ed72669e586c60f4ac57106a29765c050495be618cc32f7bf168532417d2b305

Sharing

Copy URL Twitter E-mail

General

Target

ed72669e586c60f4ac57106a29765c050495be618cc32f7bf168532417d2b305
Size

148KB
MD5

812833ab2167226664a9fdaa696ac55a
SHA1

97f17dc3a07a80fa77aa77e3455c29a00234787b
SHA256

ed72669e586c60f4ac57106a29765c050495be618cc32f7bf168532417d2b305
SHA512

002cebab2ae3cb0f4b65efd61aa590f081911ad7e6dcf8ec8f7a9771add966cfb6cdfd8c20dbefb792c50f3f20d0cfbdc840d9a125eaecb943e0dea79e61e28b
SSDEEP

3072:Q5fiOIaxJI14AuZTMjMtkhmvFCy+Jdf71:z+NMXId/0z1

Score

N/A

Malware Config

Signatures

Files

ed72669e586c60f4ac57106a29765c050495be618cc32f7bf168532417d2b305
.dll windows x86

b7788135d18efa042c31a2fce26ad24d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
LoadLibraryA
WriteProcessMemory
CreateFileA
EnterCriticalSection
CreateMutexW
CloseHandle
LeaveCriticalSection
InterlockedDecrement
CreateEventA
SetLastError
CreateDirectoryA
MapViewOfFile
GetCurrentProcess
CreateFileMappingA
GetCommandLineA
WriteFile
GetLastError
HeapFree
GlobalAlloc
ReadProcessMemory
GetTickCount
OpenFileMappingA
UnmapViewOfFile
GetModuleHandleA
InterlockedIncrement
CreateProcessA
GetProcAddress
ExitProcess
TerminateProcess
GlobalFree
InterlockedCompareExchange
Sleep
GetVolumeInformationA
GetComputerNameA
LocalFree
GetModuleFileNameA
WaitForSingleObject
CopyFileA
HeapAlloc
OpenEventA

ole32

CoCreateInstance
CoSetProxyBlanket
CoCreateGuid
CoTaskMemAlloc
CoUninitialize
OleSetContainedObject
OleCreate
CoInitialize

user32

KillTimer
SetWindowLongA
ScreenToClient
ClientToScreen
PostQuitMessage
TranslateMessage
SendMessageA
SetWindowsHookExA
FindWindowA
DestroyWindow
GetMessageA
GetParent
GetWindowLongA
GetClassNameA
DefWindowProcA
PeekMessageA
DispatchMessageA
GetWindow
CreateWindowExA
SetTimer
RegisterWindowMessageA
GetWindowThreadProcessId
GetSystemMetrics
UnhookWindowsHookEx
GetCursorPos

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen

shlwapi

StrStrIW
UrlUnescapeW

advapi32

RegOpenKeyExA
RegCloseKey
OpenProcessToken
RegQueryValueExA
DuplicateTokenEx
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
SetTokenInformation
RegSetValueExA
GetUserNameA

shell32

SHGetFolderPathA

Exports

Exports

kbdMainlog

Sections

.text
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7788135d18efa042c31a2fce26ad24d

Headers

File Characteristics

Imports

kernel32

ole32

user32

oleaut32

shlwapi

advapi32

shell32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 118KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 916B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 120KB - Virtual size: 118KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 916B

.reloc
Size: 8KB - Virtual size: 6KB