b940a629f60d12e5df5054fc2b8fb384ab7636e6ed8333dddfb2ac1fcf981a8f

Sharing

Copy URL Twitter E-mail

General

Target

b940a629f60d12e5df5054fc2b8fb384ab7636e6ed8333dddfb2ac1fcf981a8f
Size

1.5MB
MD5

ec088ebc5e28004ec878584ccbe4af41
SHA1

867f1f083d50030e33bde3dfd662bf9394958590
SHA256

b940a629f60d12e5df5054fc2b8fb384ab7636e6ed8333dddfb2ac1fcf981a8f
SHA512

ed384e32a1d328af92c8fb431c28c5c91e6e8d1f7466f6597d80825e82aea1a81df01b8dff04451b62fd533ff8373b0b0e84dfd95b6ceecf312c4259b1906023
SSDEEP

12288:4i14bOHmNMN7Qo7+pE0/7HOmP39crfvjh/nSxOJrt9dzuL5g5RH/byK9j3mD1Yc:l14smNXp5/jl/983hSAtuL5g5RFNc

Score

N/A

Malware Config

Signatures

Files

b940a629f60d12e5df5054fc2b8fb384ab7636e6ed8333dddfb2ac1fcf981a8f
.exe windows x86

7e5e4d10e4fbfcf9a7237b131c9e1a82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shell32

SHGetSpecialFolderPathA

user32

wsprintfA

advapi32

QueryServiceStatusEx
OpenThreadToken
CloseServiceHandle
GetAclInformation
LookupAccountNameW
RegOpenKeyExA
MakeAbsoluteSD
GetLengthSid
RevertToSelf
InitializeSecurityDescriptor
GetSecurityDescriptorControl
ControlService
GetSecurityDescriptorSacl
CopySid
GetSecurityDescriptorOwner
ImpersonateSelf
EqualSid
CryptAcquireContextA
MakeSelfRelativeSD
RegQueryValueExA
AdjustTokenPrivileges
GetFileSecurityW
CryptDestroyHash
InitializeAcl
LookupPrivilegeValueA
SetFileSecurityW
OpenServiceW
RegDeleteValueA
SetSecurityDescriptorDacl
IsValidSid
CryptReleaseContext
CryptGetHashParam
RegCloseKey
CryptCreateHash
CryptHashData
GetAce
GetSecurityDescriptorLength
OpenSCManagerA
GetSecurityDescriptorGroup
RegNotifyChangeKeyValue
RegSetValueExA
AddAce
GetSecurityDescriptorDacl

shlwapi

PathAddBackslashW
PathStripPathA
PathAppendW
PathQuoteSpacesW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW
PathRemoveExtensionW

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
StringFromGUID2
GetHGlobalFromStream
StringFromCLSID
CoDisconnectObject
OleRun
CoInitialize
CoQueryProxyBlanket
CoSetProxyBlanket
CreateStreamOnHGlobal
OleInitialize
CoGetMalloc
CoGetClassObject
CoCreateGuid

psapi

GetModuleBaseNameA

kernel32

lstrlenW
OpenEventA
GetStdHandle
GetProcessHeap
FormatMessageA
VirtualAlloc
CreateThread
GetUserDefaultLCID
LockResource
CreateFileA
HeapFree
VirtualProtect
VirtualFree
HeapReAlloc
SizeofResource
RtlUnwind
GetSystemTime
EnterCriticalSection
CreateWaitableTimerA
GetCurrentThreadId
VirtualQuery
SetLastError
WaitForSingleObject
GetOEMCP
HeapAlloc
LocalAlloc
SetStdHandle
GetFileType
SetWaitableTimer
SetFilePointer
TlsAlloc
LCMapStringA
UnhandledExceptionFilter
WideCharToMultiByte
SetHandleCount
LeaveCriticalSection
GetSystemInfo
HeapSize
GetSystemTimeAsFileTime
FlushFileBuffers
FindResourceA
FreeEnvironmentStringsA
IsValidCodePage
ReadFile
EnumSystemLocalesA
GlobalLock
lstrlenA
LCMapStringW
OpenProcess
FindResourceExA
IsValidLocale
WriteFile
TlsSetValue
GetCommandLineA
DeleteCriticalSection
HeapDestroy
CancelWaitableTimer
LoadResource
GlobalAlloc
WaitForMultipleObjects
ResumeThread
GetThreadLocale
GlobalSize
GetModuleHandleA
TlsGetValue
FreeEnvironmentStringsW
SetEndOfFile
CloseHandle
GlobalUnlock
LocalFree
GetACP
TlsFree
RaiseException
CreateEventA
CreateProcessW
IsBadCodePtr
SetUnhandledExceptionFilter
lstrcmpA
VirtualAllocEx

userenv

UnloadUserProfile

oleaut32

VariantTimeToSystemTime
SysFreeString
SysAllocString
SafeArrayCreate
LoadTypeLi
VariantCopyInd
SystemTimeToVariantTime
SafeArrayUnlock
VariantChangeType
SysStringByteLen
SafeArrayGetDim
SafeArrayDestroy
SafeArrayCopy
VariantInit
SafeArrayGetElement
VarBstrCmp
SafeArrayCreateVectorEx
SafeArrayLock
SafeArrayGetUBound
SafeArrayRedim
SafeArrayUnaccessData
GetErrorInfo
SysStringLen
LoadRegTypeLi
SysAllocStringByteLen
VariantClear
GetRecordInfoFromGuids
SafeArrayGetVartype
SafeArrayAccessData
VariantCopy
SysAllocStringLen
SafeArrayGetLBound

atmlib

ATMFinish
ATMGetNtmFields
ATMXYShowTextW
ATMForceFontChange
ATMMakePFM
ATMGetFontInfo
ATMFontAvailableW
ATMFontStatusW
ATMMakePSSA
ATMGetNtmFieldsW

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 309KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e5e4d10e4fbfcf9a7237b131c9e1a82

Headers

File Characteristics

Imports

version

shell32

user32

advapi32

shlwapi

ole32

psapi

kernel32

userenv

oleaut32

atmlib

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 309KB - Virtual size: 1.5MB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 309KB - Virtual size: 1.5MB

.rsrc
Size: 3KB - Virtual size: 2KB