e8267d71fffa452c139e125b297e2dfd2b046949624b11c8fd7eff7daafe8b8c

Sharing

Copy URL Twitter E-mail

General

Target

e8267d71fffa452c139e125b297e2dfd2b046949624b11c8fd7eff7daafe8b8c
Size

287KB
MD5

b03e6760a4cb6e2cc264f08be9e96118
SHA1

4ff49ee2f48264a9f41c0ffde8f0025fe438aef8
SHA256

e8267d71fffa452c139e125b297e2dfd2b046949624b11c8fd7eff7daafe8b8c
SHA512

dd74ce73150cf3a1b7a5747e3b39547e98dfa82cbf97d6d9ec30c1e4df552e149e3c2a0944bd39aed04c8bcbb40a61099f27619e892a36391afeae7fa29f9a93
SSDEEP

6144:2lF/jpPPNwXSvxENgb8FioAANUDIS2EzdmvR0yDFWAvVSUH:2zjpPPNwXQEN1xNiYpVDvH

Score

N/A

Malware Config

Signatures

Files

e8267d71fffa452c139e125b297e2dfd2b046949624b11c8fd7eff7daafe8b8c
.exe windows x86

a972bb8ba1a0200d40507485144587b8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

RegisterClassW
TranslateMessage
DestroyWindow
LoadStringW
GetSysColorBrush
UnregisterClassA
CreateWindowExW
CharNextW
PeekMessageW
DispatchMessageW
LoadCursorW
CharUpperBuffW
GetMessageW
wsprintfW
DefWindowProcW
MsgWaitForMultipleObjects
UnregisterClassW
PostThreadMessageW

oleaut32

SafeArrayGetVartype
VariantClear
LoadRegTypeLi
SafeArrayDestroy
SafeArrayRedim
GetErrorInfo
SafeArrayGetUBound
VarUI4FromStr
VariantCopyInd
VariantChangeType
VariantInit
SysAllocString
SafeArrayCopy
SetErrorInfo
SysStringLen
CreateErrorInfo
SafeArrayCreate
SafeArrayGetLBound
SysAllocStringByteLen
SysFreeString
SafeArrayLock
SafeArrayUnlock
LoadTypeLi
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
VariantCopy
SysStringByteLen

shlwapi

PathQuoteSpacesW
PathRemoveFileSpecW

userenv

UnloadUserProfile

setupapi

SetupDiEnumDeviceInterfaces
SetupDiOpenDeviceInfoW
SetupDiGetClassDevsExW
CM_Get_Device_ID_Size
SetupDiGetDeviceInterfaceDetailW
CM_Get_Sibling
SetupDiEnumDeviceInfo
CM_Get_Parent
SetupDiCreateDeviceInfoList
CM_Get_Child
SetupDiSetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
CM_Get_Device_IDW
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status_Ex
CM_Locate_DevNodeW
SetupDiGetDeviceInstanceIdW
SetupDiCreateDeviceInfoListExW
SetupDiGetDeviceInfoListDetailW

iphlpapi

NotifyAddrChange
GetTcpTable
GetUdpTable
GetIpForwardTable
InternalCreateIpForwardEntry
NTPTimeToNTFileTime
NhGetInterfaceNameFromDeviceGuid
InternalGetUdpTable
register_icmp
NotifyRouteChange

kernel32

lstrlenA
GetConsoleMode
LocalFree
GetOEMCP
GetThreadLocale
IsValidCodePage
RaiseException
SetHandleCount
HeapDestroy
GetCommandLineW
GetVolumeNameForVolumeMountPointW
FlushFileBuffers
HeapSize
FreeEnvironmentStringsA
VirtualFree
lstrlenW
CreateWaitableTimerW
HeapFree
LCMapStringW
VerifyVersionInfoW
CloseHandle
WideCharToMultiByte
TlsAlloc
GetSystemInfo
TlsSetValue
LoadResource
GetCurrentThreadId
FreeLibrary
GetModuleHandleA
WaitForMultipleObjects
WriteConsoleA
LCMapStringA
UnhandledExceptionFilter
VirtualAlloc
VerSetConditionMask
CancelIo
GetConsoleCP
LoadLibraryExW
WriteConsoleW
TlsFree
SetWaitableTimer
SetProcessWorkingSetSize
LeaveCriticalSection
OpenProcess
SetStdHandle
SizeofResource
IsValidLocale
GetFileType
SetFilePointer
VirtualProtect
CreateProcessW
SetProcessShutdownParameters
WaitForSingleObject
SetLastError
CreateFileA
FindResourceExW
DeleteCriticalSection
GetExitCodeThread
EnterCriticalSection
SetUnhandledExceptionFilter
TlsGetValue
HeapReAlloc
DeviceIoControl
CreateFileW
GetCommandLineA
RtlUnwind
WriteFile
TerminateThread
EnumSystemLocalesA
GetSystemTimeAsFileTime
GetProcessHeap
ResumeThread
CreateEventW
IsDebuggerPresent
HeapAlloc
SetConsoleCtrlHandler
CreateThread
FreeEnvironmentStringsW
DuplicateHandle
GetStdHandle
lstrcmpiW
GetDriveTypeW
GetUserDefaultLCID
GetModuleHandleW
VirtualQuery
GetConsoleOutputCP
FindResourceW
LockResource
GetACP

ole32

CoSuspendClassObjects
CoRegisterClassObject
CoInitializeSecurity
CoRevokeClassObject
CoImpersonateClient
CoResumeClassObjects
OleRun
StringFromCLSID
CoTaskMemFree
CoUninitialize
CoTaskMemRealloc
CoCreateInstance
CoRevertToSelf
StringFromGUID2
ProgIDFromCLSID
CoInitializeEx
CLSIDFromString
CoTaskMemAlloc

advapi32

InitializeAcl
MakeSelfRelativeSD
SetSecurityDescriptorOwner
DuplicateTokenEx
GetAclInformation
OpenServiceW
QueryServiceConfigW
InitializeSid
DeleteService
RegEnumKeyExW
LookupAccountNameW
CloseServiceHandle
SetSecurityDescriptorGroup
GetSidLengthRequired
GetTokenInformation
RegOpenKeyExW
RegSetValueExW
SetThreadToken
CreateProcessAsUserW
ReportEventW
OpenThreadToken
CheckTokenMembership
RegQueryInfoKeyW
RegisterEventSourceW
OpenSCManagerW
ConvertSecurityDescriptorToStringSecurityDescriptorW
SetServiceStatus
GetSecurityDescriptorControl
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateToken
GetSecurityDescriptorOwner
ChangeServiceConfig2W
QueryServiceStatusEx
RegEnumValueW
RegCreateKeyExW
RegQueryValueExW
DeregisterEventSource
RegDeleteValueW
CopySid
GetSecurityDescriptorLength
GetSidSubAuthority
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegDeleteKeyW
ChangeServiceConfigW
GetLengthSid
ControlService
IsValidSid
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
EqualSid
RegCloseKey
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
AddAce
SetNamedSecurityInfoW
CreateServiceW
MakeAbsoluteSD

dciman32

DCIDraw

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 610KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a972bb8ba1a0200d40507485144587b8

Headers

File Characteristics

Imports

user32

oleaut32

shlwapi

userenv

setupapi

iphlpapi

kernel32

ole32

advapi32

dciman32

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 257KB - Virtual size: 610KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 257KB - Virtual size: 610KB

.rsrc
Size: 512B - Virtual size: 4KB