7caf1a0fbbc8ffe1b265a1709792e9e3305bfd18fd510f09b8a74e19714d1506

Sharing

Copy URL Twitter E-mail

General

Target

7caf1a0fbbc8ffe1b265a1709792e9e3305bfd18fd510f09b8a74e19714d1506
Size

1.0MB
MD5

ad4d3d16083992f4d17197857f3d3269
SHA1

05c55a3e4c659b7d8872eb4bd22c99b16e4dca88
SHA256

7caf1a0fbbc8ffe1b265a1709792e9e3305bfd18fd510f09b8a74e19714d1506
SHA512

c9741f5ffb01c2e6ede199749d0b9bef6a2b62d758d527a62553d3b9cab79a48ef45f57f7c538f3fa98140737d954fcac062eab37c0f5fd19a86e841b30cb6ee
SSDEEP

24576:D93weX/vmXqsL84wbbDZIWBrkZcTyaNG3x39ev:D9ga/vmrL84ibDZfrBTyaNGB3Iv

Score

N/A

Malware Config

Signatures

Files

7caf1a0fbbc8ffe1b265a1709792e9e3305bfd18fd510f09b8a74e19714d1506
.exe windows x86

2516d17cb209ad80e74fb7e6072de4aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetSetOptionW
HttpAddRequestHeadersW
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetCloseHandle
InternetGetConnectedState
HttpSendRequestW
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoW
DeleteUrlCacheEntryW

rasapi32

RasEnumConnectionsW

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertGetNameStringW
CertFreeCertificateChain
CertCreateContext
CryptQueryObject
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertNameToStrW
CertFreeCertificateContext
CryptImportPublicKeyInfo

msi

ord190
ord141
ord88
ord16
ord238
ord175

kernel32

SetThreadLocale
GetVersionExA
PostQueuedCompletionStatus
QueryPerformanceCounter
EnumResourceLanguagesW
GetACP
GetLocaleInfoA
GetThreadLocale
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitThread
MapViewOfFile
ProcessIdToSessionId
GetUserDefaultUILanguage
SystemTimeToFileTime
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
TerminateProcess
SetFileAttributesW
LocalAlloc
GetStartupInfoW
VirtualQuery
ExitProcess
RtlUnwind
LCMapStringA
GetCPInfo
HeapCreate
GetStdHandle
GetModuleFileNameA
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetSystemTime
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetCurrentThread
LoadLibraryA
VerSetConditionMask
VerifyVersionInfoW
lstrlenA
GetTempPathW
LCMapStringW
VirtualAlloc
VirtualFree
VirtualProtect
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
CreateThread
GetFileSizeEx
GetSystemInfo
WaitForMultipleObjects
FlushFileBuffers
CopyFileW
GetTempFileNameW
GetFileAttributesExW
GetSystemTimeAsFileTime
CreateFileMappingW
OpenFileMappingW
MapViewOfFileEx
UnmapViewOfFile
CreateProcessW
OpenEventW
GetExitCodeProcess
GetVersionExW
GetCurrentProcess
FormatMessageW
RaiseException
MultiByteToWideChar
LockResource
SizeofResource
LoadResource
FindResourceW
GetModuleHandleA
GetModuleHandleW
LocalFree
EnumResourceNamesW
WideCharToMultiByte
CreateFileW
CompareFileTime
GetFileSize
SetFilePointer
WriteFile
ReadFile
RemoveDirectoryW
GetTickCount
SetThreadPriority
ResumeThread
MoveFileExW
InterlockedExchange
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
GetCurrentProcessId
CreateEventW
FreeLibrary
CreateMutexW
WaitForSingleObject
ReleaseMutex
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
lstrlenW
LoadLibraryExW
GetCurrentThreadId
Sleep
OpenProcess
SetEvent
OutputDebugStringA
GetModuleFileNameW
GetProcAddress
SetLastError
LoadLibraryW
CloseHandle
GetLastError
FindResourceExW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersion
GetFileAttributesW
IsDebuggerPresent

user32

GetGUIThreadInfo
CharLowerBuffW
IsWindow
DestroyWindow
CharNextW
PostQuitMessage
SendMessageW
MessageBoxIndirectW
DialogBoxParamW
LoadImageW
EnumChildWindows
GetShellWindow
GetWindowThreadProcessId
MsgWaitForMultipleObjects
GetMessageW
RegisterClassW
TranslateMessage
DispatchMessageW
wvsprintfA
wvsprintfW
PeekMessageW
IsWindowVisible
MessageBoxW
EndDialog
GetClassNameW
SetWindowLongW
PostMessageW
DefWindowProcW
GetWindowLongW
UnregisterClassA
FindWindowExW
CreateWindowExW

advapi32

IsValidSid
CryptVerifySignatureW
RegNotifyChangeKeyValue
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSidIdentifierAuthority
RegOpenCurrentUser
SetTokenInformation
CreateProcessAsUserW
EqualPrefixSid
OpenThreadToken
SetThreadToken
DuplicateTokenEx
GetSidSubAuthorityCount
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CryptAcquireContextW
CryptCreateHash
CryptHashData
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
ConvertSidToStringSidW
RegGetKeySecurity
RegSetKeySecurity
GetAce
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
EqualSid
CopySid
GetLengthSid
MakeAbsoluteSD
SetSecurityDescriptorControl
GetAclInformation
InitializeAcl
AddAce
RegFlushKey
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSidToSidW
RegEnumValueW
CryptDestroyKey
CryptDestroyHash
OpenSCManagerW
OpenServiceW
DeleteService
CloseServiceHandle
CreateServiceW
StartServiceW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
ImpersonateLoggedOnUser
GetUserNameW
RevertToSelf
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl

ole32

OleRun
CLSIDFromString
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitializeEx

shell32

ord165
SHGetFolderPathW

oleaut32

SysAllocString
VariantCopy
VariantClear
VariantInit
SysFreeString
SysAllocStringLen
VarUI4FromStr

shlwapi

PathIsDirectoryEmptyW
PathCanonicalizeW
PathRemoveFileSpecW
PathFileExistsW
SHDeleteEmptyKeyW
SHDeleteValueW
SHDeleteKeyW
StrCatBuffA
PathCombineW
SHCopyKeyW
PathIsDirectoryW
PathAppendW
SHGetValueW
SHSetValueW
PathIsRelativeW

gdiplus

GdiplusShutdown

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory

wintrust

WinVerifyTrust

Sections

.text
Size: 393KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2516d17cb209ad80e74fb7e6072de4aa

Headers

DLL Characteristics

File Characteristics

Imports

wininet

rasapi32

crypt32

msi

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdiplus

userenv

version

wtsapi32

wintrust

Sections

.text Size: 393KB - Virtual size: 392KB

.rdata Size: 289KB - Virtual size: 289KB

.data Size: 28KB - Virtual size: 72KB

shared Size: 512B - Virtual size: 4B

.rsrc Size: 237KB - Virtual size: 237KB

.reloc Size: 73KB - Virtual size: 73KB

.text
Size: 393KB - Virtual size: 392KB

.rdata
Size: 289KB - Virtual size: 289KB

.data
Size: 28KB - Virtual size: 72KB

shared
Size: 512B - Virtual size: 4B

.rsrc
Size: 237KB - Virtual size: 237KB

.reloc
Size: 73KB - Virtual size: 73KB