82abfccac7852806f0a9c72f30e9f3ada549a76ebaa7aff170f25fe86431dc7f

Sharing

Copy URL Twitter E-mail

General

Target

82abfccac7852806f0a9c72f30e9f3ada549a76ebaa7aff170f25fe86431dc7f
Size

247KB
MD5

321e24c3d5b35aaa6ef73a27c70d8fc9
SHA1

b93d6ca41acd8f55a4ebabc51d4574f171ba3a9c
SHA256

82abfccac7852806f0a9c72f30e9f3ada549a76ebaa7aff170f25fe86431dc7f
SHA512

e6de24c1d03c2ad3c539af6c42d7c3a7a4614d042fb3dd37f29614e306e65ca44b64fb59cb5ed6fb3a98909ddda1bda91c0ba510fc259090ea2a2260d63acdd6
SSDEEP

6144:nOEp8G4SbYzXym7zeTHgVRH1Mjw682IaxwWyHAsUUSURi3Y:l8FFzXyZ0x1MjjdNeW0Rio

Score

N/A

Malware Config

Signatures

Files

82abfccac7852806f0a9c72f30e9f3ada549a76ebaa7aff170f25fe86431dc7f
.exe windows x86

a0487fea5b2cb518b9228e86e4ccdca3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyW
PathFileExistsW
PathIsRootW
AssocQueryStringW
StrRChrW
StrCmpNIW
PathIsUNCW
SHRegGetBoolUSValueW
StrStrW
PathRemoveFileSpecW
PathIsDirectoryW
PathRemoveBlanksW
SHSetValueW
PathRemoveFileSpecA
StrCmpNIA
UrlUnescapeW
StrCmpNW
SHGetValueW
PathIsURLW
wnsprintfA
PathFindExtensionA
SHDeleteKeyA
PathIsRelativeW
UrlCanonicalizeW
StrStrIW
StrCpyNW
PathStripToRootW
StrToIntW
SHStrDupW
PathAppendA
wnsprintfW
PathRemoveExtensionW
PathSkipRootW
SHDeleteValueA
StrToIntExW
StrRetToBufW
PathRemoveBackslashW
StrTrimW

rpcrt4

RpcServerUnregisterIf
NdrStubForwardingFunction
RpcBindingVectorFree
RpcRaiseException
UuidCreate
IUnknown_AddRef_Proxy
RpcServerInqBindings
RpcServerRegisterAuthInfoW
RpcRevertToSelf
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
CStdStubBuffer_DebugServerRelease
NdrOleFree
RpcStringBindingParseW
NdrDllRegisterProxy
NdrOleAllocate
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_AddRef
RpcBindingSetAuthInfoExW
NdrClientCall2
NdrStubCall2
IUnknown_QueryInterface_Proxy
RpcStringBindingComposeW
NdrServerCall2
IUnknown_Release_Proxy
NdrDllCanUnloadNow
UuidToStringW
CStdStubBuffer_IsIIDSupported
RpcBindingSetAuthInfoW
RpcBindingFromStringBindingW
RpcServerUseProtseqEpW
RpcImpersonateClient
CStdStubBuffer_QueryInterface
RpcStringFreeA
CStdStubBuffer_CountRefs
RpcBindingFree
UuidToStringA
NdrDllUnregisterProxy
UuidFromStringW
RpcStringFreeW
RpcBindingToStringBindingW
RpcServerRegisterIfEx
NdrCStdStubBuffer2_Release
CStdStubBuffer_Disconnect
NdrDllGetClassObject
CStdStubBuffer_Invoke

shell32

CommandLineToArgvW
SHBrowseForFolderA
ShellExecuteA
SHGetMalloc
SHGetPathFromIDListA
SHFileOperationW
SHGetFolderPathW
SHBrowseForFolderW
DragQueryFileW
SHGetPathFromIDListW
SHBindToParent
ShellExecuteExW
DragQueryFileA

version

GetFileVersionInfoSizeA
VerLanguageNameA
VerQueryValueA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeW

gdi32

CombineRgn
CreateCompatibleBitmap
CreateFontA
OffsetRgn
GetTextExtentPointA
BitBlt
GetMapMode
RealizePalette
ExtTextOutA
GetCurrentObject
CreateRectRgnIndirect
GetBkColor
CreateMetaFileA
Ellipse
SelectClipRgn
Polyline
SetBrushOrgEx
CreateDCW
GetNearestColor
GetClipBox
RectVisible
SetROP2
ScaleWindowExtEx
SetTextAlign
GetGlyphOutlineA
GetRgnBox
SaveDC
EndDoc
SetBkColor
GetTextExtentPoint32W
CreateDIBitmap

comctl32

PropertySheetW
ImageList_Create
InitCommonControlsEx
PropertySheetA
ImageList_ReplaceIcon
InitCommonControls
CreatePropertySheetPageW
ImageList_Draw
ImageList_Destroy

oleaut32

VariantClear
SysFreeString
SafeArrayGetLBound
SysStringByteLen
RegisterTypeLib
SetErrorInfo
VariantCopy
SafeArrayPtrOfIndex
SafeArrayUnaccessData
VariantCopyInd
SysAllocStringByteLen
SafeArrayAccessData
SafeArrayPutElement
VariantChangeType
SafeArrayGetUBound
SafeArrayGetElement
SysReAllocStringLen
CreateErrorInfo
GetErrorInfo
VariantInit

user32

SetDlgItemTextW
GetActiveWindow
SetDlgItemTextA
GetFocus
CreateWindowExW
GetWindowThreadProcessId
SetCursor
SetFocus
RegisterClassW
GetWindowTextA
DrawFocusRect
GetMenu
MessageBoxW
GetWindowLongW
EndPaint
GetSubMenu
GetForegroundWindow
PeekMessageA
PostMessageA
IsWindow
CopyRect
GetWindow
GetSysColor
PtInRect
MoveWindow
DestroyMenu
GetWindowLongA
GetPropA
GetMessagePos
ExitWindowsEx
IsDlgButtonChecked
IsChild
CharLowerW
LoadCursorA
GetSystemMetrics
SendDlgItemMessageA
GetClientRect
GetDlgItemTextW
GetCursorPos
GetDlgItem
TrackPopupMenu
CheckRadioButton
SetCapture
GetWindowTextW
CharPrevA
GetDC
MessageBeep
UnregisterClassA
CharNextW
BeginPaint
GetSysColorBrush
CharUpperW
GetWindowDC
RegisterWindowMessageA
GetMenuItemCount

msvcrt

_wcsnicmp
ceil
sprintf
_beginthreadex
_finite
printf
isxdigit
wcstok
_XcptFilter
_vsnwprintf
__getmainargs
_acmdln
wcscpy
__p__iob
_isatty
memset
iswalpha
fseek
_local_unwind2
qsort
towlower
rand
_stricmp
wcstol
_purecall
isdigit
?terminate@@YAXXZ
atol
_rotr
??0exception@@QAE@ABV0@@Z
_commit
__p__osver
_wfopen
_rotl
memmove
_ultow
isspace
wcsrchr
_chsize
__badioinfo
mbstowcs
fclose
_ftol
_ultoa
_access
_write
_stat
ctime
srand
isleadbyte
_strdup

kernel32

OpenEventA
QueryPerformanceCounter
GetWindowsDirectoryW
IsBadWritePtr
SetFileAttributesA
GetStartupInfoA
ExitProcess
VirtualAlloc
GetFileAttributesA
GetModuleFileNameA
FindResourceA
GetComputerNameW
FormatMessageA
EraseTape
GetLocalTime
TlsGetValue
GetVersion
FormatMessageW
GetCurrentThreadId
IsBadReadPtr
GetSystemInfo
HeapCreate
lstrcmpiW
OpenMutexW
GlobalFree
GetModuleHandleA
GetCurrentProcessId
CreateEventW
GetDriveTypeA
Sleep
GetTempPathA
DeleteFileW
SetLastError
CreateFileMappingA
GetDriveTypeW
MultiByteToWideChar
FindClose
LockResource
InitializeCriticalSection
GetProcessHeap
CreateDirectoryW
GetCommandLineA
GetSystemTimeAsFileTime
GetExitCodeProcess
lstrcpyA
lstrlenA
GetCurrentThread
TerminateProcess
CompareStringW
LeaveCriticalSection
WideCharToMultiByte
HeapAlloc
GetCommandLineW
SizeofResource
GetLastError
CreateEventA
GetCurrentProcess
WaitForSingleObject
RaiseException

ole32

CoFreeUnusedLibraries
CoRegisterClassObject
MkParseDisplayName
CLSIDFromProgID
StringFromCLSID
CoCreateFreeThreadedMarshaler
CreateItemMoniker
OleUninitialize
IIDFromString
CoCreateInstanceEx
OleRegEnumVerbs
OleRegGetUserType
CoSetProxyBlanket

ntdll

NtQuerySecurityObject
RtlAddAccessAllowedAce
wcscat
RtlLookupElementGenericTable
RtlxUnicodeStringToOemSize
RtlLengthSecurityDescriptor
RtlSetGroupSecurityDescriptor
NtQueryInformationProcess
RtlDosPathNameToNtPathName_U
RtlGUIDFromString
RtlLengthSid
RtlAddAce
RtlAppendUnicodeStringToString
NtQueryKey
RtlOpenCurrentUser
NtQueryDirectoryFile
RtlSetOwnerSecurityDescriptor
RtlCopySid
RtlLengthRequiredSid
RtlCopyUnicodeString
RtlRunDecodeUnicodeString
RtlFreeHeap
RtlValidSid
RtlValidSecurityDescriptor
NlsMbCodePageTag
RtlRaiseStatus
NtCreateFile
RtlUpcaseUnicodeStringToOemString
RtlxAnsiStringToUnicodeSize
NtCreateKey
RtlNtStatusToDosError
RtlInitAnsiString
NtOpenProcessToken
NtFreeVirtualMemory
RtlGetOwnerSecurityDescriptor
strrchr
RtlDeleteSecurityObject
NtAdjustPrivilegesToken
NtClose
NtDeleteKey
NtFsControlFile
NtOpenEvent
RtlFreeSid
NtSetEvent
swprintf
NtSetSecurityObject
NtSetValueKey
RtlUnicodeStringToOemString
NtWriteFile
RtlInitString
_strnicmp
_allmul
NtOpenSymbolicLinkObject
RtlFormatCurrentUserKeyPath
VerSetConditionMask
RtlxUnicodeStringToAnsiSize
RtlFreeUnicodeString
RtlReAllocateHeap
RtlUnwind
RtlCreateTimerQueue
NlsMbOemCodePageTag
RtlSetEnvironmentVariable
RtlTimeFieldsToTime
_wcsnicmp
NtDuplicateObject
RtlQueryEnvironmentVariable_U
RtlCreateHeap
NtSetInformationProcess
atoi
NtCancelIoFile
_wcslwr
NtEnumerateValueKey
RtlQueryRegistryValues
NtQueryVirtualMemory
NtAllocateVirtualMemory
RtlSubAuthoritySid
RtlInitUnicodeString
NtRequestWaitReplyPort
RtlUnicodeToOemN
NtOpenThreadToken
RtlUnicodeStringToInteger
RtlAcquireResourceExclusive
wcscmp
NtDeleteValueKey
memmove
RtlEqualSid
wcslen
RtlUpcaseUnicodeChar
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
RtlValidRelativeSecurityDescriptor
RtlPrefixUnicodeString
NtImpersonateAnonymousToken
RtlSizeHeap
RtlOemStringToUnicodeString
NtOpenProcess
RtlCreateUnicodeStringFromAsciiz

comdlg32

GetFileTitleW
PrintDlgA
PageSetupDlgA
CommDlgExtendedError
GetOpenFileNameA
PrintDlgExW
ChooseFontW
PrintDlgW
GetOpenFileNameW
GetFileTitleA
ChooseFontA
GetSaveFileNameW
FindTextW
ChooseColorW
ChooseColorA
PageSetupDlgW
FindTextA
GetSaveFileNameA

Sections

.bss
Size: 512B - Virtual size: 491B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textbss
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 482B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 491B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textbss
Size: 512B - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 486B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 481B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0487fea5b2cb518b9228e86e4ccdca3

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

rpcrt4

shell32

version

gdi32

comctl32

oleaut32

user32

msvcrt

kernel32

ole32

ntdll

comdlg32

Sections

.bss Size: 512B - Virtual size: 491B

.textbss Size: 512B - Virtual size: 496B

.tls Size: 512B - Virtual size: 482B

.tls Size: 512B - Virtual size: 491B

.text Size: 223KB - Virtual size: 222KB

.textbss Size: 512B - Virtual size: 336KB

.tls Size: 512B - Virtual size: 486B

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 512B - Virtual size: 481B

.bss
Size: 512B - Virtual size: 491B

.textbss
Size: 512B - Virtual size: 496B

.tls
Size: 512B - Virtual size: 482B

.tls
Size: 512B - Virtual size: 491B

.text
Size: 223KB - Virtual size: 222KB

.textbss
Size: 512B - Virtual size: 336KB

.tls
Size: 512B - Virtual size: 486B

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 512B - Virtual size: 481B