74812a897ea9d2f3212447f6804febb03feeb846384c5da901275e053dd67268

Sharing

Copy URL Twitter E-mail

General

Target

74812a897ea9d2f3212447f6804febb03feeb846384c5da901275e053dd67268
Size

260KB
MD5

0a71584ba252ecb035bb27fa85051f30
SHA1

7d50e2a0184c5490472c3ad0d36518094486ad89
SHA256

74812a897ea9d2f3212447f6804febb03feeb846384c5da901275e053dd67268
SHA512

4a47096fe19d4a768e100c44edd8aef5d14d8e454a6f30a39fa556d796e7dd0140c9a3d1ee9cab0d0d927e5e40315613881f9a25a6f5404c94a48da29c0bfa3b
SSDEEP

6144:EOHrLFboyWwjr6Y9elEh/K08QQlc7izf3F4APvEtyqcT:EOHnFgwjOYzqHp7HE5+

Score

N/A

Malware Config

Signatures

Files

74812a897ea9d2f3212447f6804febb03feeb846384c5da901275e053dd67268
.exe windows x86

1d7cb4364df7c167a6b72d0018cb1a1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

I_RpcGetBuffer
RpcAsyncGetCallStatus
RpcNsBindingInqEntryNameW
I_RpcBindingInqDynamicEndpointA
NdrRpcSsDisableAllocate
NdrCStdStubBuffer2_Release
RpcSmAllocate
NdrSimpleStructBufferSize

secur32

SetContextAttributesA
LsaGetLogonSessionData
LsaDeregisterLogonProcess
QuerySecurityPackageInfoA
ImpersonateSecurityContext
GetComputerObjectNameW
LsaRegisterLogonProcess
GetUserNameExA
LsaConnectUntrusted

oleaut32

VarI1FromBool
VarDecInt
VarUI8FromI1
VarBstrFromUI1
VarR8FromDisp
VarI4FromDec
VarCyCmp

rasapi32

RasGetAutodialAddressW
RasSetAutodialParamW
RasSetAutodialAddressW
RasGetErrorStringA
RasGetSubEntryHandleW
RasGetProjectionInfoA
RasEnumAutodialAddressesA
RasHangUpW
RasSetEntryDialParamsW
RasEnumConnectionsW

ole32

CoCreateInstance
OleCreateLinkToFile
OleCreateFromData
CoRevokeInitializeSpy
CoTestCancel
CoGetCallContext
CoRevokeClassObject
SetConvertStg
StgOpenStorageOnILockBytes
OleRegEnumFormatEtc
CoGetCurrentLogicalThreadId

shell32

SHAppBarMessage
ord240
ord129
SHFileOperationW
ord154
ExtractIconExW
SHGetDesktopFolder
ord701
ord688
ord21

imm32

ImmSetCompositionStringA
ImmGetCandidateListA
ImmSetConversionStatus
ImmInstallIMEW
ImmUnregisterWordW
ImmGetImeMenuItemsW
ImmRegisterWordW
ImmGetContext
ImmInstallIMEA
ImmAssociateContext
ImmNotifyIME

glu32

gluDisk
gluNewNurbsRenderer
gluGetNurbsProperty
gluUnProject
gluBeginPolygon
gluPerspective
gluBeginSurface
gluQuadricCallback
gluLoadSamplingMatrices
gluEndPolygon
gluNurbsSurface

opengl32

glRasterPos3fv
glTexCoord3iv
wglRealizeLayerPalette
glPushName
glArrayElement

msvcrt

strchr
towupper
sprintf
wcschr
isxdigit
islower
toupper
_mbctoupper
_exit
isspace
swscanf
iswlower

wininet

HttpSendRequestW
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoW
FtpOpenFileW
FtpOpenFileA

shlwapi

ord29
PathRemoveFileSpecW
ord10
PathIsURLA
PathRelativePathToA
ord15
IsCharSpaceA
PathMatchSpecW
ord8
PathIsFileSpecA
PathIsUNCServerA
PathIsLFNFileSpecW
PathFindExtensionW
PathIsNetworkPathW
ord7
PathAddExtensionA

comctl32

ImageList_ReplaceIcon
ImageList_Create
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_Read
PropertySheetA
ImageList_GetIcon
InitCommonControlsEx
ImageList_Destroy
CreateStatusWindowW

kernel32

GetSystemTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
CreateProcessA
GetCurrentThreadId
FreeResource
GetComputerNameW
FindResourceExA
CreateEventW
GetLocaleInfoW
SetFileAttributesW
OutputDebugStringW
GetCurrentProcess
TerminateProcess

gdi32

GetBitmapBits
CloseEnhMetaFile
CreateBitmap
GetMapMode
CreateBitmapIndirect
GetTextExtentPoint32W
ScaleViewportExtEx
StretchBlt
RoundRect
SetRectRgn
OffsetRgn
GetTextExtentPointW

comdlg32

GetOpenFileNameA
FindTextA
PrintDlgW
PrintDlgExA
ChooseColorW
ChooseFontA
ChooseFontW
CommDlgExtendedError
GetFileTitleA
FindTextW
PrintDlgExW
GetSaveFileNameA

advapi32

ReadEventLogW
CredEnumerateA
AccessCheckByTypeAndAuditAlarmW
ImpersonateSelf
EncryptFileA
BuildExplicitAccessWithNameW
CreateServiceA
LsaRetrievePrivateData
SetEntriesInAclW
RegCreateKeyA

Exports

Exports

BlatBatsLipegatslavalearminxCurtzipxi
HermDormKeirjefeGeumWhaprodeDaftZoonsopsBirlSabsprowBotanthye
LimyGoesOgamkoannologinsDiffLimasat
LitePupsSoullobofirmrote
PartBrincainEwerSurfHautbarmHutsSardThanSacsWackWoldSarkwaget
StudGuckDossGladGedsloof
WolfLaicTakaBackGushDogsAvosbiffloosdameitsox
YillMurabirlSicsDovevow

Sections

.text
Size: - Virtual size: 512B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d7cb4364df7c167a6b72d0018cb1a1c

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

secur32

oleaut32

rasapi32

ole32

shell32

imm32

glu32

opengl32

msvcrt

wininet

shlwapi

comctl32

kernel32

gdi32

comdlg32

advapi32

Exports

Exports

Sections

.text Size: - Virtual size: 512B

.rdata Size: 246KB - Virtual size: 246KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: - Virtual size: 512B

.rdata
Size: 246KB - Virtual size: 246KB

.reloc
Size: 12KB - Virtual size: 12KB