5f141952f8a4cb82f40c2da073e953421e2182fddffd91cffad26661849567e5

Sharing

Copy URL

Twitter E-mail

General

Target

5f141952f8a4cb82f40c2da073e953421e2182fddffd91cffad26661849567e5
Size

156KB
MD5

42336b96dae5e9b4069c07eb5e783340
SHA1

c2311c879bb3178dcf6b276c7b956cf7f9423d6a
SHA256

5f141952f8a4cb82f40c2da073e953421e2182fddffd91cffad26661849567e5
SHA512

c577a26828d281af554c7cc94ca9fceaca64f40fc3df408147e1fb9512766c582b0b06a441ad2bc3e9d92984d24432e9412aa32690c81d5c2b269dab01c711c3
SSDEEP

3072:pHhL19vSPMF+y0J3j4r01HKrvAP3fGxoYiGZENkQ5KGFVX:pHhL1xSPMF+y4jtUrvAfaoLwskQYGFh

Score

N/A

Malware Config

Signatures

Files

5f141952f8a4cb82f40c2da073e953421e2182fddffd91cffad26661849567e5
.exe windows x86

99895b5b7167417882ef55e8544e0e87

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
GetLastError
GlobalMemoryStatusEx
GetProcessHeap
GetCurrentProcess
SetFileAttributesA
ReleaseMutex
GetTickCount
CloseHandle
CreateMutexA
GetStartupInfoA
GetModuleHandleA
lstrcpyA
GetDriveTypeA
GetVersionExA
lstrcmpA
lstrcatA
lstrlenA
Sleep
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress

user32

GetForegroundWindow
GetAsyncKeyState
GetKeyState
SetCapture
WindowFromPoint
SetCursorPos
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetSystemMetrics
LoadCursorA
ReleaseDC
SetRect
GetCursorPos
wsprintfA
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
GetWindowThreadProcessId
IsWindowVisible
CloseDesktop
GetThreadDesktop
IsWindow
CharNextA
GetWindowTextA
SendMessageA
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA

gdi32

DeleteDC
CreateDIBSection
SelectObject
BitBlt
CreateCompatibleBitmap
GetDIBits
DeleteObject

advapi32

RegEnumKeyExA
ControlService
DeleteService
CloseServiceHandle
RegQueryValueA
RegCloseKey
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
GetTokenInformation
LookupAccountSidA
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserA
RegDeleteKeyA
RegDeleteValueA
OpenProcessToken
RegEnumValueA
AllocateAndInitializeSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
RegSetKeySecurity
FreeSid
QueryServiceStatus

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

shlwapi

SHDeleteKeyA

msvcrt

_strnicmp
strtok
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
strncat
_strupr
_errno
atoi
strncmp
strcat
rename
strrchr
_except_handler3
free
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memcpy
memmove
ceil
_ftol
strlen
strstr
memset
??2@YAPAXI@Z
strcpy
strchr
malloc
strcmp

ws2_32

select
send
inet_ntoa
inet_addr
getsockname
bind
getpeername
accept
listen
sendto
closesocket
__WSAFDIsSet
gethostname
ntohs
socket
gethostbyname
connect
setsockopt
WSAStartup
WSACleanup
recvfrom
recv
WSAIoctl
htons

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

99895b5b7167417882ef55e8544e0e87

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

ws2_32

msvcp60

wtsapi32

userenv

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 992B

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 992B