bf846964544ec40e132fba579da9cfcee5d72a599ef88fa17761858b831ae1e0

Sharing

Copy URL

Twitter E-mail

General

Target

bf846964544ec40e132fba579da9cfcee5d72a599ef88fa17761858b831ae1e0
Size

94KB
MD5

67d901bc449788aaf5682948bbf7b299
SHA1

58f405340f7e50b41d924e4430946ece428e015a
SHA256

bf846964544ec40e132fba579da9cfcee5d72a599ef88fa17761858b831ae1e0
SHA512

6c62cd2e2a6ffa01d04edde182f71531456d833ea4c9c804ced4ae6fdf3a7381de3e2a8d8db53082904681949c72b43ffad4c3bb1986507a3d3f7245cb9cf0e2
SSDEEP

1536:qK+Ennj3DH7uSX9OGrYGi8DeQVhJ3VuBovOUjvAkXlfPguOn:l+Ej3DH7uEYkNiovbvAkX14uu

Score

N/A

Malware Config

Signatures

Files

bf846964544ec40e132fba579da9cfcee5d72a599ef88fa17761858b831ae1e0
.exe windows x86

ecfe1c506d17188bd3c79eb47c487246

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetPathFromIDListA
DragQueryFileW
ShellExecuteA
SHFileOperationW
SHBrowseForFolderA
SHGetMalloc
SHChangeNotify
ShellExecuteExW
CommandLineToArgvW

kernel32

OpenProcess
InitializeCriticalSectionAndSpinCount
CreateDirectoryW
CreateFileA
HeapAlloc
GetSystemTime
GetLocalTime
RemoveDirectoryW
GetStringTypeW
GetCommandLineA
GetExitCodeProcess
FindNextFileA
ResumeThread
FreeLibrary
GetFileAttributesW
GetStdHandle
LockResource
IsBadReadPtr
ReleaseMutex
OutputDebugStringA
GetWindowsDirectoryW
SizeofResource
ReleaseSemaphore
CreateEventA
FindFirstFileW
WaitForMultipleObjects
GetLastError
GetVersionExA
LoadLibraryExA
LocalFree
GetWindowsDirectoryA
FileTimeToSystemTime
GetSystemInfo
WriteFile
GetFileAttributesA
UnhandledExceptionFilter
VirtualAlloc
ExitProcess
TlsGetValue
LoadLibraryA
WideCharToMultiByte

user32

GetWindowLongW
KillTimer
LoadStringA
GetSystemMetrics
SetWindowRgn
GetWindowLongA
GetClassNameA
MessageBoxA
CreateWindowExA
DefWindowProcA
wsprintfW
LoadStringW
IsWindowEnabled
GetDlgItemTextA
SystemParametersInfoW
RegisterClassExW
GetSysColor
WinHelpW
LoadCursorW
ExitWindowsEx
GetWindowRect
EnableWindow
GetWindowThreadProcessId
ReleaseDC
PtInRect
DrawFocusRect
EnumChildWindows
GetParent
SetWindowPos
GetKeyState
SetDlgItemTextA
GetWindowPlacement
GetWindowTextW

version

VerFindFileW
GetFileVersionInfoA
VerQueryValueA

ole32

CoDisconnectObject
OleRegGetMiscStatus
MkParseDisplayName
OleUninitialize
GetRunningObjectTable
CoGetObjectContext
CoUnmarshalInterface
CoSetProxyBlanket
CoRevertToSelf
CreateStreamOnHGlobal
CoInitialize
ReleaseStgMedium
CreateBindCtx
CoUninitialize
OleRegGetUserType
WriteClassStm
CoMarshalInterface
OleInitialize
StringFromCLSID
CoCreateFreeThreadedMarshaler
PropVariantCopy
CoRevokeClassObject
CoReleaseMarshalData
CoImpersonateClient
CLSIDFromProgID
StgCreateDocfile
CoGetClassObject
StgIsStorageFile
CoInitializeEx
CoCreateInstanceEx

shlwapi

PathFindFileNameW
PathIsDirectoryW
PathGetDriveNumberW
PathRemoveBlanksW
StrToIntExW
PathRemoveExtensionW
wnsprintfA
StrRetToBufW
StrChrIW
PathFindExtensionW
PathFileExistsW
StrStrIW
StrStrIA
StrToIntW
UrlUnescapeW
StrCmpNW
StrCmpNIA
PathRemoveFileSpecW
StrCmpNIW
PathSkipRootW
PathAppendW
PathCombineW
SHDeleteKeyA
PathRemoveBackslashW
PathStripToRootA
UrlCanonicalizeW
PathRemoveFileSpecA
PathIsURLW
PathIsRootW
PathStripToRootW
StrCmpIW
SHDeleteKeyW
StrCpyNW
PathAppendA
StrCatBuffW
AssocQueryStringW

ntdll

RtlGetDaclSecurityDescriptor
RtlSetEnvironmentVariable
RtlLeaveCriticalSection
RtlCompareUnicodeString
RtlInsertElementGenericTable
NtQueryPerformanceCounter
RtlCreateTimer
RtlAcquireResourceExclusive
RtlSubAuthoritySid
RtlUnicodeToMultiByteN
RtlDetermineDosPathNameType_U
RtlSubAuthorityCountSid
wcslen
RtlGUIDFromString
_alloca_probe
wcsstr
RtlOemStringToUnicodeString
RtlInitializeSid
NtQueryInformationProcess
RtlGetFullPathName_U
RtlSetSaclSecurityDescriptor
RtlCreateHeap
_stricmp
RtlxOemStringToUnicodeSize
NtOpenProcessToken
RtlUnicodeToOemN
NtClose
RtlQueryEnvironmentVariable_U
NtDelayExecution
RtlInitializeResource
RtlMultiByteToUnicodeN
RtlTimeToTimeFields
RtlDeleteResource
RtlRunDecodeUnicodeString
NtAdjustPrivilegesToken
NtRequestWaitReplyPort
RtlStringFromGUID

advapi32

RegEnumKeyExA
LsaQueryInformationPolicy
SetSecurityDescriptorOwner
GetSidLengthRequired
RegSetValueW
SetFileSecurityW
GetSidSubAuthorityCount
SetSecurityDescriptorDacl
RegEnumValueA
GetTraceEnableLevel
SetThreadToken
AdjustTokenPrivileges
RegFlushKey
GetAclInformation
RegDeleteValueW
GetSidSubAuthority
CryptDestroyHash
RevertToSelf
CopySid
StartServiceW
ConvertStringSidToSidW
CryptAcquireContextW
OpenServiceA
SetSecurityDescriptorGroup
QueryServiceStatus
RegOpenKeyExA
RegQueryValueA
GetUserNameW
OpenThreadToken
DeregisterEventSource
GetSidIdentifierAuthority
AllocateAndInitializeSid
RegEnumKeyA
CryptDestroyKey
RegSetValueExA
InitializeSecurityDescriptor
RegCreateKeyA
GetLengthSid
InitializeAcl
RegOpenKeyA
RegEnumValueW
CheckTokenMembership
SetServiceStatus
RegQueryInfoKeyA
LsaClose
GetAce
EqualSid

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ecfe1c506d17188bd3c79eb47c487246

Headers

File Characteristics

Imports

shell32

kernel32

user32

version

ole32

shlwapi

ntdll

advapi32

Sections

.text Size: 19KB - Virtual size: 18KB

.data Size: 60KB - Virtual size: 120KB

.tls Size: 10KB - Virtual size: 10KB

.text
Size: 19KB - Virtual size: 18KB

.data
Size: 60KB - Virtual size: 120KB

.tls
Size: 10KB - Virtual size: 10KB