98481552996c54c2e57120fd2b2d8848d1a7c57f9ad06849370a65476ebb68cc

Sharing

Copy URL Twitter E-mail

General

Target

98481552996c54c2e57120fd2b2d8848d1a7c57f9ad06849370a65476ebb68cc
Size

306KB
MD5

a73da2f8e1d934bb4d7a22218497e070
SHA1

fa922dbd30d509f966cf0817a471e24c6ec7cdf6
SHA256

98481552996c54c2e57120fd2b2d8848d1a7c57f9ad06849370a65476ebb68cc
SHA512

852900d66f388d4fa692bf76406ceec8975539834a554e8c91a94ddd7ca2c19f7b60b15ce458b38ce3a5ed95fd78dbbeef9f322b30f1e06898c1e002ed6868cd
SSDEEP

6144:xW9IuiepgjRzM2IlVu5fNaOuHgIX3TJdaaFXobFJ7I/u:xW9IuxafNMvX3ddx4ZRIW

Score

N/A

Malware Config

Signatures

Files

98481552996c54c2e57120fd2b2d8848d1a7c57f9ad06849370a65476ebb68cc
.dll windows x86

e532544fbe73e0a288f4d112cebbd597

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryInfoKeyW
OpenSCManagerW
RegCloseKey
CloseServiceHandle
QueryServiceConfigW
QueryServiceStatus
RegDeleteValueW
ImpersonateSelf
RegEnumKeyExW
OpenServiceW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyA
RegQueryValueExA

gdi32

GetObjectW
GetBkMode

kernel32

LocalFree
WaitForSingleObject
CreateEventW
VirtualProtect
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapReAlloc
TlsGetValue
TlsSetValue
DisableThreadLibraryCalls
TlsAlloc
TlsFree
OpenFileMappingW
MapViewOfFile
WaitForSingleObjectEx
InterlockedExchange
UnmapViewOfFile
SleepEx
VerifyVersionInfoW
HeapSize
MultiByteToWideChar
GetACP
PulseEvent
LoadLibraryA
GetTickCount
GetModuleFileNameW
Beep
GetFileSize
GetFileTime
CompareFileTime
GlobalHandle
GlobalFree
MoveFileW
_lclose
GetTempPathW
GetTempFileNameW
DeleteFileW
GetFileAttributesW
GetFullPathNameW
_llseek
_lwrite
_lread
CreateEventA
GetCurrentThread
SetEvent
ExitThread
FindResourceW
LoadLibraryExW
LoadResource
LockResource
FreeResource
SetCurrentDirectoryW
GetCurrentDirectoryW
lstrcmpW
lstrcpyA
WideCharToMultiByte
CreateThread
SetThreadPriority
LocalAlloc
OpenEventW
EnterCriticalSection
HeapAlloc
HeapFree
Sleep
GetLastError
GetCurrentProcessId
IsBadWritePtr
IsBadStringPtrW
SetLastError
IsBadReadPtr
IsBadCodePtr
ExpandEnvironmentStringsW
lstrlenW
lstrcpyW
lstrcatW
lstrcmpiW
GetPrivateProfileStringW
CloseHandle
SearchPathW
CreateFileW
GetProfileStringW
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
lstrcmpiA
lstrcpynA
FileTimeToSystemTime
VirtualAlloc
GlobalLock
GetFileAttributesExA
GetModuleFileNameA
lstrcpynW
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
SetErrorMode
FreeLibrary
GlobalReAlloc
GlobalAlloc
InitializeCriticalSection
GetCurrentThreadId
GetThreadPriority
ResetEvent

ntdll

NtQueryVirtualMemory
RtlUnwind
RtlDeleteResource
RtlImageNtHeader
RtlInitializeResource
mbstowcs
VerSetConditionMask
NtCreateEvent
NtWaitForMultipleObjects
NtCreateTimer
NtSetTimer
NtCancelTimer
NtSetEvent
NtSetTimerResolution
NtQueryTimerResolution
memmove
RtlUnicodeToMultiByteN
RtlMultiByteToUnicodeN
wcsrchr
towlower
isdigit
wcscpy
wcscat
strncpy
strspn
strncmp
strstr
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
NtCreateSection
NtMapViewOfSection
NtUnmapViewOfSection
atoi
wcschr
wcstol
swprintf
RtlCreateUserThread
NtResumeThread
wcsncpy
wcsncmp
_wcsnicmp
wcslen
wcsncat
NtSetValueKey
RtlOpenCurrentUser
NtQueryValueKey
RtlInitUnicodeString
NtOpenKey
NtClose

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
NdrClientCall2
RpcStringFreeW

user32

GetWinStationInfo
GetSystemMetrics
SystemParametersInfoW
CharUpperA
LoadIconA
RegisterClassA
CreateWindowExA
GetMessageA
DispatchMessageA
DestroyWindow
DefWindowProcA
PostThreadMessageA
PeekMessageA
UnregisterClassA
PeekMessageW
MessageBoxW
GetAsyncKeyState
LoadStringA
SendMessageA
CharLowerBuffA
PostMessageA
SetTimer
LoadStringW
PostMessageW
KillTimer
RegisterWindowMessageW
IsWindow
wsprintfA
wsprintfW

Exports

Exports

ServiceMain
DefDriverProc
DriverCallback
DrvGetModuleHandle
GetDriverModuleHandle
MigrateAllDrivers
MigrateSoundEvents
NotifyCallbackData
OpenDriver
PlaySound
PlaySoundA
PlaySoundW
SendDriverMessage
WOW32DriverCallback
WOW32ResolveMultiMediaHandle
WOWAppExit
WinmmLogoff
WinmmLogon
_gfxLogoff@0
_gfxLogon@4
aux32Message
auxGetDevCapsA
auxGetDevCapsW
auxGetNumDevs
auxGetVolume
auxOutMessage
auxSetVolume
gfxAddGfx
gfxBatchChange
gfxCreateGfxFactoriesList
gfxCreateZoneFactoriesList
gfxDestroyDeviceInterfaceList
gfxEnumerateGfxs
gfxModifyGfx
gfxOpenGfx
gfxRemoveGfx
joy32Message
joyConfigChanged
joyGetDevCapsA
joyGetDevCapsW
joyGetNumDevs
joyGetPos
joyGetPosEx
joyGetThreshold
joyReleaseCapture
joySetCapture
joySetThreshold
mci32Message
mciDriverNotify
mciDriverYield
mciExecute
mciFreeCommandResource
mciGetCreatorTask
mciGetDeviceIDA
mciGetDeviceIDFromElementIDA
mciGetDeviceIDFromElementIDW
mciGetDeviceIDW
mciGetDriverData
mciGetErrorStringA
mciGetErrorStringW
mciGetYieldProc
mciLoadCommandResource
mciSendCommandA
mciSendCommandW
mciSendStringA
mciSendStringW
mciSetDriverData
mciSetYieldProc
mid32Message
midiConnect
midiDisconnect
midiInAddBuffer
midiInClose
midiInGetDevCapsA
midiInGetDevCapsW
midiInGetErrorTextA
midiInGetErrorTextW
midiInGetID
midiInGetNumDevs
midiInMessage
midiInOpen
midiInPrepareHeader
midiInReset
midiInStart
midiInStop
midiInUnprepareHeader
midiOutCacheDrumPatches
midiOutCachePatches
midiOutClose
midiOutGetDevCapsA
midiOutGetDevCapsW
midiOutGetErrorTextA
midiOutGetErrorTextW
midiOutGetID
midiOutGetNumDevs
midiOutGetVolume
midiOutLongMsg
midiOutMessage
midiOutOpen
midiOutPrepareHeader
midiOutReset
midiOutSetVolume
midiOutShortMsg
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamPause
midiStreamPosition
midiStreamProperty
midiStreamRestart
midiStreamStop
mixerClose
mixerGetControlDetailsA
mixerGetControlDetailsW
mixerGetDevCapsA
mixerGetDevCapsW
mixerGetID
mixerGetLineControlsA
mixerGetLineControlsW
mixerGetLineInfoA
mixerGetLineInfoW
mixerGetNumDevs
mixerMessage
mixerOpen
mixerSetControlDetails
mmDrvInstall
mmGetCurrentTask
mmTaskBlock
mmTaskCreate
mmTaskSignal
mmTaskYield
mmioAdvance
mmioAscend
mmioClose
mmioCreateChunk
mmioDescend
mmioFlush
mmioGetInfo
mmioInstallIOProcA
mmioInstallIOProcW
mmioOpenA
mmioOpenW
mmioRead
mmioRenameA
mmioRenameW
mmioSeek
mmioSendMessage
mmioSetBuffer
mmioSetInfo
mmioStringToFOURCCA
mmioStringToFOURCCW
mmioWrite
mmsystemGetVersion
mod32Message
mxd32Message
sndPlaySoundA
sndPlaySoundW
tid32Message
timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetSystemTime
timeGetTime
timeKillEvent
timeSetEvent
waveInAddBuffer
waveInClose
waveInGetDevCapsA
waveInGetDevCapsW
waveInGetErrorTextA
waveInGetErrorTextW
waveInGetID
waveInGetNumDevs
waveInGetPosition
waveInMessage
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutBreakLoop
waveOutClose
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutGetErrorTextA
waveOutGetErrorTextW
waveOutGetID
waveOutGetNumDevs
waveOutGetPitch
waveOutGetPlaybackRate
waveOutGetPosition
waveOutGetVolume
waveOutMessage
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetPitch
waveOutSetPlaybackRate
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite
wid32Message
winmmDbgOut
winmmSetDebugLevel
wod32Message

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e532544fbe73e0a288f4d112cebbd597

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

ntdll

rpcrt4

user32

Exports

Exports

Sections

.text Size: 123KB - Virtual size: 123KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 170KB - Virtual size: 169KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 123KB - Virtual size: 123KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 170KB - Virtual size: 169KB

.reloc
Size: 6KB - Virtual size: 6KB