ef68157ee73670795fac02118f59d1c1e00d71e268581fab59e9ae10bf62e5d4

Sharing

Copy URL Twitter E-mail

General

Target

ef68157ee73670795fac02118f59d1c1e00d71e268581fab59e9ae10bf62e5d4
Size

144KB
MD5

3c1e28add2f6d77241df2c9c69dcc5f0
SHA1

23394c294f9407115fc91bda5ce06a9f41172346
SHA256

ef68157ee73670795fac02118f59d1c1e00d71e268581fab59e9ae10bf62e5d4
SHA512

ebd7d43f93764be63d13fac5d020d4112f4c16b52b5f27d3ae8064d45e29080ac91359bbce26bc1a2ee901ecb16be9a3b29e047bc37a4db49b1d6343266ab331
SSDEEP

3072:pHn2X4SnJN7rAx6E2n3e9t3MX6624kRpsaec67ZD88:pH2ISnJN7rAxZqUOXV2367ZD8

Score

N/A

Malware Config

Signatures

Files

ef68157ee73670795fac02118f59d1c1e00d71e268581fab59e9ae10bf62e5d4
.exe windows x86

49f519345cffe7565b25cb72b4fa8892

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
HeapAlloc
GetProcessHeap
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalSize
GetTickCount
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetLocalTime
GetSystemInfo
ReleaseMutex
SetErrorMode
SetFileAttributesA
MoveFileExA
DefineDosDeviceA
OpenProcess
Process32Next
Process32First
GetCurrentThreadId
RaiseException
GetModuleHandleA
GetSystemDirectoryA
ExitProcess
TerminateThread
WinExec
CreateThread
SetLastError
GetModuleFileNameA
WriteFile
SetFilePointer
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetWindowsDirectoryA
lstrcatA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
GetPrivateProfileSectionNamesA
CancelIo
InterlockedExchange
SetEvent
lstrcpyA
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
Sleep
InitializeCriticalSection
LoadLibraryA
GetCurrentProcess

user32

MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
keybd_event
SendMessageA
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
ExitWindowsEx
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetDesktopWindow
SystemParametersInfoA
IsWindow
wsprintfA
GetWindowTextA
BlockInput
LoadCursorA
GetKeyState
GetAsyncKeyState
GetForegroundWindow
ReleaseDC
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop

gdi32

CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
GetDIBits

advapi32

RegQueryValueA
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
AllocateAndInitializeSid
IsValidSid
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
LsaFreeMemory
RegCloseKey
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
RegOpenKeyExA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

msvcrt

_strnicmp
calloc
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_strupr
_beginthreadex
strncat
strtok
_errno
strncpy
strncmp
atoi
strcat
rename
strrchr
_except_handler3
free
strcmp
malloc
strchr
strcpy
??2@YAPAXI@Z
memset
strstr
strlen
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memcpy
memmove
ceil
_ftol

shlwapi

SHDeleteKeyA

ws2_32

__WSAFDIsSet
gethostname
inet_addr
inet_ntoa
send
recvfrom
closesocket
WSAStartup
WSACleanup
WSAIoctl
setsockopt
socket
connect
sendto
listen
accept
getpeername
bind
select
getsockname
recv
ntohs
gethostbyname
htons

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

urlmon

URLDownloadToFileA

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA

userenv

CreateEnvironmentBlock

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA

msvfw32

ICSeqCompressFrameEnd
ICSendMessage

psapi

EnumProcessModules
GetModuleFileNameExA

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49f519345cffe7565b25cb72b4fa8892

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

shlwapi

ws2_32

msvcp60

urlmon

wtsapi32

userenv

wininet

msvfw32

psapi

Sections

.text Size: 104KB - Virtual size: 101KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 104KB - Virtual size: 101KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 8KB - Virtual size: 4KB