fadb2d88f01fca7545d95f4c1d3fa110ff678d7e3850f3508e0bbd3b028bb74a

Sharing

Copy URL Twitter E-mail

General

Target

fadb2d88f01fca7545d95f4c1d3fa110ff678d7e3850f3508e0bbd3b028bb74a
Size

172KB
MD5

327a32da18bd6deef5612eede2d31290
SHA1

83f47042e5f8c8a0d1c2cd81db6e4670ad80ad79
SHA256

fadb2d88f01fca7545d95f4c1d3fa110ff678d7e3850f3508e0bbd3b028bb74a
SHA512

d540226761af882032e952a48fc15c781f846d1e7355a8e504f647d4abc6c80147d8cd56940839557eab994cd20991d4a8a1f89761f1e9c2e5b6ffe5db107f0f
SSDEEP

3072:AVeAEKGJ0D/Vw8kmkOWS6QKw2h03rMrqBQWPJm8kYpB4+qmuKN:KDQ0LkmkhQb2KuqqwJm8DB4+qmd

Score

N/A

Malware Config

Signatures

Files

fadb2d88f01fca7545d95f4c1d3fa110ff678d7e3850f3508e0bbd3b028bb74a
.exe windows x86

959cac9b7a9f9ea2388a7252ad2a7c8e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GlobalUnlock
ReleaseMutex
OpenEventA
SetErrorMode
GetCurrentProcess
RaiseException
GetStartupInfoA
GetModuleHandleA
HeapFree
DeleteFileA
ExitProcess
SetLastError
GetLastError
GetModuleFileNameA
SetFilePointer
WriteFile
CreateFileA
RemoveDirectoryA
LocalAlloc
LocalFree
MoveFileA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateDirectoryA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
GetProcAddress
GetProcessHeap
HeapAlloc
FreeLibrary
CreateThread
GetLocalTime
GetTickCount
Sleep
InterlockedExchange
SetEvent
CreateEventA
VirtualAlloc
TerminateThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CreateProcessA
DeviceIoControl
GetVolumeInformationA
GetVersion
VirtualFree
DeleteCriticalSection
CloseHandle
LoadLibraryA
OutputDebugStringA

user32

TranslateMessage
DispatchMessageA
CharNextA
ExitWindowsEx
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState
GetKeyState
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
SetClipboardData
EmptyClipboard
GetClipboardData
LoadCursorA
SystemParametersInfoA
SendMessageA
ReleaseDC
GetDC
GetDesktopWindow
SetRect
GetCursorPos
wsprintfA
SetProcessWindowStation
GetProcessWindowStation
CloseWindow
IsWindow
PostMessageA
OpenDesktopA
GetUserObjectInformationA
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
CloseDesktop
OpenInputDesktop

shlwapi

SHDeleteKeyA

gdi32

SelectObject
BitBlt
CreateCompatibleDC
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleBitmap
CreateDIBSection

advapi32

SetEntriesInAclA
LsaOpenPolicy
LsaClose
LookupAccountNameA
IsValidSid
RegQueryValueA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
RegOpenKeyA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseEventLog
ClearEventLogA
OpenEventLogA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
LookupAccountSidA
GetTokenInformation
LsaFreeMemory

shell32

SHGetFileInfoA
ShellExecuteA

winmm

waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveOutGetNumDevs
waveOutOpen
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveOutPrepareHeader
waveInGetNumDevs

msvcrt

strncpy
_strnicmp
_onexit
__dllonexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
atol
strncat
strtok
wcscpy
_errno
strncmp
atoi
rename
strrchr
_except_handler3
free
malloc
strchr
_strupr
sprintf
puts
putchar
rand
strstr
_ftol
ceil
memmove
_CxxThrowException
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

msvcp60

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

netapi32

NetUserAdd
NetLocalGroupAddMembers

urlmon

URLDownloadToFileA

avicap32

capGetDriverDescriptionA

msvfw32

ICSeqCompressFrameEnd
ICSendMessage

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSFreeMemory

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

959cac9b7a9f9ea2388a7252ad2a7c8e

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

gdi32

advapi32

shell32

winmm

msvcrt

wininet

msvcp60

netapi32

urlmon

avicap32

msvfw32

psapi

wtsapi32

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 16KB - Virtual size: 15KB

.rsrc Size: 16KB - Virtual size: 15KB

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 16KB - Virtual size: 15KB