ac6999e1d43d2da8dd0e9e945875c4f8cbed9cba52469adc4473357a85920785

Sharing

Copy URL Twitter E-mail

General

Target

ac6999e1d43d2da8dd0e9e945875c4f8cbed9cba52469adc4473357a85920785
Size

47KB
MD5

53e3a82b01fb48059371d56e16d675fa
SHA1

19da6722db0e878d04a51c6bec9e35844bbb44cd
SHA256

ac6999e1d43d2da8dd0e9e945875c4f8cbed9cba52469adc4473357a85920785
SHA512

cebaca690ece223b9d1632ce79786afc7107a6c6d77f6d55269a35fba77900e2937b312e0b05cf92210754637d3828df85c4d84f98a18a04aa1e785e8842aa81
SSDEEP

768:tWTf75cDYsK7sG/DwKoNTbaV4ez6FCr+dkqU1aEoEYhSjkoPmb9qEZG3aAGL/poO:tIf75cVGbi8mezOCStUQEoEuSQBLk3a5

Score

N/A

Malware Config

Signatures

Files

ac6999e1d43d2da8dd0e9e945875c4f8cbed9cba52469adc4473357a85920785
.dll windows x86

c795ec9ffe40f72f071fa12aa9ef6bb4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
CreateToolhelp32Snapshot
GetProcessHeap
HeapAlloc
Process32Next
lstrcmpiA
Process32First
WriteFile
WideCharToMultiByte
MultiByteToWideChar
lstrcatA
GetTickCount
FindClose
FindFirstFileA
VirtualFreeEx
WaitForSingleObject
VirtualProtect
WriteProcessMemory
VirtualAllocEx
lstrlenA
OpenProcess
GetTempPathA
GetWindowsDirectoryA
ReleaseMutex
GetLastError
CreateMutexA
FreeLibrary
GetSystemDirectoryA
GetFileAttributesA
MoveFileExA
DeleteFileA
lstrcpynA
ReadProcessMemory
SetThreadPriority
VirtualProtectEx
CopyFileA
DeviceIoControl
TerminateThread
GlobalAlloc
GlobalFree
SetEndOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
CreateFileA
ReadFile
SetFilePointer
CloseHandle
GetFileSize
GetCurrentProcess
TerminateProcess
LoadLibraryA
GetProcAddress
GetModuleFileNameA
Sleep
CreateRemoteThread
CreateThread

user32

GetForegroundWindow
GetWindow
PostMessageA
wsprintfA
ToAscii
GetKeyboardState
FindWindowA
GetClassNameW

gdi32

CreateDCA
GetDeviceCaps
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

SetSecurityDescriptorDacl
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
InitializeSecurityDescriptor

msvcrt

_onexit
__dllonexit
exit
_strcmpi
_strupr
_strdup
wcsstr
memset
??2@YAPAXI@Z
strcpy
strcat
strlen
strncpy
rand
srand
time
strstr
atoi
memcpy
strrchr
free
_stricmp
malloc
??3@YAXPAX@Z
_except_handler3
_strlwr
wcscat
wcscpy
wcslen
sprintf
isspace
strchr
_vsnprintf
realloc
isdigit
isalpha
wcscmp
mbstowcs
wcsncat

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

wsock32

WSAStartup
socket
htons
connect
recv
gethostbyname
send
shutdown
closesocket

psapi

GetModuleFileNameExA
EnumProcessModules

gdiplus

GdiplusStartup
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDisposeImage
GdipCreateBitmapFromHBITMAP

Exports

Exports

pfjaoidjglkajd

Sections

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c795ec9ffe40f72f071fa12aa9ef6bb4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

msvcp60

wsock32

psapi

gdiplus

Exports

Exports

Sections

.bss Size: - Virtual size: 2KB

.data Size: 42KB - Virtual size: 41KB

.CRT Size: 512B - Virtual size: 8B

.reloc Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 2KB

.data
Size: 42KB - Virtual size: 41KB

.CRT
Size: 512B - Virtual size: 8B

.reloc
Size: 3KB - Virtual size: 2KB