fa85bdc57824fccdc09ff6137285e616cd2f973c2743bfa485d164b0c9091c24

Sharing

Copy URL Twitter E-mail

General

Target

fa85bdc57824fccdc09ff6137285e616cd2f973c2743bfa485d164b0c9091c24
Size

198KB
MD5

a136231e982bf9e54e8bb0328346f124
SHA1

61ed856a5ec52f2ffbf9416b5af0942e37e994c6
SHA256

fa85bdc57824fccdc09ff6137285e616cd2f973c2743bfa485d164b0c9091c24
SHA512

f06b6cfb421fc97cdefe96581a06316c2cbb49f99a2aa0d14b059ccd381bddda071b306085cf613e4bcb78b092410debc7a040ca3661bc345beb2ba9af389735
SSDEEP

6144:2qY9FP4A7HFCbPnEszHQ5/wXHlJywGTBJ7MrZ3xSkDs:2bFP4bLEszK/igTrv

Score

N/A

Malware Config

Signatures

Files

fa85bdc57824fccdc09ff6137285e616cd2f973c2743bfa485d164b0c9091c24
.dll windows x86

dc1380c197fbc885429e29f9940eb063

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueA
OpenProcessToken
GetUserNameW
RegCreateKeyW
RegEnumKeyW
RegSetValueExA
RegCreateKeyExW
RegSetValueW
RegQueryValueExA
RegQueryValueExW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyA
RegDeleteKeyW
RegEnumKeyExA
RegCreateKeyA
RegQueryValueW
LookupPrivilegeValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueW
RegDeleteValueA
RegEnumValueA
RegEnumValueW
RegOpenKeyExW
RegNotifyChangeKeyValue
GetUserNameA
RegOpenKeyA
RegEnumKeyA
RegFlushKey
RegEnumKeyExW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW

ws2_32

WSAStartup
htonl
select
shutdown
gethostname
inet_ntoa
connect
ntohl
inet_addr
htons
getsockname
setsockopt
bind
socket
closesocket
listen
accept
ioctlsocket
recv
send
gethostbyname

gdi32

CreateDIBSection
SelectObject
BitBlt
PatBlt
DeleteDC
CreateCompatibleDC
GetDeviceCaps
GdiFlush
CreateDCA
DeleteObject

kernel32

FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
CreateMutexA
CloseHandle
PeekNamedPipe
WriteFile
Sleep
GetExitCodeProcess
CreateProcessA
TerminateProcess
ReadFile
GetEnvironmentVariableA
ExitThread
GetStartupInfoA
CreatePipe
ResumeThread
CreateThread
TerminateThread
CreateEventA
FindFirstFileA
FindClose
ResetEvent
FindNextFileA
lstrcmpA
lstrlenA
SetEvent
IsBadReadPtr
lstrcatA
lstrcpyA
CreateFileA
GetFileSize
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetSystemDirectoryA
CreateDirectoryA
GetLastError
SetLastError
lstrcmpiA
RemoveDirectoryA
CopyFileA
GetModuleFileNameA
WinExec
DeleteFileA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetCurrentProcess
Process32First
GetLogicalDrives
GetDriveTypeA
OpenProcess
Process32Next
CreateToolhelp32Snapshot
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetEnvironmentVariableA
WaitForSingleObject
MoveFileA
HeapFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThreadId
GetSystemTimeAsFileTime
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetFullPathNameA
GetCurrentDirectoryA
SetFilePointer
LCMapStringA
LCMapStringW
ExitProcess
RtlUnwind
GetConsoleCP
GetConsoleMode
RaiseException
SetHandleCount
GetModuleHandleA

user32

SetWindowsHookExA
DrawIconEx
GetIconInfo
GetCursorInfo
CallNextHookEx
UnhookWindowsHookEx

netapi32

NetApiBufferFree
NetUserGetInfo

wininet

InternetCheckConnectionA

iphlpapi

GetIpAddrTable

Exports

Exports

AdjustTokenPrivileges
GetUserNameA
GetUserNameW
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyW
RegDeleteValueA
RegDeleteValueW
RegEnumKeyA
RegEnumKeyExA
RegEnumKeyExW
RegEnumKeyW
RegEnumValueA
RegEnumValueW
RegFlushKey
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegQueryValueW
RegSetValueA
RegSetValueExA
RegSetValueExW
RegSetValueW
a
self_delete

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SData
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc1380c197fbc885429e29f9940eb063

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

gdi32

kernel32

user32

netapi32

wininet

iphlpapi

Exports

Exports

Sections

.text Size: 151KB - Virtual size: 150KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 5KB - Virtual size: 12KB

.SData Size: 512B - Virtual size: 4B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 151KB - Virtual size: 150KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 5KB - Virtual size: 12KB

.SData
Size: 512B - Virtual size: 4B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB