e56c9f806ea2f64e15d074faffe07b40876d158d32a94428cdd709e9466499af

Sharing

Copy URL Twitter E-mail

General

Target

e56c9f806ea2f64e15d074faffe07b40876d158d32a94428cdd709e9466499af
Size

764KB
MD5

d798d6e877fa511ec2aadef954d28a0c
SHA1

c914f89700bf2ced38aacab2f2f67f891500e6ea
SHA256

e56c9f806ea2f64e15d074faffe07b40876d158d32a94428cdd709e9466499af
SHA512

cdd4d40fd73c4a76d9ea493fcaa7440f83f9acb14481313a2c39a7295beb5b0650f7685f530a59b9a9e47c8f6b39cb13d4a7609963f792cd8ba8c4fe9c98cff9
SSDEEP

12288:TTthTBbSeQwtCOIvoFqGDhjdPUEnmtOFBKJ3SCVqhUbBSh3:PtFBbSeLti4LhxTKJ3SCVqqm3

Score

N/A

Malware Config

Signatures

Files

e56c9f806ea2f64e15d074faffe07b40876d158d32a94428cdd709e9466499af
.exe windows x86

7e2026b6944fbbf44a29e8b1273a908b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dnsapi

DnsFlushResolverCache

ws2_32

socket
WSACloseEvent
connect
WSAStartup
inet_addr
WSAWaitForMultipleEvents
send
gethostbyname
closesocket
WSACreateEvent
recv
WSACleanup
shutdown
WSAEventSelect
htons
WSAGetLastError

wininet

HttpOpenRequestA
DeleteUrlCacheEntryW
InternetConnectA
InternetQueryDataAvailable
InternetReadFile
HttpSendRequestW
HttpAddRequestHeadersA
InternetOpenA
InternetCloseHandle

msvcrt

sscanf
sprintf
isspace
strncmp
fprintf
remove
fscanf
_errno
strstr
feof
free
wcsstr
malloc
_stricmp
fopen
fread
ftell
fseek
_wcsnicmp
_close
_lseek
_read
_open
strrchr
printf
wcsrchr
??3@YAXPAX@Z
??2@YAPAXI@Z
rand
memcpy
srand
strchr
strncpy
isprint
tolower
fclose
isalnum
_snwprintf
memset
_except_handler3

iphlpapi

GetAdaptersInfo

kernel32

GetTickCount
SetFilePointer
GetFileSize
SetEndOfFile
InterlockedDecrement
WriteProcessMemory
LocalFree
ProcessIdToSessionId
VirtualAllocEx
OpenProcess
CreateRemoteThread
LocalAlloc
GetProcessHeap
HeapFree
HeapAlloc
GetVolumeInformationW
GetLocaleInfoA
GetTempPathW
CreateFileW
ReadFile
WriteFile
MoveFileExW
GetTempFileNameW
lstrcatW
WaitForSingleObjectEx
GetComputerNameA
Process32First
GetCurrentThread
Module32First
Process32Next
GetSystemInfo
GetModuleFileNameA
IsDebuggerPresent
CreateToolhelp32Snapshot
SetThreadAffinityMask
Module32Next
GetVersionExA
CloseHandle
GetCurrentProcessId
ExitProcess
GetCommandLineW
FindResourceA
FreeResource
LoadResource
CreateProcessW
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
SetFileTime
GlobalAlloc
TerminateThread
Sleep
CopyFileW
SizeofResource
GetExitCodeProcess
TerminateProcess
GetModuleFileNameW
GetLastError
GetProcAddress
GlobalFree
LockResource
CreateEventW
GetModuleHandleA
VirtualProtect
GetFileTime
DeleteFileW
CreateThread
ExpandEnvironmentStringsW
CreateFileA
MoveFileExA
GetFileAttributesA
CreateDirectoryA
SetFileAttributesA
DeleteFileA
FindFirstFileW
GetVolumeInformationA
GetVersionExW
FindClose
DeviceIoControl
ExpandEnvironmentStringsA
CopyFileA
FindFirstFileA
FindNextFileA

user32

wsprintfA
EndPaint
DestroyWindow
SetTimer
GetMessageW
PostQuitMessage
KillTimer
SendMessageA
BeginPaint
wsprintfW
GetDC
TranslateMessage
IsDialogMessageW
MessageBoxA
ReleaseDC
EndDialog
ShowWindow
CreateDialogParamW
DispatchMessageW
FindWindowA

gdi32

BitBlt
DeleteDC
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetObjectA

advapi32

RegSetValueExW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
StartServiceW
OpenSCManagerW
CloseServiceHandle
CreateServiceW
SetFileSecurityA
RegEnumValueA
AddAccessAllowedAce
InitializeAcl
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryInfoKeyA
CheckTokenMembership
FreeSid
RegEnumValueW
AllocateAndInitializeSid
RegCreateKeyExW
RegCloseKey
GetUserNameA
RegSetValueExA

shell32

CommandLineToArgvW
SHChangeNotify
ShellExecuteW

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
CoInitialize

oleaut32

VariantClear
VariantInit
SysFreeString
OleLoadPicture
SysAllocString

ntdll

NtConnectPort
NtRequestWaitReplyPort
RtlNtStatusToDosError
NtClose
NtDelayExecution
NtCreateSection
NtQuerySystemTime

psapi

EnumProcesses
GetProcessImageFileNameW

urlmon

URLDownloadToFileW

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.driver
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cfgbin
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uac64
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mcp
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uacdll
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.userm
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.abk
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e2026b6944fbbf44a29e8b1273a908b

Headers

DLL Characteristics

File Characteristics

Imports

dnsapi

ws2_32

wininet

msvcrt

iphlpapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ntdll

psapi

urlmon

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 18KB - Virtual size: 117KB

.rsrc Size: 188KB - Virtual size: 188KB

.reloc Size: 4KB - Virtual size: 3KB

.driver Size: 144KB - Virtual size: 144KB

.cfgbin Size: 9KB - Virtual size: 9KB

.uac64 Size: 55KB - Virtual size: 55KB

.mcp Size: 9KB - Virtual size: 9KB

.uacdll Size: 33KB - Virtual size: 33KB

.userm Size: 62KB - Virtual size: 62KB

.abk Size: 184KB - Virtual size: 184KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 18KB - Virtual size: 117KB

.rsrc
Size: 188KB - Virtual size: 188KB

.reloc
Size: 4KB - Virtual size: 3KB

.driver
Size: 144KB - Virtual size: 144KB

.cfgbin
Size: 9KB - Virtual size: 9KB

.uac64
Size: 55KB - Virtual size: 55KB

.mcp
Size: 9KB - Virtual size: 9KB

.uacdll
Size: 33KB - Virtual size: 33KB

.userm
Size: 62KB - Virtual size: 62KB

.abk
Size: 184KB - Virtual size: 184KB