6f20dd59fd14db1cfbf674303eed7ff9840116d616db5c41a163a9ba1a9763a6

Sharing

Copy URL

Twitter E-mail

General

Target

6f20dd59fd14db1cfbf674303eed7ff9840116d616db5c41a163a9ba1a9763a6
Size

205KB
MD5

53fd2f38a9a21edc100412b18dabfdf6
SHA1

7781682c91572601ac4f496a5a0e8e43d065f7de
SHA256

6f20dd59fd14db1cfbf674303eed7ff9840116d616db5c41a163a9ba1a9763a6
SHA512

37d17911622e46a51e816454e6037f4ce9bec150d69e738492d6efaa3b8490220c0a73fcdf4632d240ea76cfd44fdbf6024a9f7ceaf1f42a7ef80d96a7e63804
SSDEEP

6144:IRQGvzhO9cFHnjLDbvHQS2GElQziF2YwSB4y9YRQir2RT:IRQGv97HnfDrXsHwSBcRQi6RT

Score

N/A

Malware Config

Signatures

Files

6f20dd59fd14db1cfbf674303eed7ff9840116d616db5c41a163a9ba1a9763a6
.exe windows x86

3cb314f22cca8d0d26f6d5df06066862

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
ExitProcess
GetCommandLineW
SetErrorMode
GetCurrentProcess
SetEvent
GetModuleFileNameW
CreateEventW
GetFileAttributesExW
OpenEventW
DuplicateHandle
GetCurrentProcessId
GetThreadContext
SetThreadContext
GetProcessId
MapViewOfFile
UnmapViewOfFile
CreateRemoteThread
FlushInstructionCache
Process32FirstW
lstrcmpiA
WTSGetActiveConsoleSessionId
GetComputerNameW
GetVolumeInformationA
lstrcmpiW
GlobalMemoryStatusEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
InterlockedIncrement
InterlockedDecrement
GetPrivateProfileStringW
CopyFileW
GetPrivateProfileIntW
InterlockedExchange
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
MoveFileExW
GetUserDefaultUILanguage
GlobalLock
GlobalUnlock
GetCurrentThreadId
TlsGetValue
TlsSetValue
ResetEvent
TlsAlloc
TlsFree
VirtualQuery
GetModuleHandleA
GetTimeZoneInformation
ReadFile
Thread32Next
TerminateProcess
GetFileAttributesW
HeapCreate
HeapDestroy
ReadProcessMemory
Process32NextW
WaitForMultipleObjects
RemoveDirectoryW
LoadLibraryA
FindClose
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
GetProcAddress
SetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
GetVersionExW
MultiByteToWideChar
Sleep
VirtualFreeEx
WideCharToMultiByte
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetTickCount
GetModuleHandleW
CreateDirectoryW
WaitForSingleObject
HeapFree
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetSystemTime
CloseHandle
GetLastError
CreateFileW
LoadLibraryW
FreeLibrary
CreateMutexW
SetThreadPriority
GetCurrentThread
CreateFileMappingW

user32

GetWindowDC
FillRect
DrawEdge
BeginPaint
GetUpdateRect
IntersectRect
GetDCEx
PostThreadMessageW
EqualRect
PrintWindow
DefWindowProcW
GetMessageA
GetWindowRect
GetMessageW
SetCapture
GetParent
GetWindowInfo
GetClassLongW
GetCapture
GetAncestor
PeekMessageA
SetWindowPos
IsWindow
ReleaseCapture
SendMessageW
GetMessagePos
GetWindowThreadProcessId
GetUpdateRgn
MapVirtualKeyW
GetShellWindow
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
IsRectEmpty
EndPaint
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
DefMDIChildProcA
PostMessageW
GetKeyboardState
GetClipboardData
HiliteMenuItem
RegisterClassW
GetUserObjectInformationW
CallWindowProcA
EndMenu
ToUnicode
DrawIcon
GetIconInfo
GetCursorPos
GetSystemMetrics
ExitWindowsEx
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
GetDC
TranslateMessage
GetWindowLongW
CharLowerA
PeekMessageW
CallWindowProcW
DefFrameProcW
RegisterClassA
MapWindowPoints
ReleaseDC
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
CharLowerW
CharLowerBuffA
SetCursorPos

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
IsWellKnownSid
GetLengthSid
EqualSid
ConvertSidToStringSidW
InitiateSystemShutdownExW
RegEnumKeyExW

shlwapi

StrStrIW
StrStrIA
PathIsURLW
StrCmpNIW
PathQuoteSpacesW
PathRenameExtensionW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

ole32

CLSIDFromString
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoGetObject
StringFromGUID2

gdi32

DeleteObject
GetDIBits
GetDeviceCaps
CreateDIBSection
SelectObject
RestoreDC
SaveDC
CreateCompatibleDC
SetRectRgn
GdiFlush
DeleteDC
SetViewportOrgEx
CreateCompatibleBitmap

ws2_32

closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
setsockopt
shutdown
WSAEventSelect
recvfrom
sendto
getpeername
WSASend
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
send
listen
accept
WSAGetLastError
select
getaddrinfo
getsockname

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore

wininet

HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetOptionW
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
HttpQueryInfoA
InternetConnectA
InternetQueryOptionW

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3cb314f22cca8d0d26f6d5df06066862

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

psapi

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

Sections

.text Size: 194KB - Virtual size: 193KB

.data Size: 3KB - Virtual size: 10KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 194KB - Virtual size: 193KB

.data
Size: 3KB - Virtual size: 10KB

.reloc
Size: 7KB - Virtual size: 6KB