c0b4db233719e66dd5180c58796c92a66f81f74e29528aab74e9c81c4233de4d

Sharing

Copy URL Twitter E-mail

General

Target

c0b4db233719e66dd5180c58796c92a66f81f74e29528aab74e9c81c4233de4d
Size

1.1MB
MD5

7e7e0d0ee722710c4854f99cc451742a
SHA1

2b4d8c35b171035a626a668121a8d52a299b0a5d
SHA256

c0b4db233719e66dd5180c58796c92a66f81f74e29528aab74e9c81c4233de4d
SHA512

844501884816737e41642464b2bedb58429dbe0a5aee838b30fbaf9001dbb21b38c5e4cccf1e7f901daa6ae89547650f038672208f0e78e63db00a9bf7a286f1
SSDEEP

24576:MTZMr7SYSEUbjqhTvtbew/dsrJ1hgxrvtzf33b7APDT0lzuCRG+:MK7BryTKzuQZ

Score

N/A

Malware Config

Signatures

Files

c0b4db233719e66dd5180c58796c92a66f81f74e29528aab74e9c81c4233de4d
.dll windows x86

b6ffbc6d615485267e9ae34e47d2e20e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
GlobalAlloc
RtlZeroMemory
HeapDestroy
GetModuleHandleA
lstrcpyA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
lstrlenA
GetLastError
HeapCreate
InterlockedIncrement
InterlockedDecrement
HeapSize
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
SetFilePointer
DeleteFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrcatA
VirtualProtect
ExitProcess
IsBadReadPtr
GetTickCount
GetUserDefaultLCID
LCMapStringA
GetCommandLineA
GetModuleFileNameA
TerminateProcess
SetWaitableTimer
SetUnhandledExceptionFilter
FlushFileBuffers
SetStdHandle
HeapAlloc
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
RaiseException
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
OpenProcess
HeapReAlloc
HeapFree
CreateWaitableTimerA
FreeLibrary
GetProcAddress
LoadLibraryA
ReadFile
GetFileSizeEx
GlobalUnlock
GlobalLock
WriteFile
CreateFileW
FindClose
FindFirstFileA
WideCharToMultiByte
MultiByteToWideChar
GetStdHandle
SetHandleCount
TlsGetValue
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
RtlUnwind
GetVersion
lstrcmpiW
lstrcmpW
lstrcpynW
lstrlenW
RtlMoveMemory
VirtualQueryEx
CancelWaitableTimer
CloseHandle
IsBadCodePtr
GetProcessHeap

user32

GetMessageA
PeekMessageA
FindWindowA
IsWindow
EnumChildWindows
GetClassNameA
CharLowerW
MoveWindow
DestroyMenu
OpenClipboard
GetClipboardData
CloseClipboard
GetAsyncKeyState
CreateWindowExA
SetTimer
SendMessageA
MessageBoxA
KillTimer
PostMessageA
MsgWaitForMultipleObjects
wvsprintfA
EmptyClipboard
SetWindowRgn
CreateIconFromResource
GetWindowRect
TrackPopupMenu
CreatePopupMenu
AppendMenuA
EnableMenuItem
IsMenu
SetWindowLongA
GetParent
GetWindowLongA
SetParent
wsprintfA
GetCursorPos
DispatchMessageA
TranslateMessage
SetForegroundWindow

gdi32

DeleteObject

advapi32

CryptSetKeyParam
CryptCreateHash
CryptExportKey
CryptDecrypt
CryptEncrypt
CryptGetKeyParam
CryptDestroyKey
CryptAcquireContextA
CryptImportKey
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam
CryptHashData

comdlg32

GetOpenFileNameW
GetSaveFileNameA

ole32

CoInitialize
CLSIDFromProgID
CoInitializeEx
CLSIDFromString
CoUninitialize
OleRun
IsEqualGUID
CoCreateInstance

ws2_32

bind
connect
WSACreateEvent
inet_addr
WSAEventSelect
ioctlsocket
socket
setsockopt
WSACloseEvent
shutdown
WSACleanup
closesocket
WSAStartup
gethostbyname
accept
recv
send
htons
select

atl

ord42
ord47

shell32

StrCmpNIW
StrStrIW
Shell_NotifyIconA
StrStrW
StrRStrW
StrRStrIW
ShellExecuteA

urlmon

UrlMkSetSessionOption
UrlMkGetSessionOption

wininet

InternetGetConnectedState
InternetOpenA
InternetCloseHandle
FindCloseUrlCache
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
InternetGetCookieA
InternetSetCookieA
HttpQueryInfoA
InternetOpenUrlA
InternetReadFile
HttpQueryInfoW
InternetQueryOptionW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetConnectW
InternetSetOptionA
InternetOpenW

shlwapi

StrToIntExW
StrToIntW
StrSpnW
StrToIntExA

crypt32

CertFreeCertificateContext
CertOpenSystemStoreA
CertFindCertificateInStore
CertVerifyTimeValidity
CertVerifyRevocation
CryptImportPublicKeyInfo
CertCloseStore

iphlpapi

GetAdaptersInfo

oleaut32

VariantChangeType
VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
VarR8FromCy
VarR8FromBool
LHashValOfNameSys
RegisterTypeLi
SafeArrayCreate
SysAllocString
VariantClear
SafeArrayDestroy
LoadTypeLi

winhttp

WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSetCredentials
WinHttpOpen

secur32

FreeContextBuffer
InitializeSecurityContextA
AcquireCredentialsHandleA
DecryptMessage
EncryptMessage
QueryContextAttributesA

winmm

PlaySoundA

Exports

Exports

IDx15
IDx16
IDx17
IDx18
IDx19
IDx20
IDx21
IDx22
IDx23
IDx24
IDx25
IDx26
IDx27
IDx28
IDx29
IDx30
IDx32
IDx33
IDx34
IDx35
IDx36
IDx37
IDx38
IDx39
IDx40
IDx41
IDx42
IDx43
IDx44
IDx45
IDx46
IDx47
IDx48
IDx49
IDx50
IDx51
IDx52
IDx53
IDx54
IDx55
IDx56
IDx57
IDx58
IDx60
IDx61
IDx62
IDx63
IDx64
IDx65
IDx66
IDx67
IDx68
IDx69
IDx70
IDx71

Sections

.text
Size: 904KB - Virtual size: 903KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6ffbc6d615485267e9ae34e47d2e20e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comdlg32

ole32

ws2_32

atl

shell32

urlmon

wininet

shlwapi

crypt32

iphlpapi

oleaut32

winhttp

secur32

winmm

Exports

Exports

Sections

.text Size: 904KB - Virtual size: 903KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 148KB - Virtual size: 211KB

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 32KB - Virtual size: 30KB

.text
Size: 904KB - Virtual size: 903KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 148KB - Virtual size: 211KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 32KB - Virtual size: 30KB