6489c7ead54c3bf23733a516c3d43773666e445fc89876780ff47951218c9e5c

Sharing

Copy URL Twitter E-mail

General

Target

6489c7ead54c3bf23733a516c3d43773666e445fc89876780ff47951218c9e5c
Size

298KB
MD5

38f6cf77df31bbaa12cb65faf1486223
SHA1

21bdb64c58c365282886e4d49f3c9ab124554016
SHA256

6489c7ead54c3bf23733a516c3d43773666e445fc89876780ff47951218c9e5c
SHA512

f1ce7af9038edb150b641f2e2b40c115c86e0fdd139b73be0d3e9b319a3b9f24d6c208533a1613bb394e1d2ca3f8e7b221f4f656223858c04d0ca4c555cc9ca8
SSDEEP

6144:k6QcDGsSQMsYHDQAnwOYS2BiVqx394VpMolap/jyH6/:9rGscxHDQNtSHC9WDg

Score

N/A

Malware Config

Signatures

Files

6489c7ead54c3bf23733a516c3d43773666e445fc89876780ff47951218c9e5c
.exe windows x86

9b7fdaff652ec0eaf6eb6e53335d8e58

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetComputerNameW
OutputDebugStringW
TlsFree
GetSystemTimeAsFileTime
HeapSize
FindFirstFileW
TlsSetValue
SetThreadAffinityMask
CloseHandle
HeapAlloc
ResumeThread
ResetEvent
IsProcessorFeaturePresent
WriteProcessMemory
RegisterWaitForSingleObject
VirtualAllocEx
SetFilePointer
OpenFileMappingW
CreateThread
EnterCriticalSection
WaitForMultipleObjects
GetModuleHandleA
TlsAlloc
HeapDestroy
GetThreadContext
GetProcessAffinityMask
UnhandledExceptionFilter
LeaveCriticalSection
lstrcmpiW
CreateFileW
DuplicateHandle
FindClose
LockResource
SwitchToThread
FormatMessageW
UnmapViewOfFile
SizeofResource
GetTempPathW
OpenThread
UnregisterWaitEx
LoadLibraryExW
LoadResource
GetModuleHandleW
HeapReAlloc
TlsGetValue
DeleteFileW
GetThreadPriority
WideCharToMultiByte
WaitForSingleObject
FormatMessageA
GetCurrentThreadId
FreeEnvironmentStringsW
lstrlenW
OpenProcess
FindResourceExW
GlobalLock
ReadFile
SetUnhandledExceptionFilter
CreateProcessW
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetProcessHeap
RaiseException
SetLastError
LocalFree
GetSystemInfo
DeleteCriticalSection
FreeLibrary
SetEnvironmentVariableW
SuspendThread
FindResourceW
CreateEventW
LCMapStringW
LocalAlloc
HeapFree
MapViewOfFile
GetThreadLocale
ExpandEnvironmentStringsW
GlobalUnlock
GlobalAlloc
GetFileInformationByHandle

oleaut32

VariantClear
SysStringByteLen
VarUI4FromStr
SysStringLen
SysAllocStringByteLen
VarBstrCmp
VarBstrCat
SysFreeString
SysAllocStringLen
SysAllocString
VariantInit

ole32

CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoCreateGuid
CoUninitialize
StringFromCLSID
CoLockObjectExternal
CreateStreamOnHGlobal
CLSIDFromString
CoInitializeEx
CoTaskMemFree
CoCreateInstance

shell32

SHGetFolderPathW

advapi32

SetSecurityDescriptorDacl
IsValidSecurityDescriptor
RegCreateKeyExW
RegOpenKeyExA
RegQueryInfoKeyW
OpenProcessToken
PrivilegeCheck
RegEnumKeyExW
RegDeleteValueW
AddAccessAllowedAce
RegCloseKey
SetSecurityDescriptorOwner
DuplicateToken
RegOpenKeyExW
InitializeSecurityDescriptor
InitializeAcl
RegDeleteKeyW
RegSetValueExW
AllocateAndInitializeSid
LookupPrivilegeValueW
FreeSid
SetSecurityDescriptorGroup
RegQueryValueExW
GetLengthSid
AccessCheck
AdjustTokenPrivileges
RegQueryValueExA
RegConnectRegistryW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

PeekMessageW
CharNextW
LoadStringW
PostThreadMessageW
TranslateMessage
CharUpperBuffW
DispatchMessageW
GetMessageW
UpdateWindow

comctl32

CreateStatusWindow
ImageList_EndDrag
ImageList_DragEnter
DestroyPropertySheetPage
ImageList_LoadImage
ImageList_DragShowNolock
InitMUILanguage
DrawStatusTextA
LBItemFromPt

msrle32

DriverProc

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 74KB - Virtual size: 1012KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 142KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 708KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b7fdaff652ec0eaf6eb6e53335d8e58

Headers

File Characteristics

Imports

kernel32

oleaut32

ole32

shell32

advapi32

version

user32

comctl32

msrle32

Sections

.text Size: 14KB - Virtual size: 13KB

.bss Size: 74KB - Virtual size: 1012KB

.reloc Size: 142KB - Virtual size: 418KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 48KB - Virtual size: 708KB

.rsrc Size: 14KB - Virtual size: 19KB

.text
Size: 14KB - Virtual size: 13KB

.bss
Size: 74KB - Virtual size: 1012KB

.reloc
Size: 142KB - Virtual size: 418KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 48KB - Virtual size: 708KB

.rsrc
Size: 14KB - Virtual size: 19KB