99f281b1384a8bb8b679064f3a9b6f26daa5e5d8a54a9452262f60c41a2175f8

Sharing

Copy URL

Twitter E-mail

General

Target

99f281b1384a8bb8b679064f3a9b6f26daa5e5d8a54a9452262f60c41a2175f8
Size

367KB
MD5

421b240301bb855687ffcade44017435
SHA1

6e34447474f8d061c6824ef08b41e01385a25360
SHA256

99f281b1384a8bb8b679064f3a9b6f26daa5e5d8a54a9452262f60c41a2175f8
SHA512

6e98e6acf6901fee689b26d108ee72bb1dc7a58cae3f7d2a99664ca409a1f6174575503857802f8d8c95fdfd73f265617fa971a0f3cbafa6aedf860ccf526245
SSDEEP

6144:Z0pqlAPM9FURr7mmS6PPL6RgoHjoyXgq48ct8Yc8396qyti4:ZRCk9gHmH6WRloKCyYVFyt/

Score

N/A

Malware Config

Signatures

Files

99f281b1384a8bb8b679064f3a9b6f26daa5e5d8a54a9452262f60c41a2175f8
.exe windows x86

41fa6b0d39620e58dfa37a5ad1df554c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

OleCreateFromFile
CoDisconnectObject
OleQueryLinkFromData
CoRegisterClassObject
OleIsRunning
UtGetDvtd16Info
CoFileTimeNow
OleDraw
OleDuplicateData
CoReleaseMarshalData
OleLockRunning
ReadOleStg
OleCreateLinkFromDataEx
CoRegisterMessageFilter
GetHGlobalFromStream
EnableHookObject
OleGetIconOfClass
CoGetMarshalSizeMax
StgOpenStorage
CoGetClassObject
CoSetProxyBlanket
UpdateDCOMSettings
GetClassFile
DllDebugObjectRPCHook
UtGetDvtd32Info
IsAccelerator
CreateBindCtx
ReadClassStg
OleCreate
RegisterDragDrop
OleConvertIStorageToOLESTREAM
CreateOleAdviseHolder
CoQueryProxyBlanket
CoSuspendClassObjects
OleSaveToStream
WriteFmtUserTypeStg
CoRevertToSelf
StringFromGUID2
OleCreateFromFileEx
CoRegisterSurrogate
CoCopyProxy
ReadStringStream
StgIsStorageFile
CreateILockBytesOnHGlobal
CoCreateInstanceEx
CreateItemMoniker
OleRegGetUserType
CoIsHandlerConnected
OleSetClipboard
CoGetTreatAsClass
CoGetPSClsid
CreateFileMoniker
CoMarshalHresult
CreatePointerMoniker
CoGetCurrentLogicalThreadId
StgOpenStorageEx
RevokeDragDrop
OleCreateFromData
CoInitialize
IIDFromString
CoGetObject
OleBuildVersion
CreateClassMoniker
OleRun
UtConvertDvtd16toDvtd32
GetRunningObjectTable
OleSetAutoConvert
CoBuildVersion
FreePropVariantArray

user32

MoveWindow
SendMessageA
GetWindowRect
SendIMEMessageExW
ToUnicode
EnumWindowStationsW
SetCaretBlinkTime
RegisterClipboardFormatW
DdeClientTransaction
GetWindowContextHelpId
SwitchToThisWindow
MapWindowPoints
CallWindowProcW
GetMenuContextHelpId
DialogBoxIndirectParamA
FindWindowExA
GetUserObjectInformationA
OemToCharBuffA
CreateIconIndirect
DdeAccessData
CreateWindowStationA
DefWindowProcW
OffsetRect
SetParent
DlgDirListComboBoxW
DefMDIChildProcW
GetScrollPos
GrayStringA
CharNextW
ShowCaret
EnumDesktopsW
RegisterClassExA
CreateAcceleratorTableW
GetMenuStringA
UnregisterClassW
OpenWindowStationW
CreatePopupMenu
IsCharLowerW
InsertMenuA
SetClassLongW
EnumPropsExA
LoadMenuA
OpenInputDesktop
GetTabbedTextExtentA
LookupIconIdFromDirectory
ValidateRect
GetWindowTextW
CallMsgFilter
IsDialogMessageW
DlgDirSelectComboBoxExW
WINNLSGetEnableStatus
PostQuitMessage
DlgDirListW
LoadAcceleratorsA
EnumWindows
SetFocus
SetScrollInfo
GetMessageTime
EndDeferWindowPos
SetDlgItemInt
GetClientRect
CharUpperBuffW
SetForegroundWindow
ShowScrollBar
GetTitleBarInfo
GetMenuInfo
PeekMessageA
GetWindowModuleFileNameW
UpdateWindow
SetDlgItemTextW
ChangeMenuA
OemKeyScan
GetProcessDefaultLayout
GetDesktopWindow
MessageBeep
GetWindowDC
CharLowerBuffA
WINNLSGetIMEHotkey
RegisterClipboardFormatA
GetDC
IsCharAlphaW
GetDoubleClickTime
GetMenu

kernel32

OpenMutexW
OpenFileMappingA
FindResourceW
GetEnvironmentStrings
IsBadReadPtr
OutputDebugStringW
GenerateConsoleCtrlEvent
GetACP
LoadLibraryA
GlobalGetAtomNameW
GetCurrentDirectoryW
GetNamedPipeHandleStateA
ExitProcess
EnumCalendarInfoExW
TlsAlloc
GetPrivateProfileSectionNamesW
SetFileAttributesA
GetModuleFileNameW
ConvertDefaultLocale
SetDefaultCommConfigA
FreeEnvironmentStringsW
SignalObjectAndWait
ExpandEnvironmentStringsW
SetEnvironmentVariableA
GetStringTypeW
WideCharToMultiByte
OpenWaitableTimerA
FillConsoleOutputAttribute
EnumResourceLanguagesA
WritePrivateProfileStringA
GetProfileSectionW
IsDBCSLeadByteEx
VirtualFree
SetVolumeLabelW
SetConsoleTextAttribute
CreateFileW
WriteConsoleInputA
GlobalFree
GetCurrentThread
RtlFillMemory
lstrcpy
EndUpdateResourceW
TransmitCommChar
EnumResourceNamesA
GetPrivateProfileIntA
Sleep
LoadLibraryExA
EnumCalendarInfoExA
ReadConsoleOutputAttribute
GetProfileIntA
EnumTimeFormatsA
VirtualFreeEx
GetPrivateProfileIntW
GetCompressedFileSizeW
SetLocaleInfoA
GetVersionExA
SleepEx
GetModuleHandleW
GetCommProperties
lstrcmpiA
GetDiskFreeSpaceW
HeapUnlock
CancelIo
RaiseException
SetProcessAffinityMask
FormatMessageA
WriteProfileSectionW
BackupWrite
FindClose
FillConsoleOutputCharacterW
ReadConsoleInputA
FindAtomA
CreateEventA
GetThreadSelectorEntry
GetLogicalDriveStringsA
VirtualAlloc
VirtualProtect

shlwapi

PathIsRelativeA
UrlCompareA
UrlUnescapeW
SHEnumKeyExA
PathMakePrettyW
PathFindSuffixArrayW
wnsprintfA
PathCreateFromUrlW
StrCSpnIW
StrCmpNIW
IntlStrEqWorkerW
SHRegEnumUSValueA
SHCopyKeyW
StrSpnA
StrPBrkW
PathIsPrefixW
PathMakePrettyA
AssocQueryStringByKeyW
SHCreateStreamOnFileA
PathGetDriveNumberA
PathIsPrefixA
SHAutoComplete
ColorAdjustLuma
SHRegEnumUSKeyA
GetMenuPosFromID
SHRegDeleteEmptyUSKeyW
StrFromTimeIntervalW
UrlCompareW
SHRegOpenUSKeyW
UrlHashA
PathIsDirectoryA
PathMatchSpecW
PathRemoveBackslashA
PathGetArgsA
ChrCmpIW
StrStrA
SHGetInverseCMAP
PathMatchSpecA
PathIsContentTypeA
PathIsUNCServerA
PathRemoveFileSpecW
SHEnumValueW
PathUndecorateA
SHRegOpenUSKeyA
PathIsNetworkPathW
PathIsRootA
SHDeleteValueA
StrNCatA
StrRChrW
StrCpyNW
StrCmpNIA
UrlCanonicalizeW
PathStripPathA
StrRStrIA
PathRemoveArgsW
StrRChrIW
SHRegDeleteUSValueW
SHRegEnumUSKeyW
PathSkipRootW
StrSpnW
SHDeleteEmptyKeyW
SHOpenRegStreamW
PathIsSystemFolderW
SHRegCreateUSKeyW
PathCompactPathA
StrRetToBufW
SHRegGetBoolUSValueW
PathUnmakeSystemFolderA
PathAddBackslashW
SHRegQueryInfoUSKeyW
PathParseIconLocationW
StrRetToStrW
PathRenameExtensionW
PathFindExtensionA
SHQueryInfoKeyW
StrToIntExA
StrRetToStrA

advapi32

AddAccessAllowedAce
SetNamedSecurityInfoA
CryptExportKey
BuildTrusteeWithNameA
GetCurrentHwProfileW
CryptReleaseContext
CryptDecrypt
MakeAbsoluteSD
LogonUserA
ConvertSecurityDescriptorToAccessNamedA
GetTrusteeNameW
LookupPrivilegeNameA
DestroyPrivateObjectSecurity
EnumDependentServicesW
AdjustTokenPrivileges
ObjectCloseAuditAlarmA
GetMultipleTrusteeW
GetSecurityDescriptorLength
ObjectCloseAuditAlarmW
BuildSecurityDescriptorW
EnumDependentServicesA
NotifyChangeEventLog
AdjustTokenGroups
RegQueryMultipleValuesA
StartServiceCtrlDispatcherA
InitializeAcl
FreeSid
FindFirstFreeAce
PrivilegedServiceAuditAlarmA
GetEffectiveRightsFromAclA
CreatePrivateObjectSecurity
LookupPrivilegeNameW
ObjectDeleteAuditAlarmW
GetOldestEventLogRecord
AddAuditAccessAce
QueryServiceLockStatusA
RegCreateKeyW
OpenProcessToken
ReadEventLogW
GetOverlappedAccessResults
GetExplicitEntriesFromAclA
QueryServiceStatus
SetEntriesInAclW
GetSidSubAuthority
AllocateAndInitializeSid
RegEnumKeyW
CryptGetDefaultProviderW
RegisterServiceCtrlHandlerW
RegSetValueA
GetMultipleTrusteeOperationW
LookupAccountSidA
CryptSetProviderA
GetFileSecurityA
SetServiceBits
ClearEventLogW
GetServiceKeyNameA
CryptHashSessionKey
RegisterEventSourceA
CryptDuplicateHash
GetSecurityDescriptorGroup
OpenServiceA
RegCreateKeyA
LookupPrivilegeDisplayNameA
CryptGetKeyParam
IsValidAcl
LogonUserW
GetAuditedPermissionsFromAclW
GetSecurityDescriptorDacl
OpenBackupEventLogA

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

41fa6b0d39620e58dfa37a5ad1df554c

Headers

DLL Characteristics

File Characteristics

Imports

ole32

user32

kernel32

shlwapi

advapi32

Sections

.text Size: 69KB - Virtual size: 68KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: - Virtual size: 8KB

.text
Size: 69KB - Virtual size: 68KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: - Virtual size: 8KB