335128f4f7f5e32ed02c0f0b948e074b8ace726b7b0feb6b6f53e14fa7d7f5e4

Sharing

Copy URL

Twitter E-mail

General

Target

335128f4f7f5e32ed02c0f0b948e074b8ace726b7b0feb6b6f53e14fa7d7f5e4
Size

606KB
MD5

86051555d572f24401db5a6120a6cb40
SHA1

289db0ea053e77c16c6a0659f4218b819ba9b444
SHA256

335128f4f7f5e32ed02c0f0b948e074b8ace726b7b0feb6b6f53e14fa7d7f5e4
SHA512

130e4b8cc8ec654a0bb0172b98f1a3a2d116e171dc4e3136e2ee9197bef996a1f75e61f36d076cd4fb94149c156f6737cd378eb1aaf03da3b6e8b04c86d67dd5
SSDEEP

12288:Hnv4LU03L6Ebl3y3zge4k7gT1vVqLqHF8QMJ+48x:HnALfdl3y3zN4GU1v4LNQMJf0

Score

N/A

Malware Config

Signatures

Files

335128f4f7f5e32ed02c0f0b948e074b8ace726b7b0feb6b6f53e14fa7d7f5e4
.exe windows x86

426c0097d3532c3e0e52d0dd92cd0a87

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
GetCommandLineA
RegisterWaitForInputIdle
GetFileAttributesW
LocalFileTimeToFileTime
GetStartupInfoA
CreateSemaphoreW
ReleaseSemaphore
Beep
LoadLibraryA
FindNextVolumeW
MultiByteToWideChar
GetConsoleAliasExesLengthW
QueueUserAPC
SetConsoleCursorInfo
Module32FirstW
ShowConsoleCursor
GetCommandLineW
CreateJobObjectW
PeekNamedPipe
VirtualQueryEx
GetConsoleCP
EnumTimeFormatsW
WaitForMultipleObjects
Toolhelp32ReadProcessMemory
GetComputerNameA
SetConsoleInputExeNameW
DisconnectNamedPipe
RequestWakeupLatency
RtlFillMemory
FlushConsoleInputBuffer
CreateFileW
SetComputerNameW
DeleteAtom
_hwrite
SetSystemTimeAdjustment
SetCommConfig
HeapSize
HeapReAlloc
GetConsoleAliasesLengthA
SetFileAttributesA
GetStringTypeExA
VerifyConsoleIoHandle
WriteFileEx
GetFileAttributesA
LoadModule
GetThreadLocale
SetFileApisToOEM
PeekConsoleInputA
GetSystemTime
SetCommBreak
Heap32First
lstrcmpiA
FindFirstVolumeW
CompareStringW
GetVersion
FormatMessageW
CloseHandle
BuildCommDCBAndTimeoutsA
EnumDateFormatsW
SetComputerNameA
ScrollConsoleScreenBufferA
SetConsoleActiveScreenBuffer
WriteProcessMemory
GlobalWire
GetProcessAffinityMask
ConvertDefaultLocale
GetLocalTime
CreateNamedPipeA
GetCurrentThreadId
SetThreadPriorityBoost
VirtualProtectEx
CopyFileW
GlobalFlags
GetThreadPriority
SetLocalTime
MapViewOfFile
SetConsoleCursor
WriteConsoleA
CreatePipe
GetConsoleAliasExesA
SystemTimeToTzSpecificLocalTime
MoveFileW
ReadConsoleOutputCharacterW
IsValidLocale
GetProcAddress
VirtualAlloc
GetHandleInformation
GetDiskFreeSpaceExA
GetModuleHandleA

user32

WINNLSEnableIME
MoveWindow
CreateMDIWindowA
CallWindowProcW
UnregisterHotKey
SendMessageW
IsIconic
CloseWindowStation
GetCursorInfo
AdjustWindowRectEx
DrawTextW
CallWindowProcA
LoadKeyboardLayoutW
CharNextW
GetWindowTextLengthW
DrawIconEx
HideCaret
EnumChildWindows
DrawCaption
LoadCursorW
GetWindowTextW
CreateIconFromResource
SetWindowsHookExW
DrawIcon

advapi32

ElfChangeNotify
RegEnumKeyA
GetSecurityDescriptorSacl
SystemFunction030
ObjectPrivilegeAuditAlarmA
AccessCheckByTypeAndAuditAlarmW
ObjectOpenAuditAlarmA
EnumServicesStatusW
LsaEnumeratePrivilegesOfAccount
SystemFunction005
LsaSetInformationPolicy
OpenBackupEventLogA
AddAccessDeniedAce
RegCreateKeyExW
LockServiceDatabase
RegQueryValueA
SetTokenInformation
GetNamedSecurityInfoExA
LsaSetDomainInformationPolicy
BuildImpersonateTrusteeA
AddAce
RegEnumValueW
LsaGetSystemAccessAccount
LookupPrivilegeValueW
SetServiceObjectSecurity
SetEntriesInAclA
GetAuditedPermissionsFromAclA
ElfOldestRecord
ConvertSecurityDescriptorToStringSecurityDescriptorA
ReadEventLogW
LsaSetSecurityObject
CryptSetProviderExA
MapGenericMask
ConvertAccessToSecurityDescriptorW
SetSecurityDescriptorOwner
AreAllAccessesGranted
GetSidSubAuthorityCount
RegDeleteValueW
StartServiceCtrlDispatcherA
RegDeleteKeyA
LsaLookupNames
RegFlushKey
RegSetValueW
LookupAccountNameA
RegUnLoadKeyA
RegEnumKeyW
RegEnumKeyExW
SetEntriesInAccessListA
SetFileSecurityA
RegOpenKeyExW
SystemFunction004
LsaAddAccountRights
LsaEnumerateAccountsWithUserRight
BuildTrusteeWithNameW
SystemFunction017
AddAccessDeniedAceEx
RegSaveKeyW
InitiateSystemShutdownW
LsaSetQuotasForAccount
StartServiceW
CryptEnumProviderTypesA
LsaCreateTrustedDomain
LsaLookupPrivilegeValue
AddAccessAllowedObjectAce
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetUserNameW
AccessCheckByTypeAndAuditAlarmA
BuildImpersonateTrusteeW
RegEnumValueA
CryptDestroyKey
LsaEnumerateTrustedDomainsEx
GetTrusteeNameW
SystemFunction029
ReadEventLogA
SystemFunction011
ConvertSidToStringSidA
SetSecurityDescriptorSacl
GetMultipleTrusteeOperationA
LsaSetSecret
SystemFunction014
RegQueryValueExA
RegOverridePredefKey
ElfClearEventLogFileA

winmm

midiInUnprepareHeader
auxOutMessage
auxGetNumDevs
mciGetDeviceIDW
mciSendCommandA
midiStreamRestart
mciSetDriverData
waveOutGetPosition
auxGetDevCapsA
mmioRenameA
mixerGetControlDetailsA
sndPlaySoundW
mciSendStringA
waveOutGetDevCapsW
joyGetPos
timeGetDevCaps
midiInAddBuffer
midiOutLongMsg
waveOutPause
DriverCallback
midiOutOpen
mmTaskCreate
mciGetDeviceIDFromElementIDW
midiInGetDevCapsW
waveInGetPosition
midiOutCachePatches
waveInGetErrorTextW
joyGetPosEx
timeSetEvent
mixerOpen
mciGetErrorStringW
joyGetDevCapsA
joyConfigChanged
mciGetErrorStringA
waveOutMessage
midiOutGetNumDevs
mmTaskYield
mixerClose
midiStreamOpen
waveOutSetVolume
mmioDescend
mxd32Message
midiOutGetVolume
mmsystemGetVersion
midiConnect
mciSendStringW
mmioAdvance
tid32Message
mciLoadCommandResource
waveOutSetPitch
waveInGetDevCapsA
waveOutGetPlaybackRate
waveOutGetVolume
mixerGetLineInfoA
auxGetDevCapsW
mid32Message
mmioRenameW
mciFreeCommandResource
midiOutGetDevCapsW
midiOutGetErrorTextW
mciGetYieldProc
midiStreamPosition
waveInOpen
CloseDriver
mmioSeek
joyReleaseCapture
midiOutUnprepareHeader
mmioFlush
waveInGetDevCapsW
WOWAppExit
mciGetCreatorTask
wid32Message
timeGetTime
mixerGetLineInfoW
mod32Message
midiInClose
joyGetThreshold
waveInMessage
mmioOpenW
mmDrvInstall
mmioStringToFOURCCW
waveInGetErrorTextA
mmioSetBuffer
mciGetDeviceIDA
mixerGetDevCapsW
midiInGetNumDevs
midiInStop
PlaySoundW
mmioGetInfo
mixerGetNumDevs
waveInGetNumDevs
mmioSendMessage
joySetCapture
mmioAscend
waveOutRestart
midiOutMessage
midiOutSetVolume
waveOutUnprepareHeader
mciSendCommandW
mmTaskBlock
joy32Message
mciGetDriverData
mixerGetLineControlsA
midiOutGetDevCapsA
SendDriverMessage

winspool.drv

ConfigurePortW
CreatePrinterIC
DeletePrinter
PrinterMessageBoxW
GetPrinterA
DeletePrinterKeyW
EnumPrinterDataW
GetPrinterW
DeletePrintProcessorA
FindClosePrinterChangeNotification
SplDriverUnloadComplete
AdvancedSetupDialog
ord101
AddPrinterW
GetPrinterDriverW
ord202
EndPagePrinter
DeviceMode
ord204
FreePrinterNotifyInfo
AddPrinterDriverA
AddPrinterConnectionA
PlayGdiScriptOnPrinterIC
PrinterMessageBoxA
GetPrinterDriverA
DeletePrintProvidorW
ConnectToPrinterDlg
AddMonitorW
AddPrintProcessorW
DevQueryPrint
AddPortA
DeleteMonitorA
EnumPrintProcessorsW
EnumMonitorsA
DocumentPropertiesA
WritePrinter
AddPrintProvidorA
DeletePrinterDriverExW
AddPortExA
AddJobW
ord205
QueryColorProfile
SetFormA
AddPrintProcessorA
DeletePrinterDriverW
DocumentEvent
DeleteMonitorW
DeletePrinterDataExA
EnumPrintProcessorsA
ResetPrinterW
SetPortA
FindNextPrinterChangeNotification
EnumPortsA
ExtDeviceMode
XcvDataW
ScheduleJob
AddPrinterDriverExW
SetPrinterDataA
ReadPrinter
DevicePropertySheets
AddPrinterDriverW
EXTDEVICEMODE
AddPrinterConnectionW
AdvancedDocumentPropertiesA
AddPrinterA
EndDocPrinter
AddJobA
DEVICEMODE
AddMonitorA
SetPrinterA
DeletePortA
GetPrintProcessorDirectoryW
ord215
GetPrinterDriverDirectoryW
ord207
DeletePrinterConnectionW
EnumPrintProcessorDatatypesW
EnumPrintProcessorDatatypesA
EnumPrinterDataA
DeletePrinterKeyA
StartPagePrinter
DeletePrinterDataExW
ord213
ord210
EnumMonitorsW
FindFirstPrinterChangeNotification

msvcrt

_mbslen
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
_acmdln
exit
_XcptFilter
_exit
_mbsnbcnt
_mbsrev
_mbsrchr
fsetpos
_mbschr
_setsystime
_creat
_mbsstr
wcscmp
_execv
_ismbstrail
fgetwc
_heapused
ferror
_wfindnexti64
_cputs
fwprintf
_ctype
_wspawnvp
_wctime
_lseeki64
ctime
_searchenv
_heapadd
printf
atan
qsort
_spawnvpe
ftell
_pctype
_cabs
_mbsdup
_mbclen
cos
tan
__lc_collate_cp
labs
fopen
_spawnvp
_wfindnext
_gcvt
sprintf
_makepath
_splitpath
vsprintf
_CItan
_mbsncpy
bsearch
__wargv
_global_unwind2
_osver
_findfirst
_itoa
_mbctolower
iswascii
fseek
towlower
fputs
__p__fmode
_findnexti64
feof
fwrite
_stati64
_spawnl
_endthread
modf
memchr
remove
fflush
_aexit_rtn
_safe_fprem
memset
__p___mb_cur_max
_wcsset
_access
_ismbcsymbol
fread
memcpy
floor
_callnewh
fclose
_heapset
fprintf
getc
_spawnv
_CItanh
_ismbclegal
_stricmp
_wspawnlpe
_fgetwchar
wcstod
_wspawnv
swscanf
__p___winitenv
_ismbckata
_unlink
_safe_fdivr
_fcvt
fputc
_outpd
__getmainargs

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 544KB - Virtual size: 540KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

426c0097d3532c3e0e52d0dd92cd0a87

Headers

File Characteristics

Imports

kernel32

user32

advapi32

winmm

winspool.drv

msvcrt

Sections

.text Size: 40KB - Virtual size: 37KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 544KB - Virtual size: 540KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 544KB - Virtual size: 540KB