8621b7642585a3593ba255036a91b1f7a662f0d0b96d2d01841f5fc337051a6b

Sharing

Copy URL

Twitter E-mail

General

Target

8621b7642585a3593ba255036a91b1f7a662f0d0b96d2d01841f5fc337051a6b
Size

211KB
MD5

2a41439fb1e06c9cd8b0c2061c8363f0
SHA1

67b84b0a109b5c405a265cb1480784a8620912f2
SHA256

8621b7642585a3593ba255036a91b1f7a662f0d0b96d2d01841f5fc337051a6b
SHA512

3059d5087c3c77a2a2d25a7155e3b0d147dca142e15b42a75d8b9a04e5f60cddb8d426a1be597a052b3bcfd90352596dfdc36cfbed6e1e1e9ee9e6a7741870ef
SSDEEP

6144:ymWqqDLM0j5ZvxRZ2G+SoSMfF18UOXbegzpVihQ5Vq8EXO5f0z:ymTqnM0jrjZ2GroSMfF18Zegyin5cz

Score

N/A

Malware Config

Signatures

Files

8621b7642585a3593ba255036a91b1f7a662f0d0b96d2d01841f5fc337051a6b
.exe windows x86

b73cf000a033f8529f2c0b584b6ecc0b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
lstrcpynW
Thread32Next
GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
QueryDosDeviceW
WaitForMultipleObjects
FindNextFileW
VirtualProtect
GetFileTime
GetEnvironmentVariableW
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
WriteProcessMemory
VirtualQueryEx
GetModuleFileNameW
GetUserDefaultUILanguage
ExitProcess
GetCommandLineW
lstrcmpiA
WTSGetActiveConsoleSessionId
ResetEvent
GetLocalTime
GetFileAttributesExW
GetNativeSystemInfo
GetVersionExW
GetThreadContext
SetThreadContext
GetProcessId
OpenEventW
SetErrorMode
GetComputerNameW
DuplicateHandle
GetCurrentProcessId
GetModuleHandleA
TlsGetValue
TlsSetValue
VirtualFreeEx
CreateRemoteThread
ExpandEnvironmentStringsW
LocalFree
LoadLibraryW
GlobalUnlock
GetTickCount
GlobalLock
CreatePipe
ReadFile
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
SetEndOfFile
FindFirstFileW
HeapReAlloc
GetTempFileNameW
SetFileAttributesW
FileTimeToDosDateTime
SetHandleInformation
CreateProcessW
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
WriteFile
GetPrivateProfileStringW
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrcmpiW
LoadLibraryA
GetProcAddress
FreeLibrary
CreateThread
GetSystemTime
ExitThread
CreateMutexW
GetCurrentProcess
DeleteFileW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
TerminateProcess
Sleep
OpenProcess
MoveFileExW
TlsFree
CloseHandle
TlsAlloc
GetCurrentThreadId
CreateEventW
CreateFileMappingW
SetThreadPriority
GetCurrentThread
SetEvent
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
ReleaseMutex

user32

PostMessageW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetWindowLongW
CharLowerA
PeekMessageW
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
MapVirtualKeyW
GetKeyboardState
GetClipboardData
ToUnicode
DrawIcon
GetIconInfo
GetCursorPos
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
EndPaint
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
GetMessagePos
ReleaseCapture
PeekMessageA
GetDCEx
SetCursorPos
FillRect
DrawEdge
IntersectRect
EqualRect
PrintWindow
GetWindowRect
GetParent
GetWindowInfo
GetClassLongW
GetAncestor
SetWindowPos
IsWindow
MapWindowPoints
IsRectEmpty
ExitWindowsEx
MessageBoxA
GetKeyboardLayoutList
CharLowerBuffA
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
CloseDesktop
GetProcessWindowStation
SetThreadDesktop
OpenWindowStationW
TranslateMessage
GetSystemMetrics
MenuItemFromPoint
GetDC
GetMenu
GetMessageA
GetUpdateRgn
GetMessageW
GetWindowDC
SetCapture
BeginPaint
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
GetUserObjectInformationW
SendMessageW
GetUpdateRect
GetMenuItemID
GetCapture
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
CharLowerW

advapi32

RegCreateKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumValueW
RegCloseKey
RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
EqualSid
CreateProcessAsUserA
SetSecurityInfo
ConvertSidToStringSidW
IsWellKnownSid
InitiateSystemShutdownExW

shlwapi

PathCombineW
PathIsURLW
PathQuoteSpacesW
StrCmpNIW
PathRenameExtensionW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathAddExtensionW
PathUnquoteSpacesW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
StrStrIW
PathRemoveFileSpecW
StrStrIA
PathRemoveBackslashW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

CreateCompatibleBitmap
SelectObject
DeleteObject
GetDeviceCaps
DeleteDC
GetDIBits
CreateDIBSection
RestoreDC
SaveDC
SetRectRgn
GdiFlush
SetViewportOrgEx
CreateCompatibleDC

ws2_32

WSASend
getaddrinfo
inet_addr
getpeername
accept
listen
WSASetLastError
freeaddrinfo
recvfrom
WSAEventSelect
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
select
closesocket
gethostbyname
send
bind
recv
sendto
setsockopt
shutdown
getsockname
WSAGetLastError
socket

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
InternetSetStatusCallbackA
HttpEndRequestW
HttpAddRequestHeadersA
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetQueryOptionW
InternetOpenA

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

waveOutGetVolume
PlaySoundA
PlaySoundW
waveOutSetVolume

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b73cf000a033f8529f2c0b584b6ecc0b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 199KB - Virtual size: 199KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 199KB - Virtual size: 199KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 8KB