81645bd5d433e86b4523ae557562eb44978ca17645d93fbbb8e7535bb57be26f

Sharing

Copy URL Twitter E-mail

General

Target

81645bd5d433e86b4523ae557562eb44978ca17645d93fbbb8e7535bb57be26f
Size

116KB
MD5

d89894b516ebca39f611f1b499d2af91
SHA1

a56d2599d9a36f77e07a26762fe1173b7fdcf45e
SHA256

81645bd5d433e86b4523ae557562eb44978ca17645d93fbbb8e7535bb57be26f
SHA512

de2e0c64514ccb080412df3a2755fed93464d0cc2dda8bf4fa796d95b381298ba0fdcc2806de333f36aa29bbfd41b52af400e3deea74e7ed15f367399f8f20c3
SSDEEP

3072:yQnv93TdydkTQ9BowKjWxSWKXZzeoNNKH12uIa4KD:yQnF3Mdk0MO8ioLKV2q4KD

Score

N/A

Malware Config

Signatures

Files

81645bd5d433e86b4523ae557562eb44978ca17645d93fbbb8e7535bb57be26f
.dll windows x86

5a270a5062052a703aa49ae2f8a7b7bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetTapeParameters
GetLargestConsoleWindowSize
VirtualQuery
SetVolumeMountPointW
VerLanguageNameW
GetSystemTimeAsFileTime
IsBadStringPtrA
FatalAppExitW
QueryDosDeviceA
GlobalReAlloc
SetFilePointerEx
GetProcAddress
SetPriorityClass
GetLocalTime
GetVolumePathNameA
EnumDateFormatsExA
GetShortPathNameA
SetEvent
_hread
GetCommMask
DuplicateConsoleHandle
SetConsoleOutputCP
FreeConsole
GetVersionExW
IsBadStringPtrW
GetVersion
TransmitCommChar
CancelWaitableTimer
ReadConsoleOutputCharacterW
GetVolumePathNameW
LoadLibraryW
GetConsoleAliasesA
AssignProcessToJobObject
HeapAlloc
GetTickCount
SetThreadPriority
Process32NextW
WriteFile
FindFirstFileExA
GetConsoleTitleA
TlsAlloc
ChangeTimerQueueTimer
GetTapeParameters
GetLongPathNameW
GetProfileIntA
CallNamedPipeA
WriteConsoleInputVDMW
FreeLibrary
GetConsoleInputExeNameA
IsBadCodePtr
DuplicateHandle
GetFullPathNameW
WriteConsoleOutputW
EnumResourceNamesW
GetSystemTime
FlushInstructionCache
OpenConsoleW
VerLanguageNameA
VirtualAlloc
GetModuleHandleA
GetHandleInformation
IsValidLocale
FindNextFileW
LoadLibraryA

advapi32

SystemFunction013
InitiateSystemShutdownW
ConvertSidToStringSidW
ObjectCloseAuditAlarmW
SetSecurityDescriptorDacl
LsaCreateTrustedDomain
GetUserNameW
CryptExportKey
SetEntriesInAccessListA
CloseServiceHandle
LsaEnumerateTrustedDomains
SetKernelObjectSecurity
LsaLookupNames
BuildTrusteeWithSidW
CreateServiceW
AreAnyAccessesGranted
OpenBackupEventLogW
AreAllAccessesGranted
TrusteeAccessToObjectW
RegCreateKeyW
GetSidLengthRequired
GetMultipleTrusteeOperationW
RegReplaceKeyW
GetNamedSecurityInfoExW
SetSecurityDescriptorOwner
SetServiceObjectSecurity
LsaICLookupSids
AddAce
GetMultipleTrusteeW
DecryptFileA
SystemFunction007
SystemFunction001
BuildImpersonateTrusteeA
AccessCheckAndAuditAlarmA
LogonUserW
RegOverridePredefKey
CryptDestroyHash
CreateServiceA
ObjectDeleteAuditAlarmA
LsaEnumeratePrivileges
CryptEnumProvidersA
InitiateSystemShutdownA
LsaDelete
LookupAccountSidW
LsaEnumerateTrustedDomainsEx

shell32

StrRStrA
ExtractAssociatedIconExA
SHAppBarMessage
StrCmpNIA
StrCmpNA
SHGetSpecialFolderLocation
DuplicateIcon
ShellAboutW
SHQueryRecycleBinA
DragQueryPoint
RegenerateUserEnvironment
SheGetDirA
SHGetSpecialFolderPathW
StrRChrIA
Shell_NotifyIconW
SHGetDataFromIDListA
SHFileOperationW
SHBrowseForFolderA
SheChangeDirExW
StrRStrIA
DoEnvironmentSubstW
StrStrA
ShellHookProc
ExtractIconExA
DragQueryFileAorW
ShellAboutA
SheChangeDirA
CheckEscapesW
ExtractIconW
SHEmptyRecycleBinW
StrNCmpIW
SHAddToRecentDocs
Shell_NotifyIconA
SHLoadInProc
DragFinish
SHGetFileInfoA
StrRStrIW
StrNCmpA
SHUpdateRecycleBinIcon
StrRStrW
StrChrIA
ord179
ExtractIconA
SHChangeNotify
StrNCmpIA
InternalExtractIconListA
SheSetCurDrive
DragQueryFileA
DoEnvironmentSubstA
SHFreeNameMappings
StrCmpNIW
SHGetPathFromIDListA
FreeIconList
SHGetSettings
SHEmptyRecycleBinA
SHGetSpecialFolderPathA
StrChrA
SHFileOperationA
DragAcceptFiles
StrRChrW
StrStrIA
WOWShellExecute
ExtractAssociatedIconExW
CommandLineToArgvW
StrChrIW
StrStrW
SHInvokePrinterCommandA
SHGetDesktopFolder
StrChrW
SHGetFileInfoW
ord180
SHGetMalloc
FindExecutableA
SHGetInstanceExplorer
ExtractIconExW
StrStrIW
SHFormatDrive
StrNCmpW
SHQueryRecycleBinW
SHGetDataFromIDListW
ExtractAssociatedIconA
ExtractAssociatedIconW
SHInvokePrinterCommandW
FindExecutableW
SHGetPathFromIDListW
DragQueryFileW
SHGetDiskFreeSpaceA
InternalExtractIconListW

shlwapi

PathMakeSystemFolderA
StrSpnA
StrFromTimeIntervalW
SHDeleteEmptyKeyW
PathIsDirectoryW
PathCreateFromUrlA
PathAppendA
UrlGetPartW
PathCanonicalizeA
StrNCatW
PathIsPrefixW
PathIsUNCServerW
SHRegEnumUSKeyA
PathRemoveArgsA
SHSetValueW
SHRegWriteUSValueA
StrIsIntlEqualA
StrPBrkA
PathIsContentTypeW
PathFindNextComponentA
PathCompactPathExA
PathAddBackslashA
StrFromTimeIntervalA
PathMakeSystemFolderW
UrlIsW

version

VerInstallFileW
VerFindFileA
GetFileVersionInfoSizeA
VerInstallFileA
GetFileVersionInfoSizeW
VerFindFileW
GetFileVersionInfoW

winspool.drv

SetJobW
GetPrinterDriverW
AddFormA
OpenPrinterA
ord210
DeletePrinterConnectionW
CommitSpoolData
DocumentPropertiesA
PrinterMessageBoxW
ord213
SplDriverUnloadComplete
EnumPrinterKeyA
ord202
StartDocPrinterA
SetPrinterDataExW
AddPrinterConnectionW
ReadPrinter
AddPortExW
StartDocDlgW
SpoolerPrinterEvent
AddPrintProcessorW
AdvancedSetupDialog
EnumPortsA
FindNextPrinterChangeNotification
AddPortA
PlayGdiScriptOnPrinterIC
GetPrinterDataA
ConvertUnicodeDevModeToAnsiDevmode
EnumPrintProcessorDatatypesA
EnumFormsA
GetSpoolFileHandle
DevQueryPrintEx
GetPrinterDriverDirectoryW
DeleteMonitorA
ConvertAnsiDevModeToUnicodeDevmode

msvcrt

_mbsspn
_mbsnbcat
_mbsnicoll
_mbsnbset
sqrt
swscanf
fclose
_CItan
labs
ftell
_unlink
memset
_mbsnbcnt
_getdcwd
_close
_local_unwind2
_wexecvpe
strpbrk
__p__tzname
iswpunct
__badioinfo
__p__mbcasemap
_winminor
_CItanh
__p___wargv
_ismbckata
_CIlog10
_tzset
feof
_fdopen
_wopen
_chsize
fopen
_mbstok
_getsystime
_dup2
_popen
_adj_fdiv_m32i
_wfindfirsti64
fprintf
_seh_longjmp_unwind
_XcptFilter
isgraph
perror
strtol
_j0
isalnum
_mbsbtype
__p__mbctype
strncpy
strrchr
_wstrtime
fread
_execlpe
_heapused
iswlower
_pipe
strcmp
_wctime
_strtime
__winitenv
tanh
printf
_wunlink
_wfullpath
_chmod
__p__commode
fwprintf
acos
_findfirsti64
_wfopen
fseek
_ismbcprint
_cgets
ferror
atan
wcsstr
_chkesp
_execl
_wfdopen
_strdate
_wmkdir
fputc
swprintf
fwrite
rewind
toupper
__lconv_init
sprintf
fputs
fsetpos
difftime
_tolower
longjmp

Exports

Exports

Gsmhdwl
Jdmibqjzel
Lrvpclvx
Rbrud
Udwu
Vtzzruofc
Yvnqqd

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a270a5062052a703aa49ae2f8a7b7bc

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

version

winspool.drv

msvcrt

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 52KB - Virtual size: 49KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 52KB - Virtual size: 49KB

.reloc
Size: 8KB - Virtual size: 5KB