1ad7c1b7b05f881c71784c229a603c75d0a696bc3097817910da919f43d82a17

Sharing

Copy URL Twitter E-mail

General

Target

1ad7c1b7b05f881c71784c229a603c75d0a696bc3097817910da919f43d82a17
Size

1.1MB
MD5

1d714dbe8ace451587cf7008bf284286
SHA1

b2d1691febd0d593aafc834779f004ee48c1bced
SHA256

1ad7c1b7b05f881c71784c229a603c75d0a696bc3097817910da919f43d82a17
SHA512

2c3aff1cff7ef0f6d07a377e606703a926eae485f9205b9b1e15f2d24e9418ed15a8bd7301a81e1de69ede494e5358868b22ba295d0720d56831ca21648f248a
SSDEEP

24576:jZ+LFRpYxBsLkFmsyWG1BxAV19dSwdbuQDKPr+i6rdrl:sRRpeeoBkBxAV4yar+i6rRl

Score

N/A

Malware Config

Signatures

Files

1ad7c1b7b05f881c71784c229a603c75d0a696bc3097817910da919f43d82a17
.exe windows x86

65795b28a9a1b1c58e966ed5238c7fa4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeExA
GetSystemDirectoryA
GetFileSize
CreateFileMappingA
UnmapViewOfFile
LocalReAlloc
IsDBCSLeadByteEx
FindResourceExW
LoadResource
GetSystemDefaultLangID
lstrcmpA
CompareFileTime
GetLastError
LockResource
FindResourceA
LocalFree
LocalAlloc
lstrcatA
lstrcpyA
lstrlenA
FreeLibrary
SetEnvironmentVariableA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
SetStdHandle
GetTimeZoneInformation
SetFilePointer
GetLocaleInfoW
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
IsValidCodePage
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetOEMCP
GetACP
GetEnvironmentStringsW
GetEnvironmentStrings
GetFileType
SetHandleCount
HeapSize
HeapReAlloc
VirtualAlloc
GetWindowsDirectoryA
VirtualFree
HeapCreate
ExitProcess
GetCurrentThread
SetLastError
TlsAlloc
TlsGetValue
WriteFile
GetCPInfo
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetProcessHeap
GetCommandLineA
RaiseException
HeapAlloc
HeapFree
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
InterlockedDecrement
InterlockedIncrement
CompareStringA
CompareStringW
ReleaseMutex
CreateMutexA
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
GetVersionExA
GetComputerNameA
Sleep
QueryPerformanceCounter
lstrlenW
ResetEvent
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
IsDBCSLeadByte
CreateEventW
CloseHandle
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
DeleteFileA
CreateProcessA
GetSystemDirectoryW
lstrcpynA
GetModuleFileNameW
GetWindowsDirectoryW
GetModuleHandleW
lstrcmpiA
GetModuleFileNameA
HeapDestroy
SetEndOfFile
GetSystemInfo
OpenSemaphoreA
CopyFileA
FindNextFileA
FindFirstFileA
RemoveDirectoryA
CreateDirectoryA
WaitForSingleObjectEx
GetModuleHandleA
GetDiskFreeSpaceA
WriteFileEx
GlobalAlloc
GlobalFree
CreateEventA
GetUserDefaultLangID
SleepEx
CreateThread
SetEvent
ExpandEnvironmentStringsA
GetLocalTime
OpenMutexA
MapViewOfFile
OpenFileMappingA
FatalAppExitA
WaitForMultipleObjects

user32

GetSystemMetrics
wsprintfW
GetDlgItem
GetPropA
SetDlgItemTextW
LoadStringA
CharNextA
ReleaseDC
GetDC
GetDesktopWindow
CharLowerA
DialogBoxIndirectParamW
MoveWindow
GetWindowRect
GetParent

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
OpenThreadToken
GetTokenInformation
GetLengthSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
RegEnumValueA
RegEnumValueW
RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
DeregisterEventSource
InitializeAcl
AddAccessAllowedAce
FreeSid
ReportEventA
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

msvcrt

fclose
printf
sprintf
rand
strrchr
strstr
strchr
wcsstr
fprintf
wcscpy
wcscmp
free
memmove
malloc
strncpy
_chdir
atol
fflush
strncmp
wcschr
wcslen
vprintf

crypt32

CertDeleteCertificateFromStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertDeleteCRLFromStore
CertAddCRLContextToStore
CertFindCRLInStore
CertEnumCRLsInStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65795b28a9a1b1c58e966ed5238c7fa4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

version

msvcrt

crypt32

Sections

.text Size: 108KB - Virtual size: 105KB

.rdata Size: 84KB - Virtual size: 80KB

.data Size: 36KB - Virtual size: 2.2MB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 108KB - Virtual size: 105KB

.rdata
Size: 84KB - Virtual size: 80KB

.data
Size: 36KB - Virtual size: 2.2MB

.rsrc
Size: 8KB - Virtual size: 4KB