27259e8a60d8e8d7e16da7d901e42f6dff988e606ad4a977d9d54dceb6eb3686

Sharing

Copy URL Twitter E-mail

General

Target

27259e8a60d8e8d7e16da7d901e42f6dff988e606ad4a977d9d54dceb6eb3686
Size

587KB
MD5

013cc421894d7e8ccf9b7a0cd7b23573
SHA1

0ef9df76d8d933c1bb6dbf9b3b300ed7834c96fd
SHA256

27259e8a60d8e8d7e16da7d901e42f6dff988e606ad4a977d9d54dceb6eb3686
SHA512

de7891181800aa22620bd78ceb8fe175dee9c2b6b76a82701ca123ebff9e720b9bb8db32e731c8a8ff324ac19f17c7e3e9b4f0a9f714c00253571b6d7e9fc4db
SSDEEP

6144:ZsrG8vYU/rksp0PBtLuRLG4XGf5SnfrstXLFsPNFElrSgYcDsQSOrQdn5ozylVCT:XraidoMearuEcdQeSoLnhjig67ZZPSLK

Score

N/A

Malware Config

Signatures

Files

27259e8a60d8e8d7e16da7d901e42f6dff988e606ad4a977d9d54dceb6eb3686
.exe windows x86

872b0f55251a5a47e79bb9cc356038d3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
VirtualQueryEx
SetConsoleCP
CopyFileExW
GetUserDefaultLCID
SetProcessWorkingSetSize
DeleteCriticalSection
GlobalCompact
CmdBatNotification
GetCommConfig
GetEnvironmentStringsW
IsBadHugeWritePtr
SetStdHandle
PostQueuedCompletionStatus
GetLocalTime
BackupRead
EnumSystemLocalesW
GetTempPathA
GetConsoleAliasExesW
LoadLibraryA
FindCloseChangeNotification
InvalidateConsoleDIBits
ScrollConsoleScreenBufferA
SetFilePointerEx
WriteConsoleOutputAttribute
GetConsoleCP
DeleteFileA
InterlockedExchangeAdd
FindFirstVolumeW
GetFileAttributesExA
GlobalGetAtomNameW
RaiseException
GetModuleHandleA
SetInformationJobObject
GetSystemTime
RtlUnwind
GetThreadTimes
GetPrivateProfileSectionA
CancelWaitableTimer
GetNumberFormatA
GetVersion
GetCalendarInfoW
PurgeComm
_lopen
VirtualAlloc
GetProcAddress
IsValidLocale
GetHandleInformation

user32

SendMessageCallbackW
SetWindowPlacement
ClipCursor
DdeDisconnectList
SetClassWord
SetClipboardViewer
SendMessageCallbackA
IsClipboardFormatAvailable
SetMenuItemInfoA
OpenClipboard
CreateMenu
GetCapture
CopyRect
SetMessageQueue
SetActiveWindow
EnumPropsA
ModifyMenuW
IMPGetIMEW
CharUpperA
CharLowerW
ShowCursor
GetDoubleClickTime
FreeDDElParam
GetKeyboardLayoutNameA
SetUserObjectInformationA
GetThreadDesktop
SendMessageTimeoutA
DispatchMessageW
OemToCharA
SubtractRect
InsertMenuItemA
SetWindowWord
SetScrollInfo
PtInRect
GetTabbedTextExtentA
CharNextW
ShowWindow
GetClipboardOwner
DdeUnaccessData
SendDlgItemMessageA
TranslateMessage
WaitMessage
ReplyMessage
BeginDeferWindowPos
ChangeDisplaySettingsExA
IsWindowEnabled
CreateDialogIndirectParamW
BroadcastSystemMessageA
AllowSetForegroundWindow
TileChildWindows
GetWindowLongA
EnumDesktopsA
CreateAcceleratorTableA
CallWindowProcA
UserHandleGrantAccess
DrawTextA
EnumDisplayMonitors
SendIMEMessageExW
DefMDIChildProcW
SetWindowsHookExW
ChildWindowFromPointEx
keybd_event
IsDlgButtonChecked
GetKeyboardState
GetSubMenu
DdeCmpStringHandles
GetMenuItemInfoA
SetCursor
CharLowerBuffA
EnumWindows
ScrollWindow
PeekMessageW
MonitorFromWindow
SystemParametersInfoW
SetTimer
GetClassInfoExA
PackDDElParam
IsRectEmpty
DialogBoxParamA
GetForegroundWindow
DestroyIcon
CharPrevA
MoveWindow
EndDialog
DdeImpersonateClient

gdi32

GetStretchBltMode
UnrealizeObject
SelectPalette
DPtoLP

advapi32

SetEntriesInAccessListW
AccessCheckAndAuditAlarmW
QueryUsersOnEncryptedFile
RegSetValueA
AccessCheckAndAuditAlarmA
QueryServiceConfig2W
RegQueryValueExW
CryptEnumProvidersW
LsaSetTrustedDomainInfoByName
RegQueryMultipleValuesW
SetServiceObjectSecurity
SetServiceBits
CryptReleaseContext
ElfRegisterEventSourceW
SetServiceStatus
LsaQueryTrustedDomainInfo
RegEnumKeyExW
ConvertSecurityDescriptorToAccessW
RegEnumValueW
SystemFunction029
LsaOpenSecret
LsaEnumeratePrivileges
CryptSignHashW
SystemFunction006
LsaLookupPrivilegeDisplayName
LsaQueryInformationPolicy
GetSecurityDescriptorSacl
SetSecurityDescriptorOwner
FindFirstFreeAce
BuildTrusteeWithNameW
LsaRetrievePrivateData
RegQueryMultipleValuesA
SetNamedSecurityInfoExA
AddAccessAllowedObjectAce
ConvertSecurityDescriptorToStringSecurityDescriptorW
BuildSecurityDescriptorW
AbortSystemShutdownW
MakeAbsoluteSD
StartServiceCtrlDispatcherA
GetOverlappedAccessResults
CryptGenRandom
LogonUserA
GetAccessPermissionsForObjectA
GetSidSubAuthorityCount
SetNamedSecurityInfoW
TrusteeAccessToObjectA
AccessCheckByTypeResultList
ReadEventLogA
DecryptFileW
RegisterServiceCtrlHandlerW

comctl32

ImageList_SetOverlayImage
ImageList_DrawIndirect
ImageList_Merge
CreateToolbarEx
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
ImageList_LoadImageA
ord17
ImageList_DragLeave
FlatSB_GetScrollRange
ord7
FlatSB_SetScrollProp
ImageList_AddMasked
ord13
_TrackMouseEvent
ImageList_DragMove
ImageList_Replace
ord5
PropertySheetA
ImageList_Duplicate
ImageList_GetImageInfo
ImageList_ReplaceIcon
ImageList_Draw
FlatSB_ShowScrollBar
ord15
ImageList_Write
ImageList_BeginDrag
ImageList_Destroy
FlatSB_SetScrollRange
UninitializeFlatSB
ImageList_Remove
ord2

opengl32

wglSwapLayerBuffers
glPopMatrix
glMapGrid1d
glVertex4sv
glTexCoord4fv
glGetIntegerv
glShadeModel
wglMakeCurrent
glColor3ui
glPolygonOffset
glCopyTexImage2D
glMatrixMode
glColor3us
glClearColor
glColor4b
glTexGenfv
glGetPolygonStipple
glColor4uiv
glBitmap
glGetFloatv
glMultMatrixf
glOrtho
glGenLists
glTexCoord1iv
glRasterPos4s
glNormal3i
glEnable
wglSwapBuffers
glEvalMesh1
glColor3sv
glRasterPos2f
glStencilMask
glStencilOp
glVertex2dv
glMap2d
glColor3dv
glVertex3dv
glVertex2fv
glIndexf
glVertex4i
glVertex3iv
glCallList
glPushAttrib
glDrawPixels
glTexCoord3sv
glNewList
glPopName
glRectd
glIsTexture
glAreTexturesResident
glLightf
glInterleavedArrays
glTexCoord2sv
glTexCoord2s
glEdgeFlagv
glVertexPointer
glIndexsv
glColor4us
glCopyTexSubImage1D
glColor4iv
glIsEnabled
glSelectBuffer
glGetTexEnviv
glLightModeli
glTexCoord2dv
glRasterPos4fv
glTexParameterfv
glLineWidth
glRectf
glPixelTransferi
glDeleteTextures
glClipPlane
wglGetProcAddress
wglCopyContext
glPixelTransferf

winmm

auxGetDevCapsA
midiInGetErrorTextW
mmioDescend
midiOutLongMsg
mciExecute
mmioOpenW
mmTaskSignal
auxGetVolume
mixerMessage
mixerGetDevCapsA
mmTaskYield
mixerGetControlDetailsW
joySetCapture
mciGetErrorStringA
midiInGetID
midiInGetDevCapsW
DriverCallback
mmTaskCreate
waveInAddBuffer
WOWAppExit
timeEndPeriod
midiInStop
sndPlaySoundA
mmioInstallIOProcW
mmioWrite
auxOutMessage
waveInPrepareHeader
joy32Message
mixerGetControlDetailsA
waveInGetID
midiInGetNumDevs
waveOutPause
waveOutOpen
wod32Message
mciDriverNotify
mciSendStringW
mmDrvInstall
waveInMessage
mmioSetInfo
waveInStop
mid32Message
tid32Message
mmioStringToFOURCCA
midiOutCachePatches
midiOutClose
joyGetDevCapsA
waveInGetErrorTextW
mmioSeek
waveOutGetDevCapsW
midiOutPrepareHeader
mciSetYieldProc
midiConnect
midiStreamClose
mixerGetLineInfoW
mmioAscend
waveOutSetVolume
midiOutOpen
timeGetTime
waveOutGetID
PlaySoundW
mmioSetBuffer
mixerGetLineInfoA
mmioFlush
midiInReset
mciGetDeviceIDFromElementIDA
mciGetCreatorTask
waveOutPrepareHeader
auxGetDevCapsW
mixerGetLineControlsA
waveOutGetVolume
mciGetDeviceIDA
timeGetSystemTime
mod32Message
midiOutSetVolume
midiOutGetID
midiStreamStop
mmioClose
OpenDriver
waveInClose
midiInAddBuffer

winspool.drv

DeletePrintProcessorW
DeviceMode
GetPrinterDriverDirectoryA
ord103
EnumPrinterKeyW
SetPrinterDataExA
ord206
DeleteMonitorA
DeletePrinterDataExA
QueryColorProfile
DevicePropertySheets
DEVICECAPABILITIES
DeletePrinterDataA
EnumPrinterDataW
SetJobA
EnumFormsW
ord202
ord100
AdvancedSetupDialog
CloseSpoolFileHandle
ord204
GetPrintProcessorDirectoryW
ord205
DeletePrinterDataExW
ScheduleJob
SetPortW
GetPrinterDataW
GetFormA
StartDocDlgA
AddPrintProvidorA
DeleteFormW
EnumPrintProcessorsW
CommitSpoolData
DeletePrinterDriverW
AddPrinterDriverW
ConnectToPrinterDlg
DeletePrinter
SetFormW
AddMonitorW
ResetPrinterW
EnumMonitorsW
DeletePrinterConnectionA
GetSpoolFileHandle
EXTDEVICEMODE
EnumFormsA
EnumPrintProcessorDatatypesW
AddPortA
ExtDeviceMode
EnumPrintersW
ResetPrinterA
AddJobA
ord203
AddFormW
ord209
ord212
DocumentPropertiesW
SetPrinterDataExW
DeleteMonitorW
GetPrinterA
StartDocPrinterA
WaitForPrinterChange
ConvertAnsiDevModeToUnicodeDevmode
QuerySpoolMode
PrinterMessageBoxA
AddFormA
AddPrinterConnectionA
EnumPrinterDriversA
AdvancedDocumentPropertiesA
AddPortExW
EnumPrinterDriversW
AddPrintProvidorW
DeviceCapabilitiesA
StartDocDlgW

msvcrt

isspace
strtod
fwprintf
fclose
_adj_fptan
memset
_spawnvp
__unguarded_readlc_active
_unlink
_fullpath
fputc
_wcsnicoll
_seh_longjmp_unwind
_mbsicoll
iswspace
setbuf
fwrite
_memicmp
fsetpos
ftell
feof
fopen
calloc
_ismbcdigit
strstr
_cscanf
fgetws
fprintf
__lconv_init
_strdup
__p__environ
fputs
_fsopen
log
fread
sprintf
_acmdln
_mbsspnp
ferror
printf
_stricoll
fseek
_wexecle
_mbscoll
_mbsrchr
_mbschr
_mbsupr
_exit
_XcptFilter
exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 516KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

872b0f55251a5a47e79bb9cc356038d3

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

opengl32

winmm

winspool.drv

msvcrt

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 516KB - Virtual size: 514KB

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 516KB - Virtual size: 514KB