a5ae5f1095840dd7ddfc46dc4d19fc789e7696f7c4028e5710e296576fc4bbd3

Sharing

Copy URL Twitter E-mail

General

Target

a5ae5f1095840dd7ddfc46dc4d19fc789e7696f7c4028e5710e296576fc4bbd3
Size

138KB
MD5

e028e6a7b9dc9cbde040f59b70bccd0a
SHA1

041dbd2915b295d0357ce75e865288bd6622da94
SHA256

a5ae5f1095840dd7ddfc46dc4d19fc789e7696f7c4028e5710e296576fc4bbd3
SHA512

fb560334014a2cd51ac44f77bac815b135bb6e3b70c2ad7972d1027b51e8da13e0a86a7e28c2e3fbb76fb34ea3b113d1578127198cef6f48995fe418efd6772c
SSDEEP

3072:yj2aLiVa+/FcCLK9nusoDZJix3WCKM6ujzjKi79dISoDT141Q9:yj2a6InFoHeWCKUui79dI521Q9

Score

N/A

Malware Config

Signatures

Files

a5ae5f1095840dd7ddfc46dc4d19fc789e7696f7c4028e5710e296576fc4bbd3
.exe windows x86

78ea6b29d7a33ffe506b7adfa122b5c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
SetErrorMode
GetComputerNameW
VirtualFree
OpenEventW
DuplicateHandle
GetCurrentProcessId
WriteProcessMemory
CreateRemoteThread
OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
FindFirstFileW
SetEndOfFile
CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
GetProcessHeap
IsBadReadPtr
SetFileTime
GetThreadContext
Thread32First
GetUserDefaultUILanguage
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetVersionExW
GetModuleFileNameW
MoveFileExW
WaitForMultipleObjects
GetPrivateProfileIntW
FlushFileBuffers
WriteFile
GetPrivateProfileStringW
CreateThread
GetLocalTime
GetNativeSystemInfo
TlsFree
ExpandEnvironmentStringsW
GlobalUnlock
GetTickCount
GlobalLock
SetFileAttributesW
WTSGetActiveConsoleSessionId
CreateFileW
GetFileAttributesW
LoadLibraryW
CreateDirectoryW
ExitProcess
GetProcessId
VirtualAlloc
VirtualFreeEx
WideCharToMultiByte
SetThreadContext
TlsAlloc
GetCurrentThreadId
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateMutexW
Sleep
ReleaseMutex
GetFileAttributesExW
GetModuleHandleW
CloseHandle
CreateEventW
EnterCriticalSection
SetLastError
GetLastError
LeaveCriticalSection
InitializeCriticalSection
ResetEvent
TerminateProcess
TlsSetValue
SetEvent
TlsGetValue
lstrcmpiA
SetThreadPriority
GetCurrentThread
WaitForSingleObject
GetSystemTime
lstrcmpiW
LoadLibraryA
GetProcAddress
VirtualQueryEx
FreeLibrary

user32

SystemParametersInfoW
GetClassNameW
GetMenuState
GetMenuItemCount
HiliteMenuItem
GetUserObjectInformationW
EndMenu
GetWindowThreadProcessId
GetShellWindow
GetSystemMetrics
GetMessageA
RegisterClassExA
SetCapture
DefDlgProcW
DefFrameProcA
OpenInputDesktop
GetCapture
TrackPopupMenuEx
RegisterClassExW
SetCursorPos
GetClipboardData
PeekMessageW
PeekMessageA
DefWindowProcA
DefMDIChildProcW
CharToOemW
DefDlgProcA
DefMDIChildProcA
ReleaseCapture
RegisterClassW
CallWindowProcA
GetTopWindow
ToUnicode
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
CharUpperW
SetWindowLongW
GetWindow
DispatchMessageW
MapVirtualKeyW
GetWindowRect
GetParent
GetClassLongW
GetWindowLongW
GetAncestor
SetWindowPos
SendMessageTimeoutW
IsWindow
MapWindowPoints
ExitWindowsEx
CreateDesktopW
SetProcessWindowStation
GetMenu
CloseWindowStation
GetKeyboardState
TranslateMessage
CreateWindowStationW
GetMenuItemRect
CloseDesktop
SetThreadDesktop
GetCursorPos
GetIconInfo
OpenWindowStationW
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
CallWindowProcW
GetMessagePos
DefFrameProcW
RegisterClassA
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
GetDC
IntersectRect
GetDCEx
ReleaseDC
SetKeyboardState
GetSubMenu
OpenDesktopW
MenuItemFromPoint
SwitchDesktop
DrawIcon
CharLowerW
CharLowerBuffA
IsRectEmpty
DefWindowProcW
SendMessageW
PrintWindow
EqualRect
PostThreadMessageW
GetProcessWindowStation

advapi32

ConvertSidToStringSidW
EqualSid
InitiateSystemShutdownExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
IsWellKnownSid
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData

shlwapi

PathIsURLW
PathRemoveFileSpecW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
PathRenameExtensionW
StrStrIW
StrStrIA
StrCmpNIW
PathQuoteSpacesW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

GetDeviceCaps
CreateCompatibleBitmap
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDIBits
RestoreDC
SaveDC

ws2_32

recv
sendto
getsockname
select
getaddrinfo
recvfrom
WSAGetLastError
accept
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
bind
socket
WSASetLastError
listen
freeaddrinfo
getpeername
WSASend
closesocket
send

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
InternetOpenA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78ea6b29d7a33ffe506b7adfa122b5c9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 130KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 130KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB