bc8471b52af504034b0da8f0a864543737e7d26917871c667ebba7ee406413f1

Sharing

Copy URL Twitter E-mail

General

Target

bc8471b52af504034b0da8f0a864543737e7d26917871c667ebba7ee406413f1
Size

93KB
MD5

f647be3972894ed14d5f714b9bebd96c
SHA1

8782b39c9793b7a61e16dd1f3a4e8f99ebe1f438
SHA256

bc8471b52af504034b0da8f0a864543737e7d26917871c667ebba7ee406413f1
SHA512

ad1e55959a89073a9fc718187a57ba78d8b43eff355ef024fffa015a6f3ac38bb0c345b3fa01a9f5b2b28c3df8fc3f51cc9975e7d92c3cdf84e4e104e3c4f3a6
SSDEEP

1536:nwH8Alr3QF/GTqg8HLhobQLAfm5b8HLljs2mwEhstzWrYB:iLlr39Og8HlKQLAfMmLljJmwEixWre

Score

N/A

Malware Config

Signatures

Files

bc8471b52af504034b0da8f0a864543737e7d26917871c667ebba7ee406413f1
.exe windows x86

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
WriteFile
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetFileSizeEx
OpenMutexW
GetLastError
SetLastError
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
FindClose
LoadLibraryA
GetEnvironmentVariableW
FindNextFileW
HeapFree
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
CreateThread
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
SetThreadPriority
GetThreadContext
SetThreadContext
GetProcessId
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileIntW
GlobalLock
GlobalUnlock
ResetEvent
GetUserDefaultUILanguage
GetTickCount
SetFilePointerEx
SystemTimeToFileTime
HeapAlloc
CreateProcessW
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
MoveFileExW
GetSystemTime
GetTempFileNameW
VirtualProtect
FileTimeToDosDateTime
WriteProcessMemory
LocalFree
GetCurrentProcessId
DuplicateHandle
OpenEventW
GetFileAttributesExW
GetModuleFileNameW
GetVersionExW
VirtualFreeEx
VirtualFree
GetModuleHandleW
WaitForSingleObject
GetComputerNameW
SetErrorMode
GetCommandLineW
WaitForMultipleObjects
CreateEventW
SetFileAttributesW
CloseHandle
lstrcmpiW
WTSGetActiveConsoleSessionId
GetProcAddress
lstrcmpiA
CreateFileW
GetFileAttributesW
Sleep
LoadLibraryW
SetEvent
CreateDirectoryW
FreeLibrary
ExitProcess
RemoveDirectoryW

user32

LoadImageW
MsgWaitForMultipleObjects
CharLowerBuffA
GetCursorPos
CharToOemW
ExitWindowsEx
GetIconInfo
CharLowerA
PeekMessageW
DrawIcon
ToUnicode
GetClipboardData
TranslateMessage
GetKeyboardState
CharLowerW
DispatchMessageW
CharUpperW

advapi32

CryptCreateHash
LookupPrivilegeValueW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
RegQueryValueExW
CryptReleaseContext
RegCreateKeyExW
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
CryptAcquireContextW
GetSidSubAuthority
OpenProcessToken
CryptGetHashParam
GetLengthSid
IsWellKnownSid
EqualSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
ConvertSidToStringSidW
InitiateSystemShutdownExW

shlwapi

PathRemoveFileSpecW
StrCmpNIW
PathRenameExtensionW
PathRemoveBackslashW
UrlUnescapeA
wvnsprintfW
PathIsDirectoryW
PathFindFileNameW
PathAddBackslashW
SHDeleteValueW
PathSkipRootW
SHDeleteKeyW
PathCombineW
PathAddExtensionW
PathUnquoteSpacesW
PathMatchSpecW
StrCmpNIA
wvnsprintfA
PathQuoteSpacesW
PathIsURLW

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CLSIDFromString
StringFromGUID2

ws2_32

recv
select
getaddrinfo
recvfrom
send
getpeername
listen
WSAIoctl
connect
WSAStartup
WSAGetLastError
shutdown
setsockopt
bind
socket
WSASetLastError
closesocket
freeaddrinfo
WSAEventSelect
getsockname
accept
sendto

crypt32

CertCloseStore
PFXExportCertStoreEx
PFXImportCertStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertDuplicateCertificateContext

wininet

InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersA
InternetQueryOptionA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
InternetCrackUrlA
InternetQueryOptionW
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpSendRequestW
InternetReadFile
InternetReadFileExA
HttpSendRequestExW
HttpQueryInfoA
HttpSendRequestExA

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

608b524939a4ae825f572a36fd684373

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

ws2_32

crypt32

wininet

netapi32

Sections

.text Size: 87KB - Virtual size: 87KB

.data Size: 512B - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 87KB - Virtual size: 87KB

.data
Size: 512B - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB