9a864ba886006ba425571a402f744ce2b8159369a053f8f4574cae6caa320158

Sharing

Copy URL

Twitter E-mail

General

Target

9a864ba886006ba425571a402f744ce2b8159369a053f8f4574cae6caa320158
Size

140KB
MD5

b5af962b66f2217bcc750c384a372a64
SHA1

4e6abf0061356dac799bae50abe0a65099bd3fd7
SHA256

9a864ba886006ba425571a402f744ce2b8159369a053f8f4574cae6caa320158
SHA512

a9fcee8f45e155f757f5cade30202d73d222a900333bae3819ffccfc098b415e6e6851fa3afd0d3e80341917003d142e14fad83dca2877b9220c136da3a20487
SSDEEP

3072:Cl2g9nNC8oEEbBJkK0uSUCtrFPCgKa1rPzSDcNHTYRvc+tcMYcCTYywFtMl2CyKJ:m2g9n8qPKZSUCtrq2rPycRTY3M6FS2QJ

Score

N/A

Malware Config

Signatures

Files

9a864ba886006ba425571a402f744ce2b8159369a053f8f4574cae6caa320158
.exe windows x86

13a682ef44170d166e6008f58a33dfdf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetTimeZoneInformation
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
RemoveDirectoryW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
HeapReAlloc
LocalFree
Thread32Next
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
GetLocalTime
MoveFileExW
GetModuleFileNameW
GetUserDefaultUILanguage
ExitProcess
GetCommandLineW
SetErrorMode
GetComputerNameW
GetVersionExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
WTSGetActiveConsoleSessionId
GetPrivateProfileStringW
GetPrivateProfileIntW
GetNativeSystemInfo
GetThreadContext
SetThreadContext
GetProcessId
GetTempFileNameW
FileTimeToDosDateTime
GetFileAttributesW
HeapCreate
HeapDestroy
ReadProcessMemory
LoadLibraryW
WideCharToMultiByte
Thread32First
GetEnvironmentVariableW
lstrcmpiW
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
CreateDirectoryW
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
GetSystemTime
FindFirstFileW
ResetEvent
TerminateProcess
TlsSetValue
TlsGetValue
GetFileAttributesExW
GetProcAddress
GetModuleHandleW
Sleep
GlobalUnlock
GetTickCount
GlobalLock
TlsFree
TlsAlloc
GetCurrentThreadId
CreateEventW
CreateFileMappingW
SetEvent
UnmapViewOfFile
MapViewOfFile
CreateMutexW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
VirtualFreeEx
OpenProcess
CreateRemoteThread
lstrcmpiA
SetThreadPriority
GetCurrentThread
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
GetFileInformationByHandle
InitializeCriticalSection

user32

EndPaint
GetMessageA
GetUpdateRgn
GetMessageW
GetWindowDC
SetCapture
BeginPaint
GetUpdateRect
GetCapture
SetCursorPos
PeekMessageW
GetDCEx
PeekMessageA
GetCursorPos
ReleaseCapture
GetMessagePos
TranslateMessage
PostMessageW
GetClipboardData
ToUnicode
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
CharUpperW
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
MapVirtualKeyW
IsRectEmpty
PrintWindow
GetWindowRect
GetParent
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
MapWindowPoints
GetSystemMetrics
DrawIcon
GetIconInfo
ExitWindowsEx
CharLowerW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetWindowLongW
SetWindowLongW
SendMessageTimeoutW
IntersectRect
GetWindow
CharLowerA
GetKeyboardState
DispatchMessageW
CreateDesktopW
SetProcessWindowStation
EqualRect
CharLowerBuffA
GetShellWindow
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
GetDC
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
OpenWindowStationW
FillRect
GetWindowInfo
DrawEdge
GetSubMenu
RegisterClassA
GetWindowThreadProcessId
DefFrameProcW
DefWindowProcW
CallWindowProcW
EndMenu
CallWindowProcA
SendMessageW
GetUserObjectInformationW
CloseWindowStation

advapi32

GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
AllocateAndInitializeSid
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
RegOpenKeyExW
GetSecurityDescriptorSacl
CheckTokenMembership
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
InitiateSystemShutdownExW
IsWellKnownSid
EqualSid
RegEnumKeyExW
ConvertSidToStringSidW

shlwapi

PathIsDirectoryW
UrlUnescapeA
StrStrIW
StrStrIA
StrCmpNIW
PathRenameExtensionW
PathIsURLW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
wvnsprintfW
PathQuoteSpacesW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

SetViewportOrgEx
GdiFlush
CreateDIBSection
SetRectRgn
SaveDC
RestoreDC
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
GetDIBits
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

listen
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
recvfrom
sendto
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
getaddrinfo
select
WSAGetLastError
getsockname
accept
getpeername
WSASend
closesocket
send
shutdown

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
PFXImportCertStore
CryptUnprotectData

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13a682ef44170d166e6008f58a33dfdf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 132KB - Virtual size: 131KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 132KB - Virtual size: 131KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB