70bbc000baba78bfd8342ec1d5ef41a15b1143caf8f916152f20e806ca41e7af

Sharing

Copy URL Twitter E-mail

General

Target

70bbc000baba78bfd8342ec1d5ef41a15b1143caf8f916152f20e806ca41e7af
Size

128KB
MD5

fcce4c1b1776d3241334b78521b8dbac
SHA1

4eac92a7da9de61e43be9a6720ca646515827994
SHA256

70bbc000baba78bfd8342ec1d5ef41a15b1143caf8f916152f20e806ca41e7af
SHA512

86c2d17c3839960ef95a308f469420f28ac0247510ed49129ee557b83495d240cd06a7f09e5122a45237ee0a62411598bf7cec559357e3a8384a693d925c218b
SSDEEP

3072:BtYf834RopgyKT2nUBHb51b3JIxPZGkGyG+Yn/4EoE/83NSTSP:r2834c42nUz1WGyF84uMDP

Score

N/A

Malware Config

Signatures

Files

70bbc000baba78bfd8342ec1d5ef41a15b1143caf8f916152f20e806ca41e7af
.dll windows x86

124c26f6f7d67331b1f92278b949cbcc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateWaitableTimerW
GetVolumeInformationW
OutputDebugStringA
GetAtomNameW
SetFilePointerEx
VirtualUnlock
EnumResourceTypesW
VirtualProtect
IsValidLocale
PostQueuedCompletionStatus
WriteConsoleOutputCharacterA
GetVersionExA
ShowConsoleCursor
LocalFlags
SetComputerNameA
ResumeThread
AddAtomA
GetVersion
BuildCommDCBW
DeleteVolumeMountPointW
EndUpdateResourceA
ReadConsoleInputW
GetVDMCurrentDirectories
Module32Next
GetAtomNameA
SetVolumeMountPointA
DisconnectNamedPipe
ReadConsoleOutputCharacterW
SetCriticalSectionSpinCount
ReadDirectoryChangesW
UTUnRegister
GetShortPathNameW
RtlZeroMemory
GetCurrentProcessId
EraseTape
VerLanguageNameA
SetSystemPowerState
GetLastError
UpdateResourceW
GetExitCodeProcess
CreateFileMappingA
_llseek
SearchPathW
DuplicateHandle
RemoveDirectoryA
OpenProfileUserMapping
SetThreadAffinityMask
SetThreadLocale
ExpungeConsoleCommandHistoryW
LoadResource
WaitForMultipleObjectsEx
SetComputerNameW
GetQueuedCompletionStatus
OpenFileMappingA
GetProcAddress
GetProcessAffinityMask
CreateFileA
HeapFree
LoadLibraryA
GetCommMask
CreateJobObjectA
GetFileAttributesExA
GetConsoleAliasA
ContinueDebugEvent
SetVDMCurrentDirectories
FoldStringW
OpenProcess
GetSystemTime
CreateHardLinkA
CancelTimerQueueTimer
SetCommTimeouts
CreateProcessA
WriteFileGather
GetSystemDefaultLCID
CompareStringW
SetThreadContext
SetMailslotInfo
GetConsoleCursorInfo
GetConsoleInputWaitHandle
VerLanguageNameW
VirtualAllocEx
GetCurrentProcess
SetConsoleCursorPosition
BackupWrite
GetPrivateProfileIntW
SetConsoleNumberOfCommandsW
SetTimeZoneInformation
SetLastConsoleEventActive
QueryDosDeviceW
CreateHardLinkW
Thread32Next
LocalAlloc
SetFileTime
GetConsoleFontSize
Heap32First
BuildCommDCBA
CreatePipe
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
CommConfigDialogA
OpenEventA
VirtualAlloc
GetHandleInformation

advapi32

SetUserFileEncryptionKey
CreateServiceW
ReportEventA
GetAccessPermissionsForObjectA
CryptHashData
ConvertSecurityDescriptorToAccessW
StartServiceCtrlDispatcherW
BuildTrusteeWithNameA
SystemFunction003
SystemFunction031
BuildTrusteeWithNameW
GetUserNameA
BackupEventLogW
GetTrusteeNameA
BuildImpersonateExplicitAccessWithNameW
SystemFunction004
DestroyPrivateObjectSecurity
SetKernelObjectSecurity
CreateRestrictedToken
GetTrusteeFormA
ChangeServiceConfigW
ChangeServiceConfig2W
LsaEnumeratePrivilegesOfAccount
LsaLookupSids
SetThreadToken
RegEnumValueA
CryptSetProvParam
ClearEventLogA
AccessCheckByTypeAndAuditAlarmW
GetTrusteeTypeW
ConvertSidToStringSidW
SystemFunction030
AreAllAccessesGranted
GetServiceDisplayNameW
CryptHashSessionKey
ConvertAccessToSecurityDescriptorA
AccessCheckAndAuditAlarmW
LsaEnumeratePrivileges
LsaSetInformationPolicy
RegUnLoadKeyW
ConvertStringSidToSidA
GetNamedSecurityInfoA
InitializeSecurityDescriptor
AddAccessAllowedObjectAce
GetSecurityInfo
CryptContextAddRef
EnumDependentServicesW
LsaSetDomainInformationPolicy
SetEntriesInAccessListW
SetFileSecurityA
CryptGetDefaultProviderW
GetOverlappedAccessResults
SystemFunction019
CryptSetProviderExA
AccessCheckByTypeResultListAndAuditAlarmW
ElfBackupEventLogFileA
LsaQuerySecret
GetFileSecurityW
AccessCheckByTypeResultList
SetNamedSecurityInfoExW
CryptDestroyHash
RegConnectRegistryW
GetEffectiveRightsFromAclW
SetSecurityInfoExW
EqualPrefixSid
MakeSelfRelativeSD
DeleteService
RegRestoreKeyA
CryptDecrypt
IsValidSid
FileEncryptionStatusW
LsaRetrievePrivateData
GetExplicitEntriesFromAclA
LsaCreateTrustedDomain
MakeAbsoluteSD
SystemFunction011
SetFileSecurityW
LsaRemoveAccountRights
BackupEventLogA
GetExplicitEntriesFromAclW
GetKernelObjectSecurity
GetSecurityDescriptorControl
RegCloseKey
SystemFunction025
DecryptFileW
CloseServiceHandle
SystemFunction010
BuildSecurityDescriptorW
SetSecurityInfo
GetUserNameW
ImpersonateLoggedOnUser
GetOldestEventLogRecord
GetMultipleTrusteeA
QueryServiceObjectSecurity
SystemFunction017
GetFileSecurityA
LsaEnumerateTrustedDomains
CryptEnumProvidersW
LsaGetSystemAccessAccount
OpenBackupEventLogA
RegQueryValueW
GetSecurityDescriptorLength

opengl32

glCopyTexImage2D

shell32

StrStrW
StrChrIW
SHGetDataFromIDListW
StrCmpNIA
StrCmpNW
DragQueryPoint
WOWShellExecute
SHBrowseForFolderW
Shell_NotifyIconW
SHInvokePrinterCommandW
InternalExtractIconListA
ExtractIconExW
DragQueryFileAorW
CheckEscapesW
ExtractAssociatedIconExA
StrStrIW
StrRChrW
StrRStrW
FreeIconList
StrChrW
CommandLineToArgvW
Shell_NotifyIconA
RealShellExecuteA
SHQueryRecycleBinW
StrNCmpIA
SHGetPathFromIDListW
SHGetFileInfoW
SHQueryRecycleBinA
FindExecutableW
ShellAboutW
SHUpdateRecycleBinIcon
ShellExecuteA
StrRChrIW
SHFileOperationW
SHGetSpecialFolderLocation
SHGetFileInfoA
SHAddToRecentDocs
DuplicateIcon
SHAppBarMessage
DragFinish
StrNCmpW
SHGetDataFromIDListA
SHBrowseForFolderA
StrChrA
StrCmpNIW
StrRStrIW
DragQueryFileW
SHGetInstanceExplorer
ExtractIconExA
RealShellExecuteW
SHFormatDrive
FindExecutableA
ExtractIconW
InternalExtractIconListW
RealShellExecuteExW
StrStrIA
DoEnvironmentSubstW
ShellHookProc
ExtractAssociatedIconExW
RegenerateUserEnvironment
StrNCmpA
DragQueryFileA
ord180
SHGetDesktopFolder
StrChrIA
SheSetCurDrive
ShellExecuteExW
SheChangeDirExW
SHGetPathFromIDListA
SHGetSettings
DoEnvironmentSubstA
ShellExecuteExA
StrRStrIA
StrRChrIA
SHLoadInProc
StrRChrA
RealShellExecuteExA
ExtractAssociatedIconA
ShellExecuteW
ExtractAssociatedIconW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ExtractIconA
SHEmptyRecycleBinW
ord179
SHChangeNotify
SHFreeNameMappings
StrNCmpIW
SHGetMalloc
SHGetDiskFreeSpaceA
ShellAboutA
SHEmptyRecycleBinA
StrRStrA
StrStrA
SHFileOperationA
SheGetDirA
DragAcceptFiles
SHInvokePrinterCommandA
SheChangeDirA
StrCmpNA

shlwapi

SHGetValueA
PathRemoveBlanksA
PathUnmakeSystemFolderA
UrlHashA
SHOpenRegStreamW
SHQueryInfoKeyW
PathGetDriveNumberA
SHRegSetUSValueW
UrlGetPartW
SHDeleteKeyA
StrFromTimeIntervalA
UrlIsOpaqueA
PathCreateFromUrlA
SHRegEnumUSValueW
StrPBrkW
PathCanonicalizeA
UrlGetPartA
PathSearchAndQualifyA
StrCSpnIA
StrToIntExW
SHCreateShellPalette
UrlHashW
PathCompactPathExW
PathStripPathW
StrToIntW

version

GetFileVersionInfoSizeA
VerInstallFileA
VerFindFileW
GetFileVersionInfoW
GetFileVersionInfoA
VerInstallFileW
VerFindFileA
VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeW

winmm

waveOutRestart
waveOutGetPosition
mciSetYieldProc
NotifyCallbackData
mci32Message
mciGetDriverData
midiInAddBuffer
midiStreamOut
mciDriverYield
waveInUnprepareHeader
mmioRenameW
joyGetThreshold
midiInMessage
midiStreamStop
midiInPrepareHeader
aux32Message
joyGetDevCapsW
midiInGetDevCapsW
mixerMessage
mmioWrite
midiConnect
mmioClose
waveOutGetErrorTextW
waveInReset
sndPlaySoundW
timeGetSystemTime
midiOutGetErrorTextW
mmTaskBlock
midiOutMessage
waveOutSetPlaybackRate
waveOutOpen
midiOutOpen
mmioDescend
mmioCreateChunk
auxSetVolume
midiInClose
WOW32ResolveMultiMediaHandle
waveOutGetDevCapsA
timeGetDevCaps
mmioOpenW
mixerGetDevCapsW

msvcrt

_mbscmp
_mbsnicmp
_mbsrev
_mbsncmp
getwc
_mbsnbset
_outpd
_safe_fprem
_getcwd
__initenv
swscanf
iswctype
__set_app_type
feof
_itow
ftell
_kbhit
_wsplitpath
_winver
_wcsnicoll
_mbsncpy
difftime
_inp
_memicmp
_findclose
fseek
_set_sbh_threshold
memset
_amsg_exit
_wgetenv
_mbsnbicoll
strtok
_getdcwd
_pwctype
_isnan
_wstati64
_read
atexit
_mbsset
strncpy
_wstrtime
_fpreset
_mbsnbcpy
wcstoul
_gcvt
_CIatan
tanh
_spawnlp
_ismbbkprint
_mbslen
_getws
cos
_cscanf
strerror
fmod
_scalb
tmpnam
_getche
_adj_fdivr_m16i
_findfirsti64
_dup2
_adj_fprem
_itoa
_makepath
_HUGE
_wutime
_unlink
_atoldbl
freopen
iswxdigit
_strnicmp
_eof
fclose
_CIexp
_CIcos
_exit
log10
__unDName
_ismbcl1
wprintf
wcstod
_loaddll
sin
_wfindfirsti64
fsetpos
_wcsdup
_putenv
_wfindnext
fwprintf
fputc
fprintf
_CItanh
fputs
_endthreadex
_rotr
wcscoll
_findnext
getc
_mbsnbcmp
_adj_fpatan
_vsnprintf
sinh
__argv
tmpfile
__badioinfo
printf
sprintf
_ismbcdigit
_CIsqrt
fread
labs
ferror
longjmp
_mbsrchr
__p__daylight
vfwprintf
_open_osfhandle
_creat
_isatty
towlower
_utime
_chgsign
fwrite
__p___argc
fopen

Exports

Exports

Azbxt
Dgirhfikf
Elcnkkrxm
Fpfq
Jpafvgwr
Kefurmsezc
Xwjvr
Xymyeh
Yibeof
Yiiqtadjq

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

124c26f6f7d67331b1f92278b949cbcc

Headers

File Characteristics

Imports

kernel32

advapi32

opengl32

shell32

shlwapi

version

winmm

msvcrt

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 56KB - Virtual size: 52KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 56KB - Virtual size: 52KB

.reloc
Size: 8KB - Virtual size: 6KB