87134d9b4d9ce78f0e80d78558b622c5b761445aca6d99bd6992098d0d1e9496

Sharing

Copy URL Twitter E-mail

General

Target

87134d9b4d9ce78f0e80d78558b622c5b761445aca6d99bd6992098d0d1e9496
Size

78KB
MD5

56ac0ccdf6cdbf18319d835849668e7b
SHA1

2daf4630155ebe259a249b1c1dccf2a0091aac7b
SHA256

87134d9b4d9ce78f0e80d78558b622c5b761445aca6d99bd6992098d0d1e9496
SHA512

bd923fc9c7f789cc5bb31636490a72af68b3abad352032e90a489eee5faa253e6255a29f5e3236a7775c1078d270fb0f0961e049117bcac5f204d5d200575e84
SSDEEP

1536:faHwDfzaWBDROPfQbM1508K6OeeYEgHSalGb4C6+acZK6NWIOTnToIftkfrcSdZb:0cuabMs8K6mgkw+acZK6ejTBftkfrcSn

Score

N/A

Malware Config

Signatures

Files

87134d9b4d9ce78f0e80d78558b622c5b761445aca6d99bd6992098d0d1e9496
.dll windows x86

150ee3f81ea71b3fe733dbdddce3e2bf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
SetLastError
MoveFileExA
GetTickCount
GetSystemDirectoryA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatus
MoveFileA
GetVersionExA
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
OpenProcess
Process32Next
lstrlenA
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
lstrcmpiA
GetCurrentThreadId
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
CancelIo
InterlockedExchange
lstrcpyA
ResetEvent
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ResumeThread
CreateEventA
SetEvent
WaitForSingleObject
TerminateThread
CloseHandle
GetACP

user32

wsprintfA
SetProcessWindowStation
OpenWindowStationA
CharNextA
GetProcessWindowStation
IsWindow
SendMessageA
CloseWindow
GetMessageA
DispatchMessageA
TranslateMessage
CreateWindowExA
OpenDesktopA
OpenInputDesktop
GetThreadDesktop
GetUserObjectInformationA
SetThreadDesktop
CloseDesktop

advapi32

ClearEventLogA
OpenEventLogA
CloseEventLog
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegEnumKeyExA
RegEnumValueA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegisterServiceCtrlHandlerA
SetServiceStatus
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation

msvcrt

_strrev
_strnicmp
_strcmpi
_itoa
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
__CxxFrameHandler
_EH_prolog
memmove
ceil
_ftol
strlen
strstr
strcat
memcmp
_CxxThrowException
free
malloc
_except_handler3
strrchr
strcmp
strcpy
strncpy
strchr
strncat
realloc
atoi
wcstombs
_beginthreadex

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

ICCompressorFree
ICSeqCompressFrameEnd
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrame

winmm

waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs

wsock32

getsockname
gethostname
send
select
recv
ntohs
closesocket
socket
gethostbyname
WSAStartup
WSACleanup
setsockopt
htons

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

Exports

Exports

ServiceMain
house

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

150ee3f81ea71b3fe733dbdddce3e2bf

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

avicap32

msvfw32

winmm

wsock32

msvcp60

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 50KB - Virtual size: 49KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB