28a9cec96ad3898e5892a61776c68d3907f0527e936787eda937eebfe32d35b6

Sharing

Copy URL

Twitter E-mail

General

Target

28a9cec96ad3898e5892a61776c68d3907f0527e936787eda937eebfe32d35b6
Size

1.1MB
MD5

feec76fb75fd061b0f6435c95613c04a
SHA1

12218aa25cd1c263372313c86d8cc9df58c32911
SHA256

28a9cec96ad3898e5892a61776c68d3907f0527e936787eda937eebfe32d35b6
SHA512

04c0bb982c1e5fe6e27cbc378ac1e18fa0ae975c040eb49c0ef44cd6aaa7ef278368803c47db7271355a94cf6090b3a03752e64dd29d2b899a228e54d6bc7915
SSDEEP

24576:gZ6FRS6pYEzfV/iwZl0hORT057qRKSF2Yc+G5ae94vxyzik:pRS6pNz9aQl0haDjN/k

Score

N/A

Malware Config

Signatures

Files

28a9cec96ad3898e5892a61776c68d3907f0527e936787eda937eebfe32d35b6
.exe windows x86

65795b28a9a1b1c58e966ed5238c7fa4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeExA
GetSystemDirectoryA
GetFileSize
CreateFileMappingA
UnmapViewOfFile
LocalReAlloc
IsDBCSLeadByteEx
FindResourceExW
LoadResource
GetSystemDefaultLangID
lstrcmpA
CompareFileTime
GetLastError
LockResource
FindResourceA
LocalFree
LocalAlloc
lstrcatA
lstrcpyA
lstrlenA
FreeLibrary
SetEnvironmentVariableA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
SetStdHandle
GetTimeZoneInformation
SetFilePointer
GetLocaleInfoW
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
IsValidCodePage
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetOEMCP
GetACP
GetEnvironmentStringsW
GetEnvironmentStrings
GetFileType
SetHandleCount
HeapSize
HeapReAlloc
VirtualAlloc
GetWindowsDirectoryA
VirtualFree
HeapCreate
ExitProcess
GetCurrentThread
SetLastError
TlsAlloc
TlsGetValue
WriteFile
GetCPInfo
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetProcessHeap
GetCommandLineA
RaiseException
HeapAlloc
HeapFree
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
InterlockedDecrement
InterlockedIncrement
CompareStringA
CompareStringW
ReleaseMutex
CreateMutexA
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
GetVersionExA
GetComputerNameA
Sleep
QueryPerformanceCounter
lstrlenW
ResetEvent
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
IsDBCSLeadByte
CreateEventW
CloseHandle
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
DeleteFileA
CreateProcessA
GetSystemDirectoryW
lstrcpynA
GetModuleFileNameW
GetWindowsDirectoryW
GetModuleHandleW
lstrcmpiA
GetModuleFileNameA
HeapDestroy
SetEndOfFile
GetSystemInfo
OpenSemaphoreA
CopyFileA
FindNextFileA
FindFirstFileA
RemoveDirectoryA
CreateDirectoryA
WaitForSingleObjectEx
GetModuleHandleA
GetDiskFreeSpaceA
WriteFileEx
GlobalAlloc
GlobalFree
CreateEventA
GetUserDefaultLangID
SleepEx
CreateThread
SetEvent
ExpandEnvironmentStringsA
GetLocalTime
OpenMutexA
MapViewOfFile
OpenFileMappingA
FatalAppExitA
WaitForMultipleObjects

user32

GetSystemMetrics
wsprintfW
GetDlgItem
GetPropA
SetDlgItemTextW
LoadStringA
CharNextA
ReleaseDC
GetDC
GetDesktopWindow
CharLowerA
DialogBoxIndirectParamW
MoveWindow
GetWindowRect
GetParent

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
OpenThreadToken
GetTokenInformation
GetLengthSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
RegEnumValueA
RegEnumValueW
RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
DeregisterEventSource
InitializeAcl
AddAccessAllowedAce
FreeSid
ReportEventA
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

msvcrt

fclose
printf
sprintf
rand
strrchr
strstr
strchr
wcsstr
fprintf
wcscpy
wcscmp
free
memmove
malloc
strncpy
_chdir
atol
fflush
strncmp
wcschr
wcslen
vprintf

crypt32

CertDeleteCertificateFromStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertDeleteCRLFromStore
CertAddCRLContextToStore
CertFindCRLInStore
CertEnumCRLsInStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65795b28a9a1b1c58e966ed5238c7fa4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

version

msvcrt

crypt32

Sections

.text Size: 108KB - Virtual size: 105KB

.rdata Size: 84KB - Virtual size: 80KB

.data Size: 36KB - Virtual size: 2.2MB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 108KB - Virtual size: 105KB

.rdata
Size: 84KB - Virtual size: 80KB

.data
Size: 36KB - Virtual size: 2.2MB

.rsrc
Size: 8KB - Virtual size: 4KB