b0863befcc951e2bcc577e40486f3ac1f664177a5a69af83efa0e19216680b1b

Sharing

Copy URL

Twitter E-mail

General

Target

b0863befcc951e2bcc577e40486f3ac1f664177a5a69af83efa0e19216680b1b
Size

267KB
MD5

4279ccfc61a7881b1c74b3e05a306060
SHA1

677035a4b351e1cc1c444b4f0da6ed20d5415133
SHA256

b0863befcc951e2bcc577e40486f3ac1f664177a5a69af83efa0e19216680b1b
SHA512

aeceded4acf5c0af26bac54c596846d94992f8bb9a21449e5435bf68860c58dba6574925efa979dd2dde6cd00de8c94ed77fe86e15494c226bdb36c801b63a2d
SSDEEP

6144:Q518o00S5l2sh+Dg3xE72oQ3nEQvcP4tDI1tSR0X:w00S5l2sh+77b2tDI1tSR0X

Score

N/A

Malware Config

Signatures

Files

b0863befcc951e2bcc577e40486f3ac1f664177a5a69af83efa0e19216680b1b
.dll regsvr32 windows x86

6c4c22273e301f44e57f4a1c4a067f5d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

mfc42

ord3830
ord3353
ord2976
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord540
ord860
ord4202
ord2764
ord800
ord823
ord825
ord537
ord925
ord858
ord535
ord6779
ord939
ord6663
ord4278
ord6877
ord6648
ord2818
ord5683
ord353
ord5773
ord5442
ord1979
ord665
ord3831
ord6385
ord4129
ord4277
ord924
ord922
ord2915
ord3825
ord3079
ord4080
ord4622
ord4424
ord3579
ord2486
ord859
ord6778
ord6876
ord4204
ord614
ord290
ord923
ord5710
ord1988
ord3318
ord2803
ord690
ord5207
ord389
ord1105
ord1158
ord801
ord772
ord941
ord500
ord541
ord536
ord6662
ord6143
ord2763
ord5608
ord6883
ord539
ord1601
ord926
ord861
ord1200
ord6467
ord1154
ord940

msvcrt

asctime
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
memcmp
_mbscmp
_onexit
__dllonexit
_strcmpi
_wcsicmp
_CxxThrowException
rename
localtime
atoi
malloc
memset
free
atof
time
fopen
fputs
fclose
srand
rand
__CxxFrameHandler
memcpy
strcpy
sprintf
strlen
realloc
printf
strstr
strcat

kernel32

LocalFree
InterlockedIncrement
ExpandEnvironmentStringsA
CopyFileA
FindNextFileA
FindFirstFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
GetExitCodeProcess
OpenProcess
GetCurrentProcess
MulDiv
GetVersionExA
GetLocaleInfoA
GetVersion
lstrcpynA
FreeLibrary
lstrcmpA
GetLastError
lstrcpyA
GetProcAddress
LoadLibraryA
DeleteFileA
WriteFile
Sleep
WideCharToMultiByte
InterlockedDecrement
MultiByteToWideChar
CreateProcessA
ResumeThread
CreateThread
lstrlenA
GetWindowsDirectoryA
GetSystemDirectoryA
OpenFile
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetModuleFileNameA
lstrcatA

user32

SendMessageA
FindWindowExA
MessageBoxW
CallWindowProcA
SetForegroundWindow
SetWindowLongA
GetDlgItemTextA
EndDialog
IsWindow
PostMessageA
GetParent
GetForegroundWindow
WaitForInputIdle
SetFocus
EnumWindows
SetDlgItemTextA
ShowWindow
GetDlgItem
ClientToScreen
ScreenToClient
ReleaseDC
GetWindowDC
SetWindowPos
GetWindowRect
GetDesktopWindow
GetCursorPos
GetDC
DialogBoxParamA
EnableWindow
GetSystemMetrics
IsCharAlphaNumericA
wsprintfA
GetWindowThreadProcessId
IsChild
SetWindowTextA
MessageBoxA

gdi32

GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
SetPixel
DeleteObject
SetBkColor
SetTextColor
CreateSolidBrush
CreateFontA
CreateCompatibleDC

advapi32

RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumKeyExA
RegQueryValueExA

shell32

SHFileOperationA
ShellExecuteA

olepro32

ord252

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantClear
SysFreeString
VariantInit
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
VariantCopy
OleLoadPicturePath
OleSavePictureFile
SysAllocString
SysStringLen
GetErrorInfo
SysAllocStringLen

wininet

InternetCloseHandle
InternetOpenUrlA
FtpFindFirstFileA
FtpOpenFileA
InternetFindNextFileA
FtpCreateDirectoryA
InternetWriteFile
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindCloseUrlCache
InternetOpenA
InternetConnectA
InternetReadFile
HttpOpenRequestA
HttpSendRequestA

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

crypt32

CertCloseStore
CertOpenSystemStoreA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer

Sections

.text
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c4c22273e301f44e57f4a1c4a067f5d

Headers

File Characteristics

Imports

shlwapi

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

olepro32

ole32

oleaut32

wininet

ws2_32

crypt32

Exports

Exports

Sections

.text Size: 187KB - Virtual size: 186KB

.text1 Size: 30KB - Virtual size: 29KB

.data1 Size: 31KB - Virtual size: 30KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 187KB - Virtual size: 186KB

.text1
Size: 30KB - Virtual size: 29KB

.data1
Size: 31KB - Virtual size: 30KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 15KB - Virtual size: 14KB