901a58c8dbfb7bc490111c7ac399d7376c1d60475ef95cd54119f98cea7af37f

Sharing

Copy URL

Twitter E-mail

General

Target

901a58c8dbfb7bc490111c7ac399d7376c1d60475ef95cd54119f98cea7af37f
Size

267KB
MD5

1241afab58e763e2ac4ddf1d6c98fc06
SHA1

e9aae6ce8a078ca4579447e7a8cbc695ed6d1639
SHA256

901a58c8dbfb7bc490111c7ac399d7376c1d60475ef95cd54119f98cea7af37f
SHA512

9f060da91537fa12d6d17dce3c716ffadfafe850d496ba62e5a9f5bc90b56d2f411ef1d4e3faae63f9b0526d85b738cda84026e081e110d497719f758b0b2738
SSDEEP

6144:6J0FvQ2TlgZBdDCxNfpWwi29GNfS3pQic2+kbsYv:hNvTkdGLfYwi29KbN2+0s

Score

N/A

Malware Config

Signatures

Files

901a58c8dbfb7bc490111c7ac399d7376c1d60475ef95cd54119f98cea7af37f
.exe windows x86

ed2615b03709dc0c7ed433d48a1e6a24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
TerminateThread
WaitForSingleObject
CreateThread
GetFileAttributesExA
ExpandEnvironmentStringsA
lstrlenA
lstrcatA
lstrcpyA
GetLastError
CreateMutexA
MoveFileA
RemoveDirectoryA
DeleteFileA
CreateDirectoryA
GetTempPathA
GetCommandLineA
GetModuleFileNameA
Sleep
GetLocalTime
GetTickCount
ReadFile
GetProcessHeap
SetEndOfFile
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
FlushFileBuffers
VirtualFree
HeapFree
WriteFile
HeapCreate
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

GetClassLongA
wsprintfA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyA

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathFileExistsA
PathIsDirectoryA
PathGetArgsA
PathFindFileNameA
PathRemoveBlanksA

gdi32

GetEnhMetaFilePixelFormat
GetCharWidth32A
CreateEllipticRgn
GetPaletteEntries
GetArcDirection
CloseEnhMetaFile
GetTextFaceA
GetClipRgn
CreateHatchBrush
SetICMProfileW
SetEnhMetaFileBits
AddFontResourceW
GetWinMetaFileBits
SetWindowExtEx
GetMapMode
GetICMProfileA
CreatePolyPolygonRgn
SetMetaRgn
GetLogColorSpaceA
GdiComment
GetCharWidthFloatA
SetBkColor
SwapBuffers
StretchDIBits
SelectPalette
EnumObjects
GetColorSpace
CloseMetaFile
GetEnhMetaFileBits
GetCharWidth32W
FillPath
GetBitmapBits
SetBitmapDimensionEx
Escape
SetTextAlign
AngleArc
CreateEnhMetaFileW
GdiGradientFill
PolyDraw
SetTextJustification
GetTextExtentPointA
FixBrushOrgEx
GetBrushOrgEx
SetMapMode
SetBkMode
GetNearestColor
GetCharABCWidthsI
SetDIBColorTable
CopyEnhMetaFileA
GetPixel
CreatePalette
CreatePen
WidenPath
GetObjectType
CreateMetaFileA
GetEnhMetaFilePaletteEntries
GetNearestPaletteIndex
CreateRoundRectRgn
AddFontResourceExA
CreateMetaFileW
AddFontMemResourceEx
PolyBezier
SelectClipPath
SelectClipRgn
PlayEnhMetaFile
GetColorAdjustment
GetCharWidthI
GetRasterizerCaps
SetBitmapBits
SelectObject
ColorMatchToTarget
GetViewportOrgEx
SetWinMetaFileBits
PolyPolyline
SetBoundsRect
GetBkColor
SetTextColor
ExtSelectClipRgn
GetTextExtentExPointW
GetObjectW
CreateDIBitmap
BitBlt
GetSystemPaletteUse
LineDDA
OffsetWindowOrgEx
GetCharacterPlacementW
CreateHalftonePalette
PolylineTo
SetWorldTransform
SetLayout
StrokeAndFillPath
EndPath
GetTextExtentPoint32W
GetPath
GetDeviceCaps
GetGlyphOutlineA
GetTextExtentPointI
CreateDCW
ResetDCA
OffsetViewportOrgEx
TextOutA
EnumFontFamiliesA
GetClipBox
GetCurrentPositionEx
GetKerningPairsA
GdiSetBatchLimit
StartPage
ExtFloodFill
SetTextCharacterExtra
FlattenPath
SetArcDirection
IntersectClipRect
GetTextMetricsW
SetRectRgn
CreateBitmap
GetEnhMetaFileDescriptionA
CreatePolygonRgn
CreateColorSpaceW
ExtTextOutW
GetEnhMetaFileW
GetGlyphIndicesW
GetOutlineTextMetricsA
AddFontResourceA
CreateICA
EnumFontsA
CreateCompatibleBitmap
CreateDCA
GetWorldTransform
PlgBlt
SetPixelFormat
GetGlyphIndicesA
ModifyWorldTransform
SetDCPenColor
GetTextExtentPointW
EnumFontsW
GetTextAlign
InvertRgn
UpdateColors
CreateColorSpaceA
ExtCreatePen
SetMiterLimit
GetWindowExtEx
SetDIBits
LineTo
TranslateCharsetInfo
ColorCorrectPalette
GetStretchBltMode
GetTextExtentExPointI
SetPolyFillMode
GetDCBrushColor
PlayEnhMetaFileRecord
EnumFontFamiliesExW
GetTextMetricsA
SetWindowOrgEx
CreateICW
GdiTransparentBlt
GetCharWidthW
PathToRegion
GetRandomRgn
GetCharABCWidthsFloatA
CancelDC
CreateFontIndirectExW
RemoveFontResourceExW
PtVisible
GetRegionData
EnumICMProfilesW
DescribePixelFormat
GetGlyphOutlineW
GdiAlphaBlend
CreateDiscardableBitmap
CreatePatternBrush
ArcTo
ExtTextOutA
GetBoundsRect
EnumFontFamiliesW
ExcludeClipRect
Polygon
SetPixel
GetPixelFormat
CreateScalableFontResourceA
GetBkMode
RemoveFontResourceA

ws2_32

gethostbyname
send
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
WSAStartup
recv

netapi32

Netbios

comsvcs

CoCreateActivity

crypt32

CertComparePublicKeyInfo
CertOpenSystemStoreA
CertVerifyTimeValidity
PFXImportCertStore
CertAddStoreToCollection
CryptMsgSignCTL
CryptUninstallDefaultContext
CertGetCertificateChain
CertRDNValueToStrA
CertEnumCertificateContextProperties
CertVerifyRevocation
CertVerifySubjectCertificateContext
CryptMsgEncodeAndSignCTL
CertFindCTLInStore
CertRegisterSystemStore
CertCreateContext
CertCreateCertificateChainEngine
CertEnumPhysicalStore
CryptMsgCalculateEncodedLength
CertAddCRLLinkToStore
CertControlStore
PFXExportCertStoreEx
CryptMsgVerifyCountersignatureEncoded
CertAddCTLContextToStore
CertFindChainInStore
CertFindCertificateInStore
CertGetCRLFromStore
CryptGetMessageSignerCount
CertCompareCertificate
CertNameToStrA
CertSetStoreProperty
CryptBinaryToStringA
CertAddCertificateContextToStore
CertSerializeCTLStoreElement
CryptEnumOIDInfo
CryptUnprotectData
CertFindCRLInStore
CryptEnumKeyIdentifierProperties
CryptMemFree
CertFreeCertificateChainEngine
CertVerifyValidityNesting
CryptBinaryToStringW
CryptExportPublicKeyInfoEx
CryptCloseAsyncHandle
CertGetValidUsages
CertOIDToAlgId
CryptCreateKeyIdentifierFromCSP
CertAddEnhancedKeyUsageIdentifier
CertGetPublicKeyLength
CryptCreateAsyncHandle
CertOpenSystemStoreW
CryptMsgDuplicate
CryptSignAndEncodeCertificate
CertFindRDNAttr
CertStrToNameA
CertSerializeCertificateStoreElement
PFXVerifyPassword
CertGetIntendedKeyUsage
CryptGetDefaultOIDFunctionAddress
CryptEnumOIDFunction
CertFreeCTLContext
CryptGetMessageCertificates
CertAddCRLContextToStore
CertDeleteCertificateFromStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCRLContext
CertVerifyCRLRevocation
CertFindSubjectInCTL
CryptFreeOIDFunctionAddress
CryptRegisterOIDInfo
CryptEncodeObjectEx
CryptStringToBinaryW
CryptFindOIDInfo
CertAddCertificateLinkToStore
CryptGetKeyIdentifierProperty
CertAddEncodedCertificateToStore
CertDeleteCTLFromStore
CryptDecryptMessage
CryptEncodeObject
CryptSignMessageWithKey
CryptHashToBeSigned
CertSetEnhancedKeyUsage
CryptMemAlloc
CertFindAttribute

imm32

ImmDisableTextFrameService
ImmSetCompositionWindow
ImmEnumInputContext
ImmGetDescriptionW
ImmGetCompositionFontA
ImmGetCandidateListCountW
ImmGetCompositionWindow
ImmSetOpenStatus
ImmGetOpenStatus
ImmNotifyIME
ImmIsUIMessageW
ImmGetCompositionStringW
ImmSetStatusWindowPos
ImmInstallIMEW
ImmConfigureIMEA
ImmGetIMEFileNameA
ImmAssociateContextEx
ImmGetGuideLineA
ImmDisableIME
ImmSetCandidateWindow
ImmGetVirtualKey
ImmGetCandidateListW
ImmGetGuideLineW
ImmGetDefaultIMEWnd
ImmIsIME
ImmUnregisterWordW
ImmIsUIMessageA
ImmSimulateHotKey
ImmRegisterWordW
ImmGetDescriptionA
ImmGetCompositionFontW
ImmEnumRegisterWordA
ImmGetCandidateListA
ImmGetConversionListW
ImmSetCompositionFontW
ImmGetProperty
ImmAssociateContext
ImmSetCompositionStringA
ImmConfigureIMEW
ImmSetConversionStatus

iphlpapi

DisableMediaSense
SetIfEntry
CancelIPChangeNotify
FlushIpNetTable
GetFriendlyIfIndex
SetIpNetEntry
EnableRouter
GetExtendedTcpTable
DeleteIPAddress
CreateIpNetEntry
GetUniDirectionalAdapterInfo
DeleteIpNetEntry
IpReleaseAddress
CreateProxyArpEntry
GetPerAdapterInfo
GetIfTable
GetBestInterface
AddIPAddress
GetUdpStatistics
IpRenewAddress
SetIpTTL
GetOwnerModuleFromTcpEntry
GetTcpTable
GetIpNetTable
GetTcpStatisticsEx
GetInterfaceInfo
GetNumberOfInterfaces
SetIpStatistics
GetIfEntry
GetOwnerModuleFromUdpEntry

msi

ord264
ord37
ord275
ord209
ord43
ord240
ord126
ord211
ord7
ord255
ord208
ord215
ord41
ord270
ord59
ord131
ord39
ord216
ord267
ord247
ord230
ord93
ord263
ord137
ord55
ord95
ord277
ord238
ord176
ord174
ord90

msvfw32

DrawDibRealize
MCIWndCreateA
DrawDibClose
ICGetDisplayFormat
DrawDibStart
ICGetInfo
ICImageCompress
ICDrawBegin
ICDecompress
DrawDibOpen
ICLocate
DrawDibStop
DrawDibEnd
ICCompressorChoose
DrawDibProfileDisplay
ICInfo
DrawDibDraw
ICInstall
ICSendMessage
ICSeqCompressFrameStart
ICCompressorFree
MCIWndCreateW
DrawDibTime
ICClose
DrawDibBegin
ICImageDecompress
ord2

mswsock

TransmitFile

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed2615b03709dc0c7ed433d48a1e6a24

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

gdi32

ws2_32

netapi32

comsvcs

crypt32

imm32

iphlpapi

msi

msvfw32

mswsock

Sections

.text Size: 172KB - Virtual size: 171KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 172KB - Virtual size: 171KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 18KB - Virtual size: 18KB