a1772691541ce6cd0474471d395fafda6b83f71c9c4056ebdd6c763bf32a2445

Sharing

Copy URL Twitter E-mail

General

Target

a1772691541ce6cd0474471d395fafda6b83f71c9c4056ebdd6c763bf32a2445
Size

603KB
MD5

e65b3de01fab50e2ee4c8ec1f0f6ac2f
SHA1

02daf9f9fd1a4cb4587064259fa602435f760c08
SHA256

a1772691541ce6cd0474471d395fafda6b83f71c9c4056ebdd6c763bf32a2445
SHA512

7485a2dcd6241e61f846803e259eb586744f5e99f367bed8a185d0d14f50670705083e8364a697e5d7d706a7467eea037f90dbba8a56c277457feb8e0834bd43
SSDEEP

12288:dIOI1MusoOqzDxTyyfL844ZH+DVjGrjJn84:dIJ1MHtqvxWk+CGq4

Score

N/A

Malware Config

Signatures

Files

a1772691541ce6cd0474471d395fafda6b83f71c9c4056ebdd6c763bf32a2445
.exe windows x86

b7f8fd34a985a509f8f218cb5c1ba3fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegisterTraceGuidsW
RegOpenKeyExW
UnregisterTraceGuids
RegSetValueExW
TraceEvent
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
RegDeleteValueW
GetTraceEnableFlags
RegEnumValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
EncryptFileW
DecryptFileW
RegQueryValueExW

kernel32

LeaveCriticalSection
lstrlenW
HeapSetInformation
SizeofResource
LoadResource
RaiseException
FindResourceW
GetModuleHandleW
InterlockedIncrement
LoadLibraryExW
GetProcAddress
InterlockedDecrement
EnterCriticalSection
InitializeCriticalSection
GetModuleFileNameW
lstrcmpiW
MultiByteToWideChar
TryEnterCriticalSection
FindResourceExW
GetFileAttributesExW
LocalFree
FormatMessageW
GetProcessAffinityMask
GetFullPathNameW
GetCurrentProcess
QueryPerformanceFrequency
CloseHandle
GetCurrentThread
SetThreadAffinityMask
CreateEventW
SetEvent
Sleep
QueryPerformanceCounter
LockResource
FreeLibrary
GetLastError
GetStartupInfoW
InterlockedCompareExchange
GetVersionExA
CreateThread
GetVersionExW
CompareStringW
LocalAlloc
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SystemTimeToFileTime
GetSystemTime
GetCurrentProcessId
DeleteCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersion
GetFileAttributesW
GetModuleHandleA
GetExitCodeThread
GetSystemTimeAsFileTime
WaitForSingleObject
OutputDebugStringA
LoadLibraryW
SetLastError
ResetEvent
FlushInstructionCache
CreateProcessW
ExpandEnvironmentStringsW
IsWow64Process
DeleteFileW
CreateFileW
GetTempFileNameW
GetTempPathW
SetFileAttributesW
MoveFileExW
LoadLibraryA
BackupRead
BackupSeek
ReadFile
WriteFile
GetFileTime
GetProcessHeap
HeapFree
GetCurrentThreadId
GetTickCount
SetFileTime
DeviceIoControl
FindClose
RemoveDirectoryW

gdi32

DeleteObject

user32

DestroyWindow
RegisterClassExW
GetClassInfoExW
LoadCursorW
CharNextW
DestroyIcon
DispatchMessageW
PeekMessageW
LoadImageW
MessageBoxW
GetSystemMetrics
SetWindowLongW
MsgWaitForMultipleObjects
GetActiveWindow
CallWindowProcW
UnregisterClassA
GetWindowLongW
PostMessageW
DefWindowProcW
IsWindow
CreateWindowExW
SendMessageW
TranslateMessage

msvcr80

wcsrchr
swscanf_s
wcsstr
swprintf_s
_beginthreadex
_wcslwr_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
_CxxThrowException
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_cexit
__wgetmainargs
_amsg_exit
memset
_wutime32
calloc
_vscwprintf
vswprintf_s
memmove_s
free
memcpy_s
_purecall
malloc
memmove
_recalloc
wcsncpy_s
_vsnwprintf
wcstok_s
__CxxFrameHandler3
memcpy
_exit

shell32

SHCreateShellItem
ord75
ord155
SHBindToParent
CommandLineToArgvW
SHParseDisplayName

ole32

OleUninitialize
CoTaskMemRealloc
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoInitialize
CoUninitialize
PropVariantClear
CLSIDFromString

oleaut32

SysAllocString
VarUI4FromStr
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysStringLen

gdiplus

GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipDisposeImage
GdipCloneBitmapAreaI
GdipFree

shlwapi

PathFindFileNameW
SHRegEnumUSValueW
AssocQueryStringW
SHRegGetUSValueW
SHRegOpenUSKeyW
SHRegCloseUSKey
AssocGetPerceivedType
StrStrW
PathIsDirectoryEmptyW
ord158
UrlUnescapeW
SHStrDupW
PathRemoveFileSpecW
PathIsFileSpecW
PathFileExistsW
PathIsRelativeW
PathFindExtensionW
PathRenameExtensionW

wlxphotobase

?Delete@BasePrivate@@YAXPAX@Z
??1Exception@Base@@UAE@XZ
?New@BasePrivate@@YAPAXI_N@Z
?Throw@Base@@YGXJ@Z
?IsVistaOrGreater@OS@Base@@YG_NXZ
?ThrowLastError@Base@@YGXXZ
?GetBaseStringManager@String@Base@@SGAAVCAtlStringMgr@ATL@@XZ
?BaseAtlThrow@ATL@@YGXJ@Z

wlxphotosqm

?AddToStream@Sqm@@YGXKPBVTuple@1@@Z
?Startup@Sqm@@YGXXZ
?Shutdown@Sqm@@YGXXZ

metadatasys

WLXPSGetItemPropertyHandler

msi

ord90

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 403KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ddata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b7f8fd34a985a509f8f218cb5c1ba3fc

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcr80

shell32

ole32

oleaut32

gdiplus

shlwapi

wlxphotobase

wlxphotosqm

metadatasys

msi

Sections

.text Size: 111KB - Virtual size: 110KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 403KB - Virtual size: 404KB

.reloc Size: 11KB - Virtual size: 10KB

.ddata Size: 68KB - Virtual size: 68KB

.text
Size: 111KB - Virtual size: 110KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 403KB - Virtual size: 404KB

.reloc
Size: 11KB - Virtual size: 10KB

.ddata
Size: 68KB - Virtual size: 68KB