64caa0f9cd251925528d39f966d0f01c0ff7bdacb5676c4e1cbbbaa267e4bace

Sharing

Copy URL Twitter E-mail

General

Target

64caa0f9cd251925528d39f966d0f01c0ff7bdacb5676c4e1cbbbaa267e4bace
Size

260KB
MD5

04b8f8930ecd2bc564d9540ff6b4b1a6
SHA1

d03e1957615bdc33e88ce7f3c88ecc63b0ec8d3f
SHA256

64caa0f9cd251925528d39f966d0f01c0ff7bdacb5676c4e1cbbbaa267e4bace
SHA512

9c900c0d6d1a56175bb2d106a52b747a233666ab0dd6df97b8542a15b83b9691a9338ba5deb03ba2c5d3d57f314f5b4ef3360d57b9f9f1d85b6221248f5a9531
SSDEEP

6144:EOHuFboyWwjr6Y9elEw/K08QQlc7izf3F4A8vEtyqcT:EOOFgwjOYyqHp7sE5+

Score

N/A

Malware Config

Signatures

Files

64caa0f9cd251925528d39f966d0f01c0ff7bdacb5676c4e1cbbbaa267e4bace
.exe windows x86

1d7cb4364df7c167a6b72d0018cb1a1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

I_RpcGetBuffer
RpcAsyncGetCallStatus
RpcNsBindingInqEntryNameW
I_RpcBindingInqDynamicEndpointA
NdrRpcSsDisableAllocate
NdrCStdStubBuffer2_Release
RpcSmAllocate
NdrSimpleStructBufferSize

secur32

SetContextAttributesA
LsaGetLogonSessionData
LsaDeregisterLogonProcess
QuerySecurityPackageInfoA
ImpersonateSecurityContext
GetComputerObjectNameW
LsaRegisterLogonProcess
GetUserNameExA
LsaConnectUntrusted

oleaut32

VarI1FromBool
VarDecInt
VarUI8FromI1
VarBstrFromUI1
VarR8FromDisp
VarI4FromDec
VarCyCmp

rasapi32

RasGetAutodialAddressW
RasSetAutodialParamW
RasSetAutodialAddressW
RasGetErrorStringA
RasGetSubEntryHandleW
RasGetProjectionInfoA
RasEnumAutodialAddressesA
RasHangUpW
RasSetEntryDialParamsW
RasEnumConnectionsW

ole32

CoCreateInstance
OleCreateLinkToFile
OleCreateFromData
CoRevokeInitializeSpy
CoTestCancel
CoGetCallContext
CoRevokeClassObject
SetConvertStg
StgOpenStorageOnILockBytes
OleRegEnumFormatEtc
CoGetCurrentLogicalThreadId

shell32

SHAppBarMessage
ord240
ord129
SHFileOperationW
ord154
ExtractIconExW
SHGetDesktopFolder
ord701
ord688
ord21

imm32

ImmSetCompositionStringA
ImmGetCandidateListA
ImmSetConversionStatus
ImmInstallIMEW
ImmUnregisterWordW
ImmGetImeMenuItemsW
ImmRegisterWordW
ImmGetContext
ImmInstallIMEA
ImmAssociateContext
ImmNotifyIME

glu32

gluDisk
gluNewNurbsRenderer
gluGetNurbsProperty
gluUnProject
gluBeginPolygon
gluPerspective
gluBeginSurface
gluQuadricCallback
gluLoadSamplingMatrices
gluEndPolygon
gluNurbsSurface

opengl32

glRasterPos3fv
glTexCoord3iv
wglRealizeLayerPalette
glPushName
glArrayElement

msvcrt

strchr
towupper
sprintf
wcschr
isxdigit
islower
toupper
_mbctoupper
_exit
isspace
swscanf
iswlower

wininet

HttpSendRequestW
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoW
FtpOpenFileW
FtpOpenFileA

shlwapi

ord29
PathRemoveFileSpecW
ord10
PathIsURLA
PathRelativePathToA
ord15
IsCharSpaceA
PathMatchSpecW
ord8
PathIsFileSpecA
PathIsUNCServerA
PathIsLFNFileSpecW
PathFindExtensionW
PathIsNetworkPathW
ord7
PathAddExtensionA

comctl32

ImageList_ReplaceIcon
ImageList_Create
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_Read
PropertySheetA
ImageList_GetIcon
InitCommonControlsEx
ImageList_Destroy
CreateStatusWindowW

kernel32

GetSystemTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
CreateProcessA
GetCurrentThreadId
FreeResource
GetComputerNameW
FindResourceExA
CreateEventW
GetLocaleInfoW
SetFileAttributesW
OutputDebugStringW
GetCurrentProcess
TerminateProcess

gdi32

GetBitmapBits
CloseEnhMetaFile
CreateBitmap
GetMapMode
CreateBitmapIndirect
GetTextExtentPoint32W
ScaleViewportExtEx
StretchBlt
RoundRect
SetRectRgn
OffsetRgn
GetTextExtentPointW

comdlg32

GetOpenFileNameA
FindTextA
PrintDlgW
PrintDlgExA
ChooseColorW
ChooseFontA
ChooseFontW
CommDlgExtendedError
GetFileTitleA
FindTextW
PrintDlgExW
GetSaveFileNameA

advapi32

ReadEventLogW
CredEnumerateA
AccessCheckByTypeAndAuditAlarmW
ImpersonateSelf
EncryptFileA
BuildExplicitAccessWithNameW
CreateServiceA
LsaRetrievePrivateData
SetEntriesInAclW
RegCreateKeyA

Exports

Exports

BlatBatsLipegatslavalearminxCurtzipxi
HermDormKeirjefeGeumWhaprodeDaftZoonsopsBirlSabsprowBotanthye
LimyGoesOgamkoannologinsDiffLimasat
LitePupsSoullobofirmrote
PartBrincainEwerSurfHautbarmHutsSardThanSacsWackWoldSarkwaget
StudGuckDossGladGedsloof
WolfLaicTakaBackGushDogsAvosbiffloosdameitsox
YillMurabirlSicsDovevow

Sections

.text
Size: - Virtual size: 512B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d7cb4364df7c167a6b72d0018cb1a1c

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

secur32

oleaut32

rasapi32

ole32

shell32

imm32

glu32

opengl32

msvcrt

wininet

shlwapi

comctl32

kernel32

gdi32

comdlg32

advapi32

Exports

Exports

Sections

.text Size: - Virtual size: 512B

.rdata Size: 246KB - Virtual size: 246KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: - Virtual size: 512B

.rdata
Size: 246KB - Virtual size: 246KB

.reloc
Size: 12KB - Virtual size: 12KB