edbac15364cab48f5279388ff8eb9ea7b78ef4b896350bdc6f31014bd139a0cc

Sharing

Copy URL Twitter E-mail

General

Target

edbac15364cab48f5279388ff8eb9ea7b78ef4b896350bdc6f31014bd139a0cc
Size

385KB
MD5

d4118f978e6dedbdd58eeb017f891e16
SHA1

9191372546b93c0b382da6a4d03a6370bca5e2f0
SHA256

edbac15364cab48f5279388ff8eb9ea7b78ef4b896350bdc6f31014bd139a0cc
SHA512

22006b1ba20b48ea9139a2b6f5df06a5df71fc2a50e415f4fda0c954521244ba4bc90c50a9482ebec7b88b63ba189e09fa72a17c8eaf20100c6ae2d9158561d5
SSDEEP

3072:MRza9xz9aQn6/7irOQjNI7HbB1yBQHbhsFhsFhsFhsFhsFhsFhsFhsFhsFhsFhs6:n9OQe7ipjNg1xD

Score

N/A

Malware Config

Signatures

Files

edbac15364cab48f5279388ff8eb9ea7b78ef4b896350bdc6f31014bd139a0cc
.exe windows x86

ddb762a1f058964e9c5f8acbc57d159e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlCreateTimer
RtlDosPathNameToNtPathName_U
RtlCopyUnicodeString
RtlUnwind
NtClose
RtlDeleteCriticalSection
RtlCopyLuid
NtQueryPerformanceCounter
NtDeleteValueKey
RtlInitAnsiString
NtDeviceIoControlFile
RtlInitializeResource
NtQueryInformationProcess
RtlUpcaseUnicodeStringToOemString
_wcsupr
NtAllocateLocallyUniqueId
RtlRunDecodeUnicodeString
_strnicmp
RtlCompareUnicodeString
RtlValidSecurityDescriptor
RtlAllocateHeap
NtTerminateThread
RtlCreateEnvironment
NtQueryDirectoryObject
RtlMultiByteToUnicodeN
RtlAcquireResourceExclusive
NtWriteFile
RtlUnicodeToOemN
NtAdjustPrivilegesToken
_wcsicmp
NtRequestWaitReplyPort
NtSetValueKey
NtUnmapViewOfSection
NtQueryKey
RtlTimeToTimeFields
NtDuplicateToken
NtFsControlFile
_allmul
RtlOemStringToUnicodeString
RtlStringFromGUID
wcstol
NtAllocateVirtualMemory
NtEnumerateValueKey
RtlReleaseResource
NtQueryVirtualMemory
RtlTimeToSecondsSince1970
wcsncat
NtQueryInformationToken
RtlAdjustPrivilege
RtlSetDaclSecurityDescriptor
wcstoul
RtlNewSecurityObject
RtlInitializeGenericTable
RtlLookupElementGenericTable

msvcrt

_ftol
_tell
srand
rand
__p__iob
_access

user32

TranslateMessage
UnhookWindowsHookEx
IsWindowVisible
MoveWindow
PtInRect
GetDC
EndDialog
GetKeyState
CallNextHookEx
wsprintfW
GetWindowDC
GetDlgItemTextA
EndPaint
PeekMessageA
InvalidateRect
IsRectEmpty
DialogBoxParamW
DispatchMessageA
CharPrevW
ClientToScreen
GetDlgItemTextW
DialogBoxParamA
GetMenuItemCount
RegisterClassW
LoadIconW
GetWindowTextA
MessageBoxA
CharPrevA
RegisterClassExA
LoadCursorW
LoadStringW
SetMenu
CreateWindowExW
DispatchMessageW
RegisterClassExW
GetCapture
RedrawWindow
SendMessageA

advapi32

CryptAcquireContextW
UnregisterTraceGuids
RegisterEventSourceW
RegNotifyChangeKeyValue
SetNamedSecurityInfoW
AddAce
AdjustTokenPrivileges
GetSecurityDescriptorControl
StartServiceW
FreeSid
OpenServiceW
RegSetValueA
OpenServiceA
CryptAcquireContextA
UnlockServiceDatabase
OpenThreadToken
LockServiceDatabase
RegQueryValueA
RegConnectRegistryW
RegFlushKey
RegSetValueExA
CopySid
CryptCreateHash
ConvertSidToStringSidW
GetSecurityDescriptorOwner
RegDeleteKeyW
DeleteService
CloseServiceHandle
LsaOpenPolicy
RegCreateKeyExW
GetLengthSid
RegEnumValueW
RegCreateKeyW
RegisterTraceGuidsW
EqualSid
CryptGetHashParam
SetServiceStatus
CryptDestroyHash
CryptGenRandom
ControlService
IsValidSid
RegOpenKeyExA
ReportEventW
GetSidLengthRequired
RegQueryValueW
GetTraceEnableFlags
ConvertStringSidToSidW
RegDeleteKeyA
RegEnumValueA
SetSecurityDescriptorDacl
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DeregisterEventSource
InitializeSecurityDescriptor
CryptDestroyKey
GetUserNameA
InitializeAcl
CryptReleaseContext
GetTraceEnableLevel
CryptHashData
SetSecurityDescriptorOwner
AddAccessAllowedAce
SetFileSecurityW
RegQueryInfoKeyW
GetSidSubAuthorityCount
QueryServiceStatus
LookupAccountNameW
RegDeleteValueW
RegOpenKeyExW
IsValidSecurityDescriptor
LsaQueryInformationPolicy
LsaFreeMemory
RegOpenKeyA
RegCreateKeyA
GetSidSubAuthority
DuplicateTokenEx
OpenSCManagerW
RegCloseKey
GetSidIdentifierAuthority
LookupAccountSidW
SetEntriesInAclW
ChangeServiceConfigW
SetSecurityDescriptorGroup

version

VerQueryValueW
VerLanguageNameA
VerFindFileW
GetFileVersionInfoW
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW

rpcrt4

IUnknown_AddRef_Proxy
RpcStringBindingComposeW
CStdStubBuffer_Disconnect
RpcServerUnregisterIf
CStdStubBuffer_Connect
RpcServerInqBindings
RpcRaiseException
NdrClientCall2
RpcStringFreeW
NdrDllRegisterProxy
RpcBindingVectorFree
RpcBindingSetAuthInfoW
RpcImpersonateClient
RpcBindingSetAuthInfoExW
UuidCreate
RpcServerUseProtseqEpW
CStdStubBuffer_DebugServerRelease
RpcStringFreeA
RpcServerRegisterIfEx
UuidToStringA
NdrCStdStubBuffer_Release
RpcRevertToSelf
NdrDllCanUnloadNow
NdrStubCall2
NdrDllGetClassObject
CStdStubBuffer_IsIIDSupported
IUnknown_QueryInterface_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
NdrOleFree

shlwapi

SHDeleteKeyW
StrRetToBufW
StrRChrW
PathAppendA
StrCatBuffW
StrStrW
PathSkipRootW
StrCmpNIW
PathRemoveFileSpecW
PathCombineW
SHGetValueW
PathIsURLW
PathIsRelativeW
PathRemoveBlanksW
StrCpyW
PathFindExtensionW
StrChrW
StrCpyNW
StrCmpIW
PathIsRootW
PathRemoveBackslashW
SHStrDupW
UrlIsW
PathAppendW
PathRemoveExtensionW
wnsprintfW
StrTrimW

kernel32

lstrcpyW
lstrcmpW
GetFileType
ResumeThread
GetModuleFileNameW
FileTimeToSystemTime
GetProcAddress
GetWindowsDirectoryA
GetComputerNameW
Sleep
CreateFileW
SetEvent
GetThreadLocale
FindNextFileW
InitializeCriticalSectionAndSpinCount
ExitProcess
FindFirstFileW
UnmapViewOfFile
CompareStringW
lstrcmpA
LCMapStringW
InterlockedDecrement
VirtualAlloc
GetSystemInfo
GetModuleHandleW
FormatMessageA
FreeEnvironmentStringsA
GetModuleHandleA
RtlUnwind
FindResourceW
GetCurrentProcess
GetCurrentThreadId
SetEndOfFile
lstrcpynA
GetTickCount
FreeLibrary
SetLastError
SetErrorMode
IsBadWritePtr
VirtualFree
FindNextFileA
SetFilePointer
LocalFree
GetSystemDirectoryW
lstrcmpiA
CreateThread
CreateDirectoryA
LocalAlloc
VirtualProtect
GetSystemTime
GetVersionExW
HeapAlloc
GetConsoleMode

gdi32

AbortDoc
SetWindowExtEx
ScaleWindowExtEx
CreateFontIndirectA
GetBitmapBits
OffsetViewportOrgEx
SetViewportExtEx

shell32

DragQueryFileW
SHGetFolderPathW
SHBindToParent
ShellExecuteW
SHGetDesktopFolder
SHBrowseForFolderW
DragQueryFileA
SHGetSpecialFolderLocation
SHGetFileInfoW
CommandLineToArgvW
SHGetMalloc
SHGetPathFromIDListA
SHChangeNotify
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetPathFromIDListW

Sections

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.code
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textbss
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 4KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.textbss
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 493B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ddb762a1f058964e9c5f8acbc57d159e

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

msvcrt

user32

advapi32

version

rpcrt4

shlwapi

kernel32

gdi32

shell32

Sections

.idata Size: 10KB - Virtual size: 9KB

.tls Size: 512B - Virtual size: 480B

.code Size: 65KB - Virtual size: 64KB

.textbss Size: 4KB - Virtual size: 3KB

BSS Size: 1KB - Virtual size: 1KB

DATA Size: 4KB - Virtual size: 30KB

.textbss Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 493B

.idata
Size: 10KB - Virtual size: 9KB

.tls
Size: 512B - Virtual size: 480B

.code
Size: 65KB - Virtual size: 64KB

.textbss
Size: 4KB - Virtual size: 3KB

BSS
Size: 1KB - Virtual size: 1KB

DATA
Size: 4KB - Virtual size: 30KB

.textbss
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 493B