24d81ab4441ffed33f6f9e35d6a5ba53b2250ec13adb34b0f76240fb8b5fc4ff

Sharing

Copy URL Twitter E-mail

General

Target

24d81ab4441ffed33f6f9e35d6a5ba53b2250ec13adb34b0f76240fb8b5fc4ff
Size

321KB
MD5

12169c898661a555bd61e3633a0013b0
SHA1

9cefd9b2cb37370ddf00895d017110793512045a
SHA256

24d81ab4441ffed33f6f9e35d6a5ba53b2250ec13adb34b0f76240fb8b5fc4ff
SHA512

1242a89abf30298f13237753f983675e45be2a87e26dd58b5046d05b40e71f4afe3ed835001bbc085f5924149f3eedf2a30e59c6cdc1c2f9bf5864b4a9f3cfee
SSDEEP

6144:+d6BzzO4IUMPoqLmfNcOgTiLLpVOUhYmVZwGvDHEJ60Z3PA:+d6BdMPoeOAiL2UhVVa8DHC/A

Score

N/A

Malware Config

Signatures

Files

24d81ab4441ffed33f6f9e35d6a5ba53b2250ec13adb34b0f76240fb8b5fc4ff
.exe windows x86

02f3abaad7c37f4d809329e8a18b2923

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceW
FindResourceExW
GetModuleFileNameW
LoadLibraryExW
GetPrivateProfileIntW
GetProcAddress
GetPrivateProfileStringW
GetEnvironmentVariableW
OpenProcess
GetCommandLineA
GetLastError
ReleaseMutex
CreateMutexW
WritePrivateProfileStringW
lstrlenW
WaitForSingleObject
LoadLibraryW
GetVersionExW
LocalFree
LocalAlloc
LoadLibraryA
RaiseException
GetTempPathW
GetModuleHandleW
LoadResource
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
OutputDebugStringW
SetEnvironmentVariableW
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapSize
HeapReAlloc
LockResource
SizeofResource
FreeLibrary
GetCommandLineW
GetCurrentThread
CreateFileA
GetFileSize
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
IsDebuggerPresent
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
CreateProcessW
CloseHandle
CreateEventW
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
lstrcmpiW
FindNextFileW
GetSystemTimeAsFileTime

user32

wsprintfW
CharNextW
LoadCursorA
GetClassInfoExW
LoadCursorW
UnregisterClassW
GetDesktopWindow
GetWindowThreadProcessId
GetShellWindow
FindWindowExW
RegisterClassExW
RegisterClassExA
GetClassInfoExA

advapi32

OpenProcessToken
InitializeSecurityDescriptor
RegCloseKey
ImpersonateSelf
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
SetThreadToken
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
SetSecurityDescriptorDacl
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW

shell32

SHGetFolderPathW
CommandLineToArgvW

ole32

CoCreateInstance
CoUninitialize
CoCreateGuid
StringFromCLSID
CoInitialize

oleaut32

UnRegisterTypeLi
SysFreeString
SysStringLen
RegisterTypeLi

atl100

ord49
ord56
ord68

shlwapi

PathStripPathW
PathIsRelativeW
StrCpyW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW

msvcp100

?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_crt_debugger_hook
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_except_handler4_common
_invoke_watson
_controlfp_s
_configthreadlocale
??3@YAXPAX@Z
_CxxThrowException
memcpy_s
wcslen
memmove_s
signal
_set_invalid_parameter_handler
_set_purecall_handler
memcpy
??2@YAPAXI@Z
memset
_wcsicmp
_vscwprintf
vswprintf_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
wcsnlen
??0exception@std@@QAE@ABV01@@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
__CxxFrameHandler3
__pxcptinfoptrs
_set_abort_behavior
_set_error_mode
_snprintf
??_V@YAXPAX@Z
strlen
memmove
__wargv
__argc
wmemcpy_s
wcsstr
wcsrchr
wcscspn
wcscpy_s
free
_wcsdup
wcschr
memcmp
wcscpy
wcstoul
wcsncpy_s
sprintf_s
swprintf_s
memchr
_recalloc
wcscat_s
malloc
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Exports

Exports

?Set_CrashUploadParams@@YAXHPB_W@Z

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.erdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

02f3abaad7c37f4d809329e8a18b2923

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

atl100

shlwapi

msvcp100

msvcr100

version

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 170KB - Virtual size: 170KB

.reloc Size: 4KB - Virtual size: 3KB

.erdata Size: 76KB - Virtual size: 76KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 170KB - Virtual size: 170KB

.reloc
Size: 4KB - Virtual size: 3KB

.erdata
Size: 76KB - Virtual size: 76KB