8250e36bf3e305404c5726b9199b560654f470744b8f0fefd456587470ff2112

Sharing

Copy URL Twitter E-mail

General

Target

8250e36bf3e305404c5726b9199b560654f470744b8f0fefd456587470ff2112
Size

260KB
MD5

87eec4c6b538ea0e2c98355ea8262538
SHA1

d991b3045b26be3ceca63cf57c5751710bb1735c
SHA256

8250e36bf3e305404c5726b9199b560654f470744b8f0fefd456587470ff2112
SHA512

a43b97c6bb56ecdea292770ee21ef527e5500982694c1aab98e5cc2772c1df8ebea6c9f6c033fac05f5cecaf14f81d20129c2d008169be8d485dabb5c3ac3842
SSDEEP

6144:EOH/FboyWwjr6Y9elEY/K08QQlc7izf3F4A8vEtyqcT:EOfFgwjOYCqHp7sE5+

Score

N/A

Malware Config

Signatures

Files

8250e36bf3e305404c5726b9199b560654f470744b8f0fefd456587470ff2112
.exe windows x86

1d7cb4364df7c167a6b72d0018cb1a1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

I_RpcGetBuffer
RpcAsyncGetCallStatus
RpcNsBindingInqEntryNameW
I_RpcBindingInqDynamicEndpointA
NdrRpcSsDisableAllocate
NdrCStdStubBuffer2_Release
RpcSmAllocate
NdrSimpleStructBufferSize

secur32

SetContextAttributesA
LsaGetLogonSessionData
LsaDeregisterLogonProcess
QuerySecurityPackageInfoA
ImpersonateSecurityContext
GetComputerObjectNameW
LsaRegisterLogonProcess
GetUserNameExA
LsaConnectUntrusted

oleaut32

VarI1FromBool
VarDecInt
VarUI8FromI1
VarBstrFromUI1
VarR8FromDisp
VarI4FromDec
VarCyCmp

rasapi32

RasGetAutodialAddressW
RasSetAutodialParamW
RasSetAutodialAddressW
RasGetErrorStringA
RasGetSubEntryHandleW
RasGetProjectionInfoA
RasEnumAutodialAddressesA
RasHangUpW
RasSetEntryDialParamsW
RasEnumConnectionsW

ole32

CoCreateInstance
OleCreateLinkToFile
OleCreateFromData
CoRevokeInitializeSpy
CoTestCancel
CoGetCallContext
CoRevokeClassObject
SetConvertStg
StgOpenStorageOnILockBytes
OleRegEnumFormatEtc
CoGetCurrentLogicalThreadId

shell32

SHAppBarMessage
ord240
ord129
SHFileOperationW
ord154
ExtractIconExW
SHGetDesktopFolder
ord701
ord688
ord21

imm32

ImmSetCompositionStringA
ImmGetCandidateListA
ImmSetConversionStatus
ImmInstallIMEW
ImmUnregisterWordW
ImmGetImeMenuItemsW
ImmRegisterWordW
ImmGetContext
ImmInstallIMEA
ImmAssociateContext
ImmNotifyIME

glu32

gluDisk
gluNewNurbsRenderer
gluGetNurbsProperty
gluUnProject
gluBeginPolygon
gluPerspective
gluBeginSurface
gluQuadricCallback
gluLoadSamplingMatrices
gluEndPolygon
gluNurbsSurface

opengl32

glRasterPos3fv
glTexCoord3iv
wglRealizeLayerPalette
glPushName
glArrayElement

msvcrt

strchr
towupper
sprintf
wcschr
isxdigit
islower
toupper
_mbctoupper
_exit
isspace
swscanf
iswlower

wininet

HttpSendRequestW
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoW
FtpOpenFileW
FtpOpenFileA

shlwapi

ord29
PathRemoveFileSpecW
ord10
PathIsURLA
PathRelativePathToA
ord15
IsCharSpaceA
PathMatchSpecW
ord8
PathIsFileSpecA
PathIsUNCServerA
PathIsLFNFileSpecW
PathFindExtensionW
PathIsNetworkPathW
ord7
PathAddExtensionA

comctl32

ImageList_ReplaceIcon
ImageList_Create
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_Read
PropertySheetA
ImageList_GetIcon
InitCommonControlsEx
ImageList_Destroy
CreateStatusWindowW

kernel32

GetSystemTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
CreateProcessA
GetCurrentThreadId
FreeResource
GetComputerNameW
FindResourceExA
CreateEventW
GetLocaleInfoW
SetFileAttributesW
OutputDebugStringW
GetCurrentProcess
TerminateProcess

gdi32

GetBitmapBits
CloseEnhMetaFile
CreateBitmap
GetMapMode
CreateBitmapIndirect
GetTextExtentPoint32W
ScaleViewportExtEx
StretchBlt
RoundRect
SetRectRgn
OffsetRgn
GetTextExtentPointW

comdlg32

GetOpenFileNameA
FindTextA
PrintDlgW
PrintDlgExA
ChooseColorW
ChooseFontA
ChooseFontW
CommDlgExtendedError
GetFileTitleA
FindTextW
PrintDlgExW
GetSaveFileNameA

advapi32

ReadEventLogW
CredEnumerateA
AccessCheckByTypeAndAuditAlarmW
ImpersonateSelf
EncryptFileA
BuildExplicitAccessWithNameW
CreateServiceA
LsaRetrievePrivateData
SetEntriesInAclW
RegCreateKeyA

Exports

Exports

BlatBatsLipegatslavalearminxCurtzipxi
HermDormKeirjefeGeumWhaprodeDaftZoonsopsBirlSabsprowBotanthye
LimyGoesOgamkoannologinsDiffLimasat
LitePupsSoullobofirmrote
PartBrincainEwerSurfHautbarmHutsSardThanSacsWackWoldSarkwaget
StudGuckDossGladGedsloof
WolfLaicTakaBackGushDogsAvosbiffloosdameitsox
YillMurabirlSicsDovevow

Sections

.text
Size: - Virtual size: 512B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d7cb4364df7c167a6b72d0018cb1a1c

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

secur32

oleaut32

rasapi32

ole32

shell32

imm32

glu32

opengl32

msvcrt

wininet

shlwapi

comctl32

kernel32

gdi32

comdlg32

advapi32

Exports

Exports

Sections

.text Size: - Virtual size: 512B

.rdata Size: 246KB - Virtual size: 246KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: - Virtual size: 512B

.rdata
Size: 246KB - Virtual size: 246KB

.reloc
Size: 12KB - Virtual size: 12KB