0514a3f9686bbb0869f5f07927e8883f60e58965fdacceaf53ffc67d0bf2b613

Sharing

Copy URL Twitter E-mail

General

Target

0514a3f9686bbb0869f5f07927e8883f60e58965fdacceaf53ffc67d0bf2b613
Size

255KB
MD5

051df6db8aee4fb68ad9ffa8511da68a
SHA1

8eb3cd829f87a4c2788bd42392655720fffcdd5b
SHA256

0514a3f9686bbb0869f5f07927e8883f60e58965fdacceaf53ffc67d0bf2b613
SHA512

6078bfc73fb2e1f1a34778930c5ef6013e9a254b6963595fb604910ead20bdcf8e6db26d19cfc50ec7b71668cf133cd80da0ecab74e1b9500abfedf846e14e16
SSDEEP

6144:p0g2ZiMlB4pBS1Xi42FnJuCa3NzKPtsCV6UsDFooE3:eg2ZiMHeGybHxttsMcq

Score

N/A

Malware Config

Signatures

Files

0514a3f9686bbb0869f5f07927e8883f60e58965fdacceaf53ffc67d0bf2b613
.exe windows x86

db335b8243a5a53df4f93ee7223e5ed7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharLowerW
ExitWindowsEx
wsprintfA
CharUpperA
OemToCharBuffA
GetSystemMetrics
CharLowerA
CharUpperW
CharToOemBuffA

advapi32

OpenProcessToken
LookupAccountSidA
AllocateAndInitializeSid
LookupPrivilegeValueA
SetSecurityDescriptorDacl
DuplicateToken
AdjustTokenPrivileges
InitializeAcl
GetUserNameA
ImpersonateLoggedOnUser
FreeSid
DuplicateTokenEx
RevertToSelf
SetSecurityDescriptorSacl
CopySid
GetLengthSid
SetThreadToken
InitializeSecurityDescriptor
AddAccessAllowedAce
OpenThreadToken
GetTokenInformation
EqualSid

shlwapi

PathUnExpandEnvStringsA
PathUnExpandEnvStringsW
PathIsRootA
StrStrNW
PathSearchAndQualifyW
PathFindExtensionW
PathIsPrefixA
PathUnmakeSystemFolderW
PathRemoveBlanksA
PathIsUNCServerA
StrRStrIA
SHQueryInfoKeyW
PathAppendW
SHRegWriteUSValueW
DllGetVersion
UrlIsA
PathGetCharTypeW
StrCmpNW
PathRemoveBlanksW
UrlHashA
SHRegCloseUSKey
PathSearchAndQualifyA
SHSkipJunction
PathCommonPrefixA
StrCatChainW
PathIsSameRootA
UrlIsW
SHDeleteKeyA
SHIsLowMemoryMachine
StrRChrIA
StrToIntA
StrChrNW
PathBuildRootA
PathFindSuffixArrayW
StrCSpnA
UrlEscapeA
PathCommonPrefixW
StrFormatKBSizeA
ColorRGBToHLS

kernel32

WaitForSingleObjectEx
SetUnhandledExceptionFilter
CreateMutexA
ResetEvent
ReleaseSemaphore
OutputDebugStringA
lstrcpyW
HeapReAlloc
GetModuleHandleW
GetWindowsDirectoryA
GlobalMemoryStatus
UnhandledExceptionFilter
EnterCriticalSection
HeapAlloc
HeapFree
GetSystemDirectoryA
GetSystemTimeAsFileTime
SleepEx
QueryPerformanceFrequency
SetErrorMode
IsDebuggerPresent
OpenMutexA
ReleaseMutex
LeaveCriticalSection
VirtualUnlock
ExpandEnvironmentStringsW
GetSystemInfo
OpenProcess
VirtualProtect
HeapDestroy
CloseHandle
GetCurrentThreadId
HeapValidate
CreateSemaphoreW
OpenEventA
GetProcessHeap
ExpandEnvironmentStringsA
VirtualLock
CreateSemaphoreA
GetTempFileNameA
DeleteCriticalSection
VirtualAlloc
FreeLibrary
CreateEventA
PulseEvent
HeapSize
lstrcpyA
VirtualFree
WaitForSingleObject
WideCharToMultiByte
GetTempPathA
GetModuleHandleA
OpenSemaphoreA
GlobalMemoryStatusEx
GetStartupInfoW
VirtualAllocEx

tapi3

DllCanUnloadNow

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UOxl
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GQKuR
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rebu
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lCAnT
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gZuLycI
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dmItC
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.LEKyy
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db335b8243a5a53df4f93ee7223e5ed7

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

shlwapi

kernel32

tapi3

Sections

.text Size: 18KB - Virtual size: 17KB

.UOxl Size: 2KB - Virtual size: 2KB

.GQKuR Size: 3KB - Virtual size: 2KB

.rebu Size: 1KB - Virtual size: 1KB

.lCAnT Size: 3KB - Virtual size: 2KB

.rdata Size: 209KB - Virtual size: 208KB

.gZuLycI Size: 2KB - Virtual size: 2KB

.data Size: 8KB - Virtual size: 284KB

.rsrc Size: 4KB - Virtual size: 3KB

.dmItC Size: 2KB - Virtual size: 2KB

.LEKyy Size: 2KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 17KB

.UOxl
Size: 2KB - Virtual size: 2KB

.GQKuR
Size: 3KB - Virtual size: 2KB

.rebu
Size: 1KB - Virtual size: 1KB

.lCAnT
Size: 3KB - Virtual size: 2KB

.rdata
Size: 209KB - Virtual size: 208KB

.gZuLycI
Size: 2KB - Virtual size: 2KB

.data
Size: 8KB - Virtual size: 284KB

.rsrc
Size: 4KB - Virtual size: 3KB

.dmItC
Size: 2KB - Virtual size: 2KB

.LEKyy
Size: 2KB - Virtual size: 1KB