48ced37df9b3308f0fd30a8dae28ab5af1d69a04ab03d84154861b612d042f53

Sharing

Copy URL Twitter E-mail

General

Target

48ced37df9b3308f0fd30a8dae28ab5af1d69a04ab03d84154861b612d042f53
Size

260KB
MD5

e6b008bb28b2952f285ae413f35b6b02
SHA1

319d25729e1ec1f75872a67f8a6e9188b9450387
SHA256

48ced37df9b3308f0fd30a8dae28ab5af1d69a04ab03d84154861b612d042f53
SHA512

78da6511df53fa7df09c270c88dd7469c25c6ffbec179a577077aeaecd49cfef8f7debbd82b00c22f278f0ade8a26eca17055616f295894d65b3b44497121e3b
SSDEEP

6144:EOHMFboyWwjr6Y9elEG/K08QQlc7izf3F4A8vEtyqcT:EOsFgwjOY4qHp7sE5+

Score

N/A

Malware Config

Signatures

Files

48ced37df9b3308f0fd30a8dae28ab5af1d69a04ab03d84154861b612d042f53
.exe windows x86

1d7cb4364df7c167a6b72d0018cb1a1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

I_RpcGetBuffer
RpcAsyncGetCallStatus
RpcNsBindingInqEntryNameW
I_RpcBindingInqDynamicEndpointA
NdrRpcSsDisableAllocate
NdrCStdStubBuffer2_Release
RpcSmAllocate
NdrSimpleStructBufferSize

secur32

SetContextAttributesA
LsaGetLogonSessionData
LsaDeregisterLogonProcess
QuerySecurityPackageInfoA
ImpersonateSecurityContext
GetComputerObjectNameW
LsaRegisterLogonProcess
GetUserNameExA
LsaConnectUntrusted

oleaut32

VarI1FromBool
VarDecInt
VarUI8FromI1
VarBstrFromUI1
VarR8FromDisp
VarI4FromDec
VarCyCmp

rasapi32

RasGetAutodialAddressW
RasSetAutodialParamW
RasSetAutodialAddressW
RasGetErrorStringA
RasGetSubEntryHandleW
RasGetProjectionInfoA
RasEnumAutodialAddressesA
RasHangUpW
RasSetEntryDialParamsW
RasEnumConnectionsW

ole32

CoCreateInstance
OleCreateLinkToFile
OleCreateFromData
CoRevokeInitializeSpy
CoTestCancel
CoGetCallContext
CoRevokeClassObject
SetConvertStg
StgOpenStorageOnILockBytes
OleRegEnumFormatEtc
CoGetCurrentLogicalThreadId

shell32

SHAppBarMessage
ord240
ord129
SHFileOperationW
ord154
ExtractIconExW
SHGetDesktopFolder
ord701
ord688
ord21

imm32

ImmSetCompositionStringA
ImmGetCandidateListA
ImmSetConversionStatus
ImmInstallIMEW
ImmUnregisterWordW
ImmGetImeMenuItemsW
ImmRegisterWordW
ImmGetContext
ImmInstallIMEA
ImmAssociateContext
ImmNotifyIME

glu32

gluDisk
gluNewNurbsRenderer
gluGetNurbsProperty
gluUnProject
gluBeginPolygon
gluPerspective
gluBeginSurface
gluQuadricCallback
gluLoadSamplingMatrices
gluEndPolygon
gluNurbsSurface

opengl32

glRasterPos3fv
glTexCoord3iv
wglRealizeLayerPalette
glPushName
glArrayElement

msvcrt

strchr
towupper
sprintf
wcschr
isxdigit
islower
toupper
_mbctoupper
_exit
isspace
swscanf
iswlower

wininet

HttpSendRequestW
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoW
FtpOpenFileW
FtpOpenFileA

shlwapi

ord29
PathRemoveFileSpecW
ord10
PathIsURLA
PathRelativePathToA
ord15
IsCharSpaceA
PathMatchSpecW
ord8
PathIsFileSpecA
PathIsUNCServerA
PathIsLFNFileSpecW
PathFindExtensionW
PathIsNetworkPathW
ord7
PathAddExtensionA

comctl32

ImageList_ReplaceIcon
ImageList_Create
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_Read
PropertySheetA
ImageList_GetIcon
InitCommonControlsEx
ImageList_Destroy
CreateStatusWindowW

kernel32

GetSystemTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
CreateProcessA
GetCurrentThreadId
FreeResource
GetComputerNameW
FindResourceExA
CreateEventW
GetLocaleInfoW
SetFileAttributesW
OutputDebugStringW
GetCurrentProcess
TerminateProcess

gdi32

GetBitmapBits
CloseEnhMetaFile
CreateBitmap
GetMapMode
CreateBitmapIndirect
GetTextExtentPoint32W
ScaleViewportExtEx
StretchBlt
RoundRect
SetRectRgn
OffsetRgn
GetTextExtentPointW

comdlg32

GetOpenFileNameA
FindTextA
PrintDlgW
PrintDlgExA
ChooseColorW
ChooseFontA
ChooseFontW
CommDlgExtendedError
GetFileTitleA
FindTextW
PrintDlgExW
GetSaveFileNameA

advapi32

ReadEventLogW
CredEnumerateA
AccessCheckByTypeAndAuditAlarmW
ImpersonateSelf
EncryptFileA
BuildExplicitAccessWithNameW
CreateServiceA
LsaRetrievePrivateData
SetEntriesInAclW
RegCreateKeyA

Exports

Exports

BlatBatsLipegatslavalearminxCurtzipxi
HermDormKeirjefeGeumWhaprodeDaftZoonsopsBirlSabsprowBotanthye
LimyGoesOgamkoannologinsDiffLimasat
LitePupsSoullobofirmrote
PartBrincainEwerSurfHautbarmHutsSardThanSacsWackWoldSarkwaget
StudGuckDossGladGedsloof
WolfLaicTakaBackGushDogsAvosbiffloosdameitsox
YillMurabirlSicsDovevow

Sections

.text
Size: - Virtual size: 512B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d7cb4364df7c167a6b72d0018cb1a1c

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

secur32

oleaut32

rasapi32

ole32

shell32

imm32

glu32

opengl32

msvcrt

wininet

shlwapi

comctl32

kernel32

gdi32

comdlg32

advapi32

Exports

Exports

Sections

.text Size: - Virtual size: 512B

.rdata Size: 246KB - Virtual size: 246KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: - Virtual size: 512B

.rdata
Size: 246KB - Virtual size: 246KB

.reloc
Size: 12KB - Virtual size: 12KB