ed6c1b89686b95493e4386785fe0277cc23c6207e75694476374923b53695590

Sharing

Copy URL

Twitter E-mail

General

Target

ed6c1b89686b95493e4386785fe0277cc23c6207e75694476374923b53695590
Size

1.1MB
MD5

58cfc2f10e1769c2fb4c6e98ded532f0
SHA1

4150b7404c02b29eb9ec8d1601134eec10942601
SHA256

ed6c1b89686b95493e4386785fe0277cc23c6207e75694476374923b53695590
SHA512

99430ff7b2b4f15b4df440fb27eb4e55baae9a931fcb7e95f3d7fb85251894168e2fb68c8c8fb9a017ce51535c8c706d883f0c1d018e37dba029ac3cbaabcb2d
SSDEEP

24576:2ZieFRVXFHlEHKth6HQU8rnJChes2rLX8B/R:zGRVVHlEHGmQFJgGQlR

Score

N/A

Malware Config

Signatures

Files

ed6c1b89686b95493e4386785fe0277cc23c6207e75694476374923b53695590
.exe windows x86

65795b28a9a1b1c58e966ed5238c7fa4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeExA
GetSystemDirectoryA
GetFileSize
CreateFileMappingA
UnmapViewOfFile
LocalReAlloc
IsDBCSLeadByteEx
FindResourceExW
LoadResource
GetSystemDefaultLangID
lstrcmpA
CompareFileTime
GetLastError
LockResource
FindResourceA
LocalFree
LocalAlloc
lstrcatA
lstrcpyA
lstrlenA
FreeLibrary
SetEnvironmentVariableA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
SetStdHandle
GetTimeZoneInformation
SetFilePointer
GetLocaleInfoW
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
IsValidCodePage
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetOEMCP
GetACP
GetEnvironmentStringsW
GetEnvironmentStrings
GetFileType
SetHandleCount
HeapSize
HeapReAlloc
VirtualAlloc
GetWindowsDirectoryA
VirtualFree
HeapCreate
ExitProcess
GetCurrentThread
SetLastError
TlsAlloc
TlsGetValue
WriteFile
GetCPInfo
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetProcessHeap
GetCommandLineA
RaiseException
HeapAlloc
HeapFree
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
InterlockedDecrement
InterlockedIncrement
CompareStringA
CompareStringW
ReleaseMutex
CreateMutexA
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
GetVersionExA
GetComputerNameA
Sleep
QueryPerformanceCounter
lstrlenW
ResetEvent
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
IsDBCSLeadByte
CreateEventW
CloseHandle
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
DeleteFileA
CreateProcessA
GetSystemDirectoryW
lstrcpynA
GetModuleFileNameW
GetWindowsDirectoryW
GetModuleHandleW
lstrcmpiA
GetModuleFileNameA
HeapDestroy
SetEndOfFile
GetSystemInfo
OpenSemaphoreA
CopyFileA
FindNextFileA
FindFirstFileA
RemoveDirectoryA
CreateDirectoryA
WaitForSingleObjectEx
GetModuleHandleA
GetDiskFreeSpaceA
WriteFileEx
GlobalAlloc
GlobalFree
CreateEventA
GetUserDefaultLangID
SleepEx
CreateThread
SetEvent
ExpandEnvironmentStringsA
GetLocalTime
OpenMutexA
MapViewOfFile
OpenFileMappingA
FatalAppExitA
WaitForMultipleObjects

user32

GetSystemMetrics
wsprintfW
GetDlgItem
GetPropA
SetDlgItemTextW
LoadStringA
CharNextA
ReleaseDC
GetDC
GetDesktopWindow
CharLowerA
DialogBoxIndirectParamW
MoveWindow
GetWindowRect
GetParent

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
OpenThreadToken
GetTokenInformation
GetLengthSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
RegEnumValueA
RegEnumValueW
RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
DeregisterEventSource
InitializeAcl
AddAccessAllowedAce
FreeSid
ReportEventA
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

msvcrt

fclose
printf
sprintf
rand
strrchr
strstr
strchr
wcsstr
fprintf
wcscpy
wcscmp
free
memmove
malloc
strncpy
_chdir
atol
fflush
strncmp
wcschr
wcslen
vprintf

crypt32

CertDeleteCertificateFromStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertDeleteCRLFromStore
CertAddCRLContextToStore
CertFindCRLInStore
CertEnumCRLsInStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65795b28a9a1b1c58e966ed5238c7fa4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

version

msvcrt

crypt32

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 84KB - Virtual size: 80KB

.data Size: 36KB - Virtual size: 2.2MB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 84KB - Virtual size: 80KB

.data
Size: 36KB - Virtual size: 2.2MB

.rsrc
Size: 8KB - Virtual size: 4KB