b75961087eacf167466614a32c7df3eb9994d66d74c19e72d5d6a8b148153037

Sharing

Copy URL Twitter E-mail

General

Target

b75961087eacf167466614a32c7df3eb9994d66d74c19e72d5d6a8b148153037
Size

631KB
MD5

5822d3890513b4ea9f8fa1083e304bea
SHA1

772c462ba15dabc9eb2f191c49a4174e5b0eac35
SHA256

b75961087eacf167466614a32c7df3eb9994d66d74c19e72d5d6a8b148153037
SHA512

269b2e86b595e80dd79a01844aa4a5c64c0bdaccb36b52aa4f7cac9c7bb172b7cb346006f7ad68993d552fca0623c98ef62b4739845f13348aa65b1d0157ad26
SSDEEP

6144:ay9eKO+y0uummghz5IAaI4NZZR0uKb2Uk+90/1FMRPpvRZ+kd1FKidiv9aeVGDld:azLDubghCACrxsKEBJ7femc7W/jxn

Score

N/A

Malware Config

Signatures

Files

b75961087eacf167466614a32c7df3eb9994d66d74c19e72d5d6a8b148153037
.exe windows x86

99d9e80d78a09a0d6dbeeb8313d14438

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleTitleW
lstrcpynA
GetModuleFileNameW
DefineDosDeviceA
BeginUpdateResourceA
SetCommTimeouts
ExitThread
CompareStringW
InterlockedExchange
EnumResourceNamesW
SetConsoleTitleA
GetModuleHandleA
FindNextVolumeW
GetPrivateProfileStructW
EnumResourceLanguagesW
IsValidLocale
CreateEventW
GetLocalTime
SetConsoleMenuClose
HeapDestroy
PeekNamedPipe
GetProcAddress
FreeLibrary
GlobalAddAtomA
IsBadStringPtrA
GetVolumeNameForVolumeMountPointW
ExitProcess
SetEnvironmentVariableA
VerLanguageNameA
QueryInformationJobObject
WritePrivateProfileStructW
GetConsoleInputWaitHandle
EnumCalendarInfoExA
CreateSemaphoreA
GetSystemTime
VirtualAllocEx
SetConsoleInputExeNameW
DosDateTimeToFileTime
GetHandleInformation
ReadConsoleA
RegisterWaitForInputIdle
TerminateProcess
UTRegister
GetTickCount
TerminateThread
FreeEnvironmentStringsA
ResetEvent
OutputDebugStringW
GetCompressedFileSizeW
VirtualAlloc
LoadLibraryA
GetVersion

gdi32

SetTextCharacterExtra
CreateRoundRectRgn
GetBoundsRect
SetDIBitsToDevice
SetPixelFormat
GdiGetPageHandle
PlayEnhMetaFileRecord
TranslateCharsetInfo
CreateCompatibleDC
SetWindowExtEx
PaintRgn
GetCurrentObject
SetMapperFlags
SetRectRgn
CreateRectRgn
BeginPath
GdiGetDC
SaveDC
SetPolyFillMode
GetEnhMetaFilePixelFormat
GetObjectA
GetPath
gdiPlaySpoolStream
GetRasterizerCaps
DrawEscape
GetDeviceCaps
CloseMetaFile
Pie
CreatePalette
SwapBuffers
GetEnhMetaFileW
GetStockObject
CreateScalableFontResourceW
GdiFlush
SetPixelV
CreateCompatibleBitmap
GetRelAbs
CreateMetaFileA
GdiStartDocEMF
CreateFontW
CombineRgn
ExtCreatePen
GetColorSpace
GetBrushOrgEx
EnumFontsA
GetKerningPairsW
SetMetaRgn
DeleteDC
PolyTextOutA
SetDIBits
GetCharABCWidthsFloatW
CreateColorSpaceA
SelectObject
EnumMetaFile

advapi32

RegOpenKeyW
QueryServiceStatus
GetSecurityDescriptorSacl
StartServiceCtrlDispatcherW
CryptDestroyKey
DuplicateTokenEx
LsaRemoveAccountRights
CryptSetProvParam
StartServiceCtrlDispatcherA
ChangeServiceConfigA
CopySid
CryptDuplicateKey
GetMultipleTrusteeOperationA
LsaSetInformationPolicy
LsaClose
QueryServiceObjectSecurity
GetTrusteeNameA
LsaQueryInfoTrustedDomain
AreAllAccessesGranted
ConvertAccessToSecurityDescriptorW
SetEntriesInAuditListA
GetEffectiveRightsFromAclW
CryptSetProviderExW
NotifyBootConfigStatus
CryptContextAddRef
SetFileSecurityW
ClearEventLogA
ConvertSecurityDescriptorToAccessNamedW
GetTrusteeFormW
ElfNumberOfRecords
SetSecurityDescriptorGroup
SystemFunction023
AccessCheckByTypeAndAuditAlarmA
LsaEnumeratePrivileges
LsaGetQuotasForAccount
SetThreadToken
LsaClearAuditLog
OpenThreadToken
DecryptFileW
RegSaveKeyW
AddAuditAccessObjectAce
SystemFunction025
GetSidSubAuthorityCount
LsaStorePrivateData
CryptVerifySignatureW
ElfOpenBackupEventLogW
RegEnumKeyExA
RegSetValueA
CryptVerifySignatureA
AbortSystemShutdownW
ObjectDeleteAuditAlarmA
BuildImpersonateExplicitAccessWithNameW
SystemFunction033
LsaLookupNames
SetSecurityDescriptorControl
LsaLookupPrivilegeDisplayName
GetSecurityDescriptorGroup
CryptGetDefaultProviderA
GetMultipleTrusteeA
LsaGetUserName
GetExplicitEntriesFromAclW
EnumServicesStatusA
BuildTrusteeWithSidA
GetTrusteeTypeW
ImpersonateLoggedOnUser
BackupEventLogA
AbortSystemShutdownA
LsaEnumeratePrivilegesOfAccount
QueryUsersOnEncryptedFile
CryptExportKey
ElfReadEventLogW
CryptSetProviderA
ElfBackupEventLogFileA
LsaLookupPrivilegeValue
SystemFunction031
CloseEventLog
ConvertSidToStringSidW
LsaICLookupNames
CreateServiceA

shell32

StrRChrIW
SHAppBarMessage
ord180
SHGetInstanceExplorer
StrRStrIW
CommandLineToArgvW
Shell_NotifyIconW
StrChrA

version

GetFileVersionInfoA

opengl32

glPixelStoref
glTexCoord4dv
glTexCoord2f
glGetTexParameterfv
GlmfCloseMetaFile
glEvalMesh2
glTexCoord1i
glCopyTexSubImage2D
glColor4ui
glEvalCoord2f
wglDeleteContext
glPointSize
glLineWidth
glNormal3iv
glNormal3i
glNormal3fv
glColor3fv
glCopyTexSubImage1D
glEvalMesh1
glIndexf
glEnableClientState
glVertex4iv
glGetPointerv
wglCreateContext
wglMakeCurrent
glColor3ubv
glColor4f
glTexCoord2fv
glColor4i

winmm

mmioOpenW
mmioRenameA
timeBeginPeriod
waveInReset
midiOutLongMsg
midiStreamPause
joyGetThreshold
mixerOpen
midiOutSetVolume
midiInReset
midiStreamClose
waveInStop
waveOutGetDevCapsA
waveInGetPosition
PlaySoundA
mciLoadCommandResource
midiInGetDevCapsW
timeGetTime
waveOutBreakLoop
midiInStart
mciGetCreatorTask

winspool.drv

GetPrinterDriverDirectoryW
SetFormA
DeletePrinterDriverA
ExtDeviceMode
PrinterProperties
DeletePrinterDriverExW
ord214
WaitForPrinterChange
EnumPrintersW
AdvancedDocumentPropertiesW
DeviceMode
ReadPrinter
DocumentEvent
GetPrinterDataExA
WritePrinter
StartPagePrinter
AdvancedSetupDialog
EnumJobsW
OpenPrinterW
DeletePrinterDataA
ScheduleJob
AddPrinterDriverA
AddJobA
ord205
AddPrintProvidorA
CreatePrinterIC
DocumentPropertiesA
DeletePrinterDataExW
ResetPrinterW
DeleteMonitorA
EnumPrintProcessorsW
AddPrintProcessorW
DocumentPropertiesW
GetSpoolFileHandle
EndDocPrinter
QueryColorProfile
SpoolerDevQueryPrintW
AddFormW
DeletePrinter
GetPrinterDriverA
DeletePrinterKeyW
DeletePrinterIC
EnumJobsA
DeleteMonitorW
PlayGdiScriptOnPrinterIC
DeletePortA
GetPrinterDataExW
GetPrinterDriverW
EnumMonitorsW
DeleteFormA
SetJobA
ord102
QueryRemoteFonts
GetFormA
SetPrinterDataExA
GetPrinterDataW
FindFirstPrinterChangeNotification
DeletePortW
EnumMonitorsA
ord203
ClosePrinter
EnumPrintProcessorDatatypesA
SetPrinterDataW
ord206
AbortPrinter
ord212
SpoolerPrinterEvent
EnumPrinterDataW
GetPrinterA
ord201
QuerySpoolMode
DevicePropertySheets
SetPortA
SetPrinterW
AddJobW
ord202
ord256
GetPrintProcessorDirectoryA
AddPortW
DeletePrintProcessorW
XcvDataW
SetPrinterDataA
StartDocDlgA
GetJobA
DeletePrintProvidorA
GetPrinterDataA
GetPrintProcessorDirectoryW
AddMonitorW
EnumPortsW
EnumPrinterDataA
ord213
AddPortExW
DeviceCapabilitiesA
AddPrinterConnectionA
DevQueryPrintEx
DeleteFormW
EnumPrinterKeyA
ord204
EnumFormsW
EnumPrinterDriversW
OpenPrinterA
FindNextPrinterChangeNotification
DeletePrinterConnectionA

msvcrt

_mbsinc
_mbsnbcat
_popen
fwrite
fgetwc
__crtLCMapStringA
vfwprintf
_adj_fdiv_m16i
__p__dstbias
fflush
__STRINGTOLD
_CIfmod
_local_unwind2
_ismbcl0
_pgmptr
_beginthread
_control87
fopen
fwprintf
is_wctype
_utime
_j1
mktime
_mbscoll
feof
qsort
__threadhandle
_wpopen
fputs
cos
_wsearchenv
ferror
strrchr
_adj_fdivr_m16i
printf
_mbsncat
_findfirst
_wspawnvp
localeconv
ftell
_unlink
_fullpath
__toascii
_getdrives
_memccpy
_CIasin
_Strftime
_mbsrev
_tempnam
_except_handler3
_wsetlocale
_XcptFilter
_lrotl
_ctype
_onexit
gmtime
fputc
strpbrk
getc
_outpd
_outp
_setjmp
_controlfp
_wcsset
_endthread
labs
fclose
__setlc_active
sprintf
fgetpos
wcscoll
_getch
wcspbrk
bsearch
fseek
_strnicoll
_wspawnvpe
raise
signal
__RTCastToVoid
fsetpos
fprintf
_mbslen
_mbctombb
_ecvt
_setmode
_wrmdir
_spawnlpe
memset
fread
ldiv
_HUGE
_winver
_finite

Sections

.text
Size: 600KB - Virtual size: 596KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

99d9e80d78a09a0d6dbeeb8313d14438

Headers

File Characteristics

Imports

kernel32

gdi32

advapi32

shell32

version

opengl32

winmm

winspool.drv

msvcrt

Sections

.text Size: 600KB - Virtual size: 596KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 12KB - Virtual size: 9KB

.text
Size: 600KB - Virtual size: 596KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 12KB - Virtual size: 9KB