9471bea87908a33c37ecfe94bb2d8db3eaf8b2039569841587b869a680e09c94

Sharing

Copy URL

Twitter E-mail

General

Target

9471bea87908a33c37ecfe94bb2d8db3eaf8b2039569841587b869a680e09c94
Size

251KB
MD5

6582ae3159099c61badcb7b6144555e7
SHA1

1cfa9654fe2c10befd48767a3ecd21cc9a21395b
SHA256

9471bea87908a33c37ecfe94bb2d8db3eaf8b2039569841587b869a680e09c94
SHA512

60662575f223d47a4269b07025a1f3cb30a2d191648dc948761a324e7df074b0cc9179a3e1942d66def3b064a00b0143780385a3fdd0579d84a22c170efc16c1
SSDEEP

3072:QHqdpufk3TP3KUVa158yjFtIgTpvq5Me743MLddCC2EexatWdCvCxR9i7byQA8GD:qf4PJV+58qDJTpsMc4OdsCiIv2nQzQ+

Score

N/A

Malware Config

Signatures

Files

9471bea87908a33c37ecfe94bb2d8db3eaf8b2039569841587b869a680e09c94
.exe windows x86

29e4a558a1311f68ece6f1f1cfcbfc39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
GetTempPathA
ReadFile
GetProcessHeap
SetEndOfFile
CreateDirectoryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
FlushFileBuffers
DeleteFileA
RemoveDirectoryA
VirtualFree
HeapFree
HeapCreate
HeapDestroy
MoveFileA
CreateMutexA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
GetFileAttributesExA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
LoadLibraryA
WriteFile
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

GetClassLongA
wsprintfA

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegSetValueExA

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathFileExistsA
PathIsDirectoryA
PathRemoveBlanksA
PathGetArgsA
PathFindFileNameA

ws2_32

recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send

netapi32

Netbios

comdlg32

CommDlgExtendedError

comsvcs

CoCreateActivity
CoLeaveServiceDomain
CoEnterServiceDomain

iphlpapi

GetOwnerModuleFromUdpEntry
GetIpStatisticsEx
GetUdpStatistics
CreateIpNetEntry
DeleteProxyArpEntry
SendARP
GetIfEntry
GetIcmpStatistics
AddIPAddress
UnenableRouter
GetInterfaceInfo
GetIpNetTable
GetOwnerModuleFromTcpEntry

msi

ord104
ord232
ord195
ord82
ord44
ord168
ord93
ord137
ord154
ord202
ord205
ord260
ord88
ord180
ord213
ord219
ord228
ord38
ord241
ord95
ord169
ord277
ord85
ord107
ord37
ord59
ord226
ord190
ord257
ord254
ord174
ord212
ord131
ord262
ord43
ord270
ord250
ord16
ord69
ord84
ord68
ord87
ord56
ord259
ord266
ord225
ord255
ord223
ord90
ord108
ord156
ord239
ord113
ord210
ord6
ord215
ord208
ord265
ord40

msimg32

GradientFill

msvfw32

ICOpenFunction
ICCompressorFree
ICSeqCompressFrameStart
MCIWndCreateA

mswsock

TransmitFile
GetAcceptExSockaddrs

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29e4a558a1311f68ece6f1f1cfcbfc39

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

ws2_32

netapi32

comdlg32

comsvcs

iphlpapi

msi

msimg32

msvfw32

mswsock

Sections

.text Size: 167KB - Virtual size: 166KB

.rdata Size: 61KB - Virtual size: 61KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 61KB - Virtual size: 61KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 17KB - Virtual size: 16KB