3af80ed0c41c5fd5a72eb55a7cb689a23e7424fd12bb620acbdf20bcc8686647

Sharing

Copy URL Twitter E-mail

General

Target

3af80ed0c41c5fd5a72eb55a7cb689a23e7424fd12bb620acbdf20bcc8686647
Size

637KB
MD5

d66e456646ba68355ef05b8c8fa888b6
SHA1

2142da56614300e270fa0ed2e56c23ee12d670e2
SHA256

3af80ed0c41c5fd5a72eb55a7cb689a23e7424fd12bb620acbdf20bcc8686647
SHA512

d77d118bff3ee3e6b6f8e1245ebf8592fdca95a26586e1c7298b9c6cefc26b8a95d94d1c3c397bd19bab6bb81f1d53176e9aa68b6a69ce626a3e0366b24f8f06
SSDEEP

12288:FQAaAajMSFORKX4/X61y45TPc2olKwJxsWCcNhHGSFt+iCH2VJ4kC:FplajMqORKUq142oUw/NhHGSF05kC

Score

N/A

Malware Config

Signatures

Files

3af80ed0c41c5fd5a72eb55a7cb689a23e7424fd12bb620acbdf20bcc8686647
.exe windows x86

ec8aaa0e7db1bae8c585a46710a09e54

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

_get_osfhandle
iswdigit
_wcsrev
tolower
_beginthread
_Getdays
islower
fseek
_mbsupr

kernel32

CreateProcessW
CreateTimerQueueTimer
SetVolumeLabelW
GetLocaleInfoW
OpenFile
VirtualAlloc
SetConsoleOutputCP
RegisterWaitForSingleObject
CancelWaitableTimer
GetFileAttributesA
ExpandEnvironmentStringsA
AreFileApisANSI

advapi32

GetSecurityDescriptorDacl
RegSetValueExA
LsaQueryInformationPolicy
InitializeSecurityDescriptor
LookupAccountNameA
ConvertSidToStringSidA
ClearEventLogW
RegSetValueA
LsaSetInformationPolicy

uxtheme

GetWindowTheme
DrawThemeText
GetThemeMetric
GetThemeSysColor
GetCurrentThemeName
IsAppThemed
GetThemePartSize
GetThemeFont
GetThemeMargins
GetThemeBackgroundRegion
IsThemePartDefined
IsThemeBackgroundPartiallyTransparent
DrawThemeBackground

netapi32

NetUserGetLocalGroups
NetGetJoinInformation
NetShareEnum
NetUserGetInfo
NetUnjoinDomain
I_NetServerSetServiceBitsEx
NetQueryDisplayInformation
NetServerTransportEnum

user32

UnregisterClassW
EnumPropsW
wsprintfA
MonitorFromRect
GetCapture
PeekMessageW
DeregisterShellHookWindow

imm32

ImmUnlockIMC
ImmReleaseContext
ImmSetCandidateWindow
ImmLockIMCC
ImmConfigureIMEW
ImmUnlockIMCC
ImmSetCompositionStringW
ImmDisableIME
ImmIsIME
ImmGetGuideLineW
ImmCreateContext
ImmGetImeMenuItemsW
ImmGetCompositionFontW
ImmGetIMEFileNameA

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 226KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 167KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

DATA
Size: 190KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec8aaa0e7db1bae8c585a46710a09e54

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

uxtheme

netapi32

user32

imm32

Sections

.text Size: 50KB - Virtual size: 49KB

.bss Size: 226KB - Virtual size: 268KB

DATA Size: 167KB - Virtual size: 265KB

DATA Size: 190KB - Virtual size: 357KB

.rsrc Size: 512B - Virtual size: 472B

.reloc Size: 1024B - Virtual size: 556B

.text
Size: 50KB - Virtual size: 49KB

.bss
Size: 226KB - Virtual size: 268KB

DATA
Size: 167KB - Virtual size: 265KB

DATA
Size: 190KB - Virtual size: 357KB

.rsrc
Size: 512B - Virtual size: 472B

.reloc
Size: 1024B - Virtual size: 556B