05e95600062ab622468740320325283b76c5e2796c8fb496b6c091ef9c404f7c

Sharing

Copy URL Twitter E-mail

General

Target

05e95600062ab622468740320325283b76c5e2796c8fb496b6c091ef9c404f7c
Size

604KB
MD5

7e33b5f9a49212e5bde07eb638435420
SHA1

465e8eb2b0a3547bba3678e91095b9ad807d086b
SHA256

05e95600062ab622468740320325283b76c5e2796c8fb496b6c091ef9c404f7c
SHA512

093c69b5552f379053c3a14ccf067ea1e1cdc6575c01ef8b9f6230a79b003e7f5d7ae71c0df8d9696ba07c1b1ef74f63c409b4c8532869a139d2f30d9aab61e7
SSDEEP

12288:y0UpdXB8fA24uYb8ctHp1nYtduCW7moM/ECKArYO9tKELYS0HVLv:y0UpdXBM6u48o4lq/M/ECKYYo7LiLv

Score

N/A

Malware Config

Signatures

Files

05e95600062ab622468740320325283b76c5e2796c8fb496b6c091ef9c404f7c
.exe windows x86

e7b0c99977e3348a2572dc304e0ab183

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
GetCommandLineA
RegisterWaitForInputIdle
GetFileAttributesW
LocalFileTimeToFileTime
GetStartupInfoA
CreateSemaphoreW
ReleaseSemaphore
Beep
FindNextVolumeW
MultiByteToWideChar
GetConsoleAliasExesLengthW
QueueUserAPC
SetConsoleCursorInfo
Module32FirstW
ShowConsoleCursor
GetCommandLineW
CreateJobObjectW
PeekNamedPipe
VirtualQueryEx
GetConsoleCP
EnumTimeFormatsW
WaitForMultipleObjects
Toolhelp32ReadProcessMemory
GetComputerNameA
SetConsoleInputExeNameW
DisconnectNamedPipe
RequestWakeupLatency
RtlFillMemory
FlushConsoleInputBuffer
CreateFileW
SetComputerNameW
DeleteAtom
_hwrite
SetSystemTimeAdjustment
SetCommConfig
GetProcAddress
HeapSize
HeapReAlloc
GetConsoleAliasesLengthA
SetFileAttributesA
GetStringTypeExA
VerifyConsoleIoHandle
WriteFileEx
GetFileAttributesA
LoadModule
GetThreadLocale
SetFileApisToOEM
PeekConsoleInputA
GetSystemTime
SetCommBreak
Heap32First
lstrcmpiA
FindFirstVolumeW
CompareStringW
GetVersion
FormatMessageW
CloseHandle
BuildCommDCBAndTimeoutsA
EnumDateFormatsW
SetComputerNameA
ScrollConsoleScreenBufferA
GetModuleHandleA
SetConsoleActiveScreenBuffer
WriteProcessMemory
GlobalWire
GetProcessAffinityMask
ConvertDefaultLocale
GetLocalTime
CreateNamedPipeA
GetCurrentThreadId
SetThreadPriorityBoost
VirtualProtectEx
CopyFileW
GlobalFlags
GetThreadPriority
SetLocalTime
MapViewOfFile
SetConsoleCursor
WriteConsoleA
CreatePipe
GetConsoleAliasExesA
SystemTimeToTzSpecificLocalTime
MoveFileW
ReadConsoleOutputCharacterW
VirtualAlloc
IsValidLocale
GetHandleInformation
GetDiskFreeSpaceExA
LoadLibraryA

user32

WINNLSEnableIME
MoveWindow
CreateMDIWindowA
CallWindowProcW
UnregisterHotKey
SendMessageW
IsIconic
CloseWindowStation
GetCursorInfo
AdjustWindowRectEx
DrawTextW
CallWindowProcA
LoadKeyboardLayoutW
CharNextW
GetWindowTextLengthW
DrawIconEx
HideCaret
EnumChildWindows
DrawCaption
LoadCursorW
GetWindowTextW
CreateIconFromResource
SetWindowsHookExW
DrawIcon

advapi32

ElfChangeNotify
RegEnumKeyA
GetSecurityDescriptorSacl
SystemFunction030
ObjectPrivilegeAuditAlarmA
AccessCheckByTypeAndAuditAlarmW
ObjectOpenAuditAlarmA
EnumServicesStatusW
LsaEnumeratePrivilegesOfAccount
SystemFunction005
LsaSetInformationPolicy
OpenBackupEventLogA
AddAccessDeniedAce
RegCreateKeyExW
LockServiceDatabase
RegQueryValueA
SetTokenInformation
GetNamedSecurityInfoExA
LsaSetDomainInformationPolicy
BuildImpersonateTrusteeA
AddAce
RegEnumValueW
LsaGetSystemAccessAccount
LookupPrivilegeValueW
SetServiceObjectSecurity
SetEntriesInAclA
GetAuditedPermissionsFromAclA
ElfOldestRecord
ConvertSecurityDescriptorToStringSecurityDescriptorA
ReadEventLogW
LsaSetSecurityObject
CryptSetProviderExA
MapGenericMask
ConvertAccessToSecurityDescriptorW
SetSecurityDescriptorOwner
AreAllAccessesGranted
GetSidSubAuthorityCount
RegDeleteValueW
StartServiceCtrlDispatcherA
RegDeleteKeyA
LsaLookupNames
RegFlushKey
RegSetValueW
LookupAccountNameA
RegUnLoadKeyA
RegEnumKeyW
RegEnumKeyExW
SetEntriesInAccessListA
SetFileSecurityA
RegOpenKeyExW
SystemFunction004
LsaAddAccountRights
LsaEnumerateAccountsWithUserRight
BuildTrusteeWithNameW
SystemFunction017
AddAccessDeniedAceEx
RegSaveKeyW
InitiateSystemShutdownW
LsaSetQuotasForAccount
StartServiceW
CryptEnumProviderTypesA
LsaCreateTrustedDomain
LsaLookupPrivilegeValue
AddAccessAllowedObjectAce
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetUserNameW
AccessCheckByTypeAndAuditAlarmA
BuildImpersonateTrusteeW
RegEnumValueA
CryptDestroyKey
LsaEnumerateTrustedDomainsEx
GetTrusteeNameW
SystemFunction029
ReadEventLogA
SystemFunction011
ConvertSidToStringSidA
SetSecurityDescriptorSacl
GetMultipleTrusteeOperationA
LsaSetSecret
SystemFunction014
RegQueryValueExA
RegOverridePredefKey
ElfClearEventLogFileA

winmm

midiInUnprepareHeader
auxOutMessage
auxGetNumDevs
mciGetDeviceIDW
SendDriverMessage
midiStreamRestart
mciSetDriverData
waveOutGetPosition
auxGetDevCapsA
mmioRenameA
mixerGetControlDetailsA
sndPlaySoundW
mciSendStringA
waveOutGetDevCapsW
joyGetPos
timeGetDevCaps
midiInAddBuffer
midiOutLongMsg
waveOutPause
DriverCallback
midiOutOpen
mmTaskCreate
mciGetDeviceIDFromElementIDW
midiInGetDevCapsW
mciLoadCommandResource
waveInGetPosition
waveInGetErrorTextW
joyGetPosEx
timeSetEvent
mixerOpen
mciGetErrorStringW
joyGetDevCapsA
joyConfigChanged
mciGetErrorStringA
waveOutMessage
midiOutGetNumDevs
mmTaskYield
mixerClose
midiStreamOpen
waveOutSetVolume
mmioDescend
mxd32Message
midiOutGetVolume
mmsystemGetVersion
midiConnect
mciSendStringW
mmioAdvance
tid32Message
midiOutCachePatches
waveOutSetPitch
waveInGetDevCapsA
waveOutGetPlaybackRate
waveOutGetVolume
mixerGetLineInfoA
auxGetDevCapsW
mid32Message
mmioRenameW
mciFreeCommandResource
midiOutGetDevCapsW
midiOutGetErrorTextW
mciGetYieldProc
midiStreamPosition
waveInOpen
CloseDriver
mmioSeek
joyReleaseCapture
midiOutUnprepareHeader
mmioFlush
waveInGetDevCapsW
WOWAppExit
mciGetCreatorTask
wid32Message
timeGetTime
mixerGetLineInfoW
mod32Message
midiInClose
joyGetThreshold
waveInMessage
mmioOpenW
mmDrvInstall
mmioStringToFOURCCW
waveInGetErrorTextA
mmioSetBuffer
mciGetDeviceIDA
mixerGetDevCapsW
midiInGetNumDevs
midiInStop
PlaySoundW
mmioGetInfo
mixerGetNumDevs
waveInGetNumDevs
mmioSendMessage
joySetCapture
mmioAscend
waveOutRestart
midiOutMessage
midiOutSetVolume
waveOutUnprepareHeader
mciSendCommandW
mmTaskBlock
joy32Message
mciGetDriverData
mixerGetLineControlsA
midiOutGetDevCapsA
mciSendCommandA

winspool.drv

ConfigurePortW
CreatePrinterIC
DeletePrinter
PrinterMessageBoxW
GetPrinterA
DeletePrinterKeyW
EnumPrinterDataW
GetPrinterW
DeletePrintProcessorA
FindClosePrinterChangeNotification
SplDriverUnloadComplete
AdvancedSetupDialog
ord101
AddPrinterW
GetPrinterDriverW
ord202
EndPagePrinter
DeviceMode
ord204
FreePrinterNotifyInfo
AddPrinterDriverA
AddPrinterConnectionA
PlayGdiScriptOnPrinterIC
PrinterMessageBoxA
GetPrinterDriverA
DeletePrintProvidorW
ConnectToPrinterDlg
AddMonitorW
AddPrintProcessorW
DevQueryPrint
AddPortA
DeleteMonitorA
EnumPrintProcessorsW
EnumMonitorsA
DocumentPropertiesA
WritePrinter
AddPrintProvidorA
DeletePrinterDriverExW
AddPortExA
AddJobW
ord205
QueryColorProfile
SetFormA
AddPrintProcessorA
DeletePrinterDriverW
DocumentEvent
DeleteMonitorW
DeletePrinterDataExA
EnumPrintProcessorsA
ResetPrinterW
SetPortA
FindNextPrinterChangeNotification
EnumPortsA
ExtDeviceMode
XcvDataW
ScheduleJob
AddPrinterDriverExW
SetPrinterDataA
ReadPrinter
DevicePropertySheets
AddPrinterDriverW
EXTDEVICEMODE
AddPrinterConnectionW
AdvancedDocumentPropertiesA
AddPrinterA
EndDocPrinter
AddJobA
DEVICEMODE
AddMonitorA
SetPrinterA
DeletePortA
GetPrintProcessorDirectoryW
ord215
GetPrinterDriverDirectoryW
ord207
DeletePrinterConnectionW
EnumPrintProcessorDatatypesW
EnumPrintProcessorDatatypesA
EnumPrinterDataA
DeletePrinterKeyA
StartPagePrinter
DeletePrinterDataExW
ord213
ord210
EnumMonitorsW
FindFirstPrinterChangeNotification

msvcrt

_mbslen
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
exit
_XcptFilter
_exit
_mbsnbcnt
_mbsrev
_mbsrchr
fsetpos
_mbschr
_setsystime
_creat
_mbsstr
wcscmp
_execv
_ismbstrail
fgetwc
_heapused
ferror
_wfindnexti64
_cputs
fwprintf
_ctype
_wspawnvp
_wctime
_lseeki64
ctime
_searchenv
_heapadd
fopen
printf
atan
qsort
_spawnvpe
ftell
_pctype
_cabs
_mbsdup
_mbclen
cos
tan
__lc_collate_cp
labs
tolower
_spawnvp
_wfindnext
_gcvt
sprintf
_makepath
_splitpath
vsprintf
_CItan
_mbsncpy
bsearch
__wargv
_global_unwind2
_osver
_findfirst
_itoa
_mbctolower
iswascii
fseek
towlower
fputs
__p__fmode
_findnexti64
feof
fwrite
_stati64
_spawnl
_endthread
modf
memchr
remove
fflush
_aexit_rtn
_safe_fprem
memset
__p___mb_cur_max
_wcsset
_access
_ismbcsymbol
fread
memcpy
floor
_callnewh
fclose
_heapset
fprintf
getc
_spawnv
_CItanh
_ismbclegal
_stricmp
_wspawnlpe
_fgetwchar
wcstod
_wspawnv
swscanf
__p___winitenv
_ismbckata
_unlink
_safe_fdivr
_fcvt
fputc
_outpd
_acmdln

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 544KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e7b0c99977e3348a2572dc304e0ab183

Headers

File Characteristics

Imports

kernel32

user32

advapi32

winmm

winspool.drv

msvcrt

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 544KB - Virtual size: 542KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 544KB - Virtual size: 542KB