2e81e99af0d53734a83c12a5dddf67bde3a9d13b20943e48b625ab93b6bfafc6

Sharing

Copy URL Twitter E-mail

General

Target

2e81e99af0d53734a83c12a5dddf67bde3a9d13b20943e48b625ab93b6bfafc6
Size

476KB
MD5

49ee111efa4cb6dac917d1bb3827c21a
SHA1

fad6c5dd307d8ff0c8da00a27ed6f837356c4b87
SHA256

2e81e99af0d53734a83c12a5dddf67bde3a9d13b20943e48b625ab93b6bfafc6
SHA512

b6e6932ce8f5f68a956c371c906deaf25f2f8c6c61e7336350a1bc24dbf7200da64b7e914d627de4d5cffc2040336f9061bd96951ff92c0eeb54bc607ccb41b1
SSDEEP

12288:HsbpJd7I9dM4uCGA4xSCSitDcsZUyee0jiZCF/YymGQicC:buCGA4xSCSitQuNeBiZCF/Y/icC

Score

N/A

Malware Config

Signatures

Files

2e81e99af0d53734a83c12a5dddf67bde3a9d13b20943e48b625ab93b6bfafc6
.dll windows x86

f91b473537ac271fd344d127d6c7d11d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
GetCommandLineA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetACP
ExitProcess
CreateThread
ExitThread
HeapSize
HeapReAlloc
SetStdHandle
GetFileType
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetStartupInfoA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
RtlUnwind
VirtualAlloc
IsBadWritePtr
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
FindNextFileA
LocalAlloc
GetFileTime
GetFileSize
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
SuspendThread
SetThreadPriority
GetCurrentThread
SetLastError
lstrcmpA
ReleaseMutex
CreateMutexA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FormatMessageA
LocalFree
ResetEvent
TerminateProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
ReadProcessMemory
VirtualFreeEx
GetExitCodeThread
GlobalLock
GlobalUnlock
MulDiv
SizeofResource
GetCurrentProcessId
OpenProcess
GetVersion
GetFileAttributesA
SetFileAttributesA
SetEvent
CreateEventA
ResumeThread
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcess
RemoveDirectoryA
GetModuleHandleA
GetVersionExA
QueryPerformanceFrequency
QueryPerformanceCounter
lstrcpynA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetFileAttributesExA
GetPrivateProfileStringA
ExpandEnvironmentStringsA
GetShortPathNameA
Sleep
MoveFileA
lstrcatA
CreateDirectoryA
WideCharToMultiByte
GetCurrentDirectoryA
SetCurrentDirectoryA
LoadLibraryA
FreeLibrary
WritePrivateProfileStringA
lstrcmpiA
GlobalAlloc
GlobalFree
GetModuleFileNameA
GetLastError
GetProcAddress
LockResource
FindResourceA
LoadResource
LeaveCriticalSection
EnterCriticalSection
lstrlenA
MultiByteToWideChar
lstrcpyA
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
SetFilePointer
WriteFile
ReadFile
HeapFree
GetProcessHeap
HeapAlloc
DeleteFileA
CreateFileA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CloseHandle
OutputDebugStringA
InterlockedDecrement
VirtualFree
InterlockedIncrement

user32

DestroyMenu
GetSysColorBrush
GetClassNameA
LoadStringA
UnregisterClassA
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
ClientToScreen
CharUpperA
GetMessageA
ValidateRect
PostQuitMessage
EndDialog
CreateDialogIndirectParamA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetNextDlgTabItem
ShowWindow
SetWindowTextA
IsDialogMessageA
LoadIconA
SendDlgItemMessageA
MapWindowPoints
DispatchMessageA
GetFocus
SetFocus
AdjustWindowRectEx
wsprintfA
PostMessageA
SetTimer
SetWindowPos
KillTimer
EnableWindow
SetActiveWindow
GetTopWindow
MessageBoxA
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetDlgCtrlID
GetKeyState
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetWindow
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
IsWindowVisible
GetActiveWindow
IsWindowEnabled
SendMessageA
UpdateWindow
PeekMessageA
GetParent
GetSysColor
OffsetRect
TranslateMessage
CopyRect
PtInRect
UnionRect
CopyImage
GetClientRect
ReleaseDC
GetDC
IsRectEmpty
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
BringWindowToTop
GetDesktopWindow
MonitorFromPoint
GetMonitorInfoA
GetWindowLongA
IsWindow
RegisterWindowMessageA
GetClassLongA
SetClassLongA
GetWindowRect
InvalidateRect
ScreenToClient
SetWindowLongA
GetWindowTextA
SetCursor
GetCursorPos
WindowFromPoint
LoadCursorA

gdi32

Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreatePatternBrush
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetObjectA
GetTextMetricsA
GetTextExtentPoint32A
StretchBlt
CreateCompatibleDC
CreateFontA
GetDeviceCaps
BitBlt
PatBlt
CreateCompatibleBitmap
SetBkColor
EnumFontFamiliesA
CreateBitmap
GetMapMode
GetClipBox
SetTextColor

comdlg32

GetFileTitleA
GetOpenFileNameA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegGetKeySecurity
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegSetValueA
RegCreateKeyExA
LookupAccountSidA
LookupPrivilegeValueA
AdjustTokenPrivileges
EnumServicesStatusA
QueryServiceConfigA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
RegSetKeySecurity
RegQueryInfoKeyA
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegQueryValueExA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
RegEnumValueA
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA

shell32

ord680
SHGetDesktopFolder
SHGetSpecialFolderPathA
ShellExecuteA

comctl32

ord17
_TrackMouseEvent

ole32

CreateStreamOnHGlobal

olepro32

ord251

oleaut32

SysFreeString
SysAllocStringLen
VariantClear
SafeArrayDestroy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString

wsock32

WSAStartup
WSACleanup
gethostbyname
inet_addr

wininet

InternetCanonicalizeUrlA
InternetGetLastResponseInfoA
InternetQueryDataAvailable
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetSetOptionExA
InternetOpenUrlA
InternetQueryOptionA
HttpSendRequestA
FindFirstUrlCacheEntryA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetSetOptionA
InternetOpenA
FindCloseUrlCache
FindNextUrlCacheEntryA
DeleteUrlCacheEntry

dbghelp

MakeSureDirectoryPathExists

cabinet

ord22
ord20
ord23

psapi

GetModuleFileNameExA
EnumProcesses

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

Exports

Exports

BeforeNavigate2
ConnectBrowser
DocumentComplete
NSIS_Base64Encoding
NSIS_CheckSetupExist
NSIS_ClearForUpdate
NSIS_GetInstalledDRVersion
NSIS_GetInstalledVersion
NSIS_IsPatchStartible
NSIS_PatchNotify
NSIS_RemoveNotify
NSIS_SetupNotify
NSIS_SetupVersionCheck
NavigateComplete2
NewWindow2
NewWindow3
OnAddressBar
OnMenuBar
OnToolBar
Quit
SetupRegisterServer
SetupUnregisterServer
ShowRMR

Sections

.text
Size: 312KB - Virtual size: 311KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARED_M
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f91b473537ac271fd344d127d6c7d11d

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

wsock32

wininet

dbghelp

cabinet

psapi

iphlpapi

version

rpcrt4

Exports

Exports

Sections

.text Size: 312KB - Virtual size: 311KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 40KB - Virtual size: 53KB

SHARED_M Size: 4KB - Virtual size: 4B

.rsrc Size: 28KB - Virtual size: 24KB

.reloc Size: 32KB - Virtual size: 30KB

.text
Size: 312KB - Virtual size: 311KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 40KB - Virtual size: 53KB

SHARED_M
Size: 4KB - Virtual size: 4B

.rsrc
Size: 28KB - Virtual size: 24KB

.reloc
Size: 32KB - Virtual size: 30KB