RegQueryInfoKeyW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
RegQueryValueExA
RegisterTraceGuidsA
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
CryptDestroyHash
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
CryptGenRandom
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptReleaseContext
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
DeregisterEventSource
ReportEventW
OpenThreadToken
UnregisterTraceGuids
RegOpenKeyExA
ConvertSidToStringSidA
CreateWellKnownSid
IsValidSid
EqualSid
CheckTokenMembership
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
CopySid
AllocateAndInitializeSid
RegisterEventSourceW

gdi32

CreateSolidBrush
DeleteObject
DeleteDC
GetDeviceCaps
CreateDCA

kernel32

CreateFileW
GetSystemTime
OutputDebugStringW
CreateProcessW
IsDebuggerPresent
GetTimeFormatW
DebugBreak
GetUserDefaultUILanguage
GetTempPathW
GetTimeZoneInformation
IsWow64Process
GetVersionExW
TerminateProcess
GetCommandLineW
ReadFile
FlushFileBuffers
CopyFileW
SetFilePointer
GetStringTypeW
FileTimeToSystemTime
GetNumberFormatW
GetCurrencyFormatW
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SetEndOfFile
EnumSystemLocalesW
QueryPerformanceFrequency
GetSystemInfo
GetDateFormatW
SetUnhandledExceptionFilter
SleepEx
CancelIo
ReadDirectoryChangesW
SetProcessShutdownParameters
LoadLibraryA
GetProcessHeap
VirtualAlloc
HeapSetInformation
HeapUnlock
HeapLock
ExpandEnvironmentStringsW
GetProcessTimes
CreateEventA
GlobalFree
CreateMutexA
OpenMutexA
CreateSemaphoreA
CreateFileMappingA
GetShortPathNameA
GetModuleFileNameA
GlobalAlloc
VirtualFree
GetSystemDefaultLCID
GetModuleHandleExW
RtlCaptureStackBackTrace
GetSystemTimeAsFileTime
GetLocalTime
SetFileAttributesW
GetSystemDirectoryW
IsValidLocale
GetDiskFreeSpaceExW
CreateProcessA
IsDBCSLeadByte
GetStringTypeExW
IsValidCodePage
GetFileType
LoadLibraryExW
GetCurrentThread
GetUserDefaultLangID
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
EnumUILanguagesW
GetCalendarInfoW
VirtualProtect
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
UnhandledExceptionFilter
EncodePointer
DecodePointer
GetFileSize
VirtualQuery
FlushInstructionCache
GetCurrentProcess
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
CloseHandle
FindClose
FreeLibrary
GlobalDeleteAtom
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalFree
MultiByteToWideChar
GetDriveTypeW
lstrlenW
FormatMessageW
LocalAlloc
UnmapViewOfFile
WaitForSingleObject
GlobalGetAtomNameW
OpenEventW
GlobalAddAtomW
FindFirstFileW
FindNextFileW
FindAtomW
DuplicateHandle
CreateMutexW
lstrlenA
ReleaseMutex
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCurrentProcessId
OpenProcess
OpenMutexW
SetEvent
CreateEventW
WaitForMultipleObjects
DeleteFileW
Sleep
TerminateThread
ResetEvent
CreateThread
GetCurrentThreadId
WideCharToMultiByte
CompareStringW
GetUserDefaultLCID
CreateSemaphoreW
GetVersionExA
TlsSetValue
TlsGetValue
InitializeCriticalSection
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
QueryPerformanceCounter
CreateDirectoryW
WriteFile
SystemTimeToFileTime
GetLocaleInfoW
RaiseException
TlsFree
TlsAlloc
GetTickCount

ole32

CLSIDFromString
CoCreateInstance
IIDFromString
CoInitializeEx
OleUninitialize
OleInitialize
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject
StringFromCLSID
CoCreateFreeThreadedMarshaler
StringFromIID
CoTaskMemFree
CoCreateGuid
StringFromGUID2
CLSIDFromProgID

oleaut32

LoadRegTypeLi
SafeArrayCreateVector
LoadTypeLibEx
VariantCopyInd
VariantCopy
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SafeArrayGetVartype
SafeArrayAccessData
SetErrorInfo
GetErrorInfo
SafeArrayUnaccessData
VariantClear
VariantInit
SysFreeString
SysReAllocStringLen
SysStringLen
SysAllocStringLen
SysAllocString

shell32

SHChangeNotify
SHGetPathFromIDListW
SHGetDataFromIDListW
SHGetFileInfoW
ShellExecuteExW
SHGetDesktopFolder
ShellExecuteW
SHGetFolderPathW
SHGetFolderLocation
SHGetSpecialFolderPathW
SHGetMalloc

shlwapi

PathIsRootW
PathFileExistsW
UrlGetPartW
PathRemoveBackslashW
PathIsUNCW
PathCreateFromUrlW
PathIsDirectoryW
StrCmpIW
PathIsUNCServerW
PathIsUNCServerShareW
PathFindFileNameW
PathCombineW
PathFindExtensionW
PathAddBackslashW
PathStripPathW
PathRemoveFileSpecW
PathRemoveExtensionW
PathSearchAndQualifyW

user32

UnregisterClassA
EnumDisplayMonitors
GetMonitorInfoA
GetSysColor
GetKeyboardLayoutList
GetMenuCheckMarkDimensions
MsgWaitForMultipleObjectsEx
MessageBoxW
RegisterClassExW
GetClassInfoExW
GetWindowLongW
SetWindowLongW
SetCursor
LoadCursorW
SendMessageW
GetClassNameW
GetWindowThreadProcessId
PostMessageW
SetTimer
KillTimer
DestroyWindow
CreateWindowExW
RegisterWindowMessageW
DefWindowProcW
CallWindowProcW
DispatchMessageW
PeekMessageW
SetForegroundWindow
ShowWindowAsync
IsIconic
IsWindow
EnumWindows
CharLowerW
CharUpperW
GetSystemMetrics
SystemParametersInfoA
GetCursor
GetKeyboardLayout
ReleaseDC
GetDC
LoadStringW

rpcrt4

UuidCreate

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 667KB - Virtual size: 667KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 211KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ndata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

76bfd3b866c52c1b0ab837f55d036a1d

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

atl90

advapi32

gdi32

kernel32

ole32

oleaut32

shell32

shlwapi

user32

rpcrt4

Exports

Exports

Sections

.text Size: 667KB - Virtual size: 667KB

.data Size: 211KB - Virtual size: 252KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 33KB - Virtual size: 33KB

.ndata Size: 60KB - Virtual size: 60KB

.text
Size: 667KB - Virtual size: 667KB

.data
Size: 211KB - Virtual size: 252KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 33KB - Virtual size: 33KB

.ndata
Size: 60KB - Virtual size: 60KB