e8a3bc63c8acd5908ef522936a6885c6c2d64122285d3635f99068409418b19e

Sharing

Copy URL Twitter E-mail

General

Target

e8a3bc63c8acd5908ef522936a6885c6c2d64122285d3635f99068409418b19e
Size

159KB
MD5

4c48791268b0f3f9390339440a0e18cc
SHA1

561870becacd53c4e73d76cb7016701e359b3769
SHA256

e8a3bc63c8acd5908ef522936a6885c6c2d64122285d3635f99068409418b19e
SHA512

824b3c3d9e32127b5239b731458fb938fd3a08fb6a7ca7ebef74c95bd698cdb2b4a80df7636d1dd80afd47b92f2b06f5fa7af2a3a39d4f1ff9fe41e2f10895fa
SSDEEP

3072:exQnyeJZdWL3Pb7lyRArWA70jgcnuhz2jWMBCdXUnElvbK:hysOL/Ndrr70jgWiCWMBCdXUEZO

Score

N/A

Malware Config

Signatures

Files

e8a3bc63c8acd5908ef522936a6885c6c2d64122285d3635f99068409418b19e
.dll windows x86

66924d040a5f97a2f1529dea84648d7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
WideCharToMultiByte
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrcmpi
lstrcat
WriteFile
WaitForSingleObject
VirtualAlloc
TerminateProcess
Sleep
SetThreadPriority
SetPriorityClass
SetFilePointer
SetEvent
ResumeThread
ReadFile
OpenProcess
MoveFileA
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalMemoryStatus
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVersionExA
GetTickCount
GetThreadPriority
GetTempPathA
GetSystemInfo
GetSystemDirectoryA
GetProcAddress
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocalTime
GetLastError
GetFileSize
GetExitCodeThread
GetDriveTypeA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetComputerNameA
FreeLibrary
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnterCriticalSection
DeviceIoControl
DeleteFileA
DeleteCriticalSection
CreateProcessA
CreatePipe
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CloseHandle
Sleep
VirtualProtect
VirtualProtect
ExitProcess

user32

GetKeyboardType
MessageBoxA
CharNextA
CreateWindowExA
mouse_event
keybd_event
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
ShowWindow
SetWindowsHookExA
SetWindowLongA
SetThreadDesktop
SetCursorPos
SendMessageA
ReleaseDC
RegisterClassA
PostMessageA
PeekMessageA
OpenInputDesktop
OpenDesktopA
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
IsWindowVisible
IsWindow
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowLongA
GetUserObjectInformationA
GetTopWindow
GetThreadDesktop
GetSystemMetrics
GetParent
GetWindow
GetMessageA
GetForegroundWindow
GetDesktopWindow
GetDC
GetCursorPos
GetClassNameA
GetClassInfoA
ExitWindowsEx
DispatchMessageA
DestroyWindow
DefWindowProcA
CloseDesktop
CallNextHookEx

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegFlushKey
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
AdjustTokenPrivileges
StartServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenServiceA
OpenSCManagerA
EnumServicesStatusA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen

gdi32

SetDIBColorTable
SelectPalette
SelectObject
RealizePalette
PatBlt
GetSystemPaletteEntries
GetStockObject
GetPaletteEntries
GetObjectA
GetDeviceCaps
GetDIBits
GetDIBColorTable
GdiFlush
DeleteObject
DeleteDC
CreatePalette
CreateICA
CreateHalftonePalette
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
BitBlt

wsock32

WSACleanup
WSAStartup
WSAGetLastError
gethostbyname
socket
shutdown
setsockopt
send
recv
ioctlsocket
inet_ntoa
inet_addr
htons
getsockname
connect
closesocket

ws2_32

inet_addr

winmm

waveInUnprepareHeader
waveInStart
waveInReset
waveInPrepareHeader
waveInOpen
waveInClose
waveInAddBuffer

msacm32

acmStreamUnprepareHeader
acmStreamPrepareHeader
acmStreamConvert
acmStreamReset
acmStreamSize
acmStreamClose
acmStreamOpen

shell32

ShellExecuteA
SHFileOperation

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

urlmon

URLDownloadToFileA

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

imm32

ImmReleaseContext
ImmGetCompositionStringA
ImmGetContext

Exports

Exports

MainService
MainWork
ServiceMain

Sections

CODE
Size: - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

866
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mackt
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sytem
Size: - Virtual size: 1000B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sytem
Size: - Virtual size: 1000B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Katja
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66924d040a5f97a2f1529dea84648d7d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

gdi32

wsock32

ws2_32

winmm

msacm32

shell32

wininet

urlmon

avicap32

imm32

Exports

Exports

Sections

CODE Size: - Virtual size: 118KB

DATA Size: - Virtual size: 7KB

BSS Size: - Virtual size: 2KB

.idata Size: - Virtual size: 6KB

.edata Size: - Virtual size: 116B

.reloc Size: - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 3KB

866 Size: - Virtual size: 8KB

.reloc Size: - Virtual size: 512B

.mackt Size: - Virtual size: 8KB

sytem Size: - Virtual size: 1000B

sytem Size: - Virtual size: 1000B

.Katja Size: - Virtual size: 4KB

.vmp0 Size: - Virtual size: 25KB

.vmp1 Size: 154KB - Virtual size: 153KB

.reloc Size: 512B - Virtual size: 128B

CODE
Size: - Virtual size: 118KB

DATA
Size: - Virtual size: 7KB

BSS
Size: - Virtual size: 2KB

.idata
Size: - Virtual size: 6KB

.edata
Size: - Virtual size: 116B

.reloc
Size: - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 3KB

866
Size: - Virtual size: 8KB

.reloc
Size: - Virtual size: 512B

.mackt
Size: - Virtual size: 8KB

sytem
Size: - Virtual size: 1000B

sytem
Size: - Virtual size: 1000B

.Katja
Size: - Virtual size: 4KB

.vmp0
Size: - Virtual size: 25KB

.vmp1
Size: 154KB - Virtual size: 153KB

.reloc
Size: 512B - Virtual size: 128B