89a90c4f6009ef0e16da6479f9d0461ccfc13ee0214de5a52f88bf11ea6d2e52

Sharing

Copy URL Twitter E-mail

General

Target

89a90c4f6009ef0e16da6479f9d0461ccfc13ee0214de5a52f88bf11ea6d2e52
Size

198KB
MD5

80aee4257c5a80183cbbff34ee350049
SHA1

2e9b24e23d1bf5d3e43218fcd6f0690b417e10b9
SHA256

89a90c4f6009ef0e16da6479f9d0461ccfc13ee0214de5a52f88bf11ea6d2e52
SHA512

68dd6e9bd114265e5ec1265922c4564823ed294e34b80e5e9ecd14d6e75e5b587304bb113adaf6863f611ea7f3c0284d52e7d699695564b3cb297cae3f0de9f7
SSDEEP

6144:r8tc4k5buKF9mMNKo1bn2dqXynJywWTBJPMrZhxSk8F:rt4k5LF80adB2Trv

Score

N/A

Malware Config

Signatures

Files

89a90c4f6009ef0e16da6479f9d0461ccfc13ee0214de5a52f88bf11ea6d2e52
.dll windows x86

c46897c8d5d6a2a7cf156e3b1408c30c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueA
OpenProcessToken
GetUserNameW
RegCreateKeyW
RegEnumKeyW
RegSetValueExA
RegCreateKeyExW
RegSetValueW
RegQueryValueExA
RegQueryValueExW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyA
RegDeleteKeyW
RegEnumKeyExA
RegCreateKeyA
RegQueryValueW
LookupPrivilegeValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueW
RegDeleteValueA
RegEnumValueA
RegEnumValueW
RegOpenKeyExW
RegNotifyChangeKeyValue
GetUserNameA
RegOpenKeyA
RegEnumKeyA
RegFlushKey
RegEnumKeyExW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW

ws2_32

WSAStartup
htonl
select
gethostbyname
gethostname
inet_ntoa
connect
ntohl
inet_addr
htons
getsockname
setsockopt
bind
socket
closesocket
listen
accept
ioctlsocket
recv
send
shutdown

gdi32

CreateDIBSection
SelectObject
BitBlt
PatBlt
DeleteDC
CreateCompatibleDC
GetDeviceCaps
GdiFlush
CreateDCA
DeleteObject

kernel32

FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
CreateMutexA
CloseHandle
PeekNamedPipe
WriteFile
Sleep
GetExitCodeProcess
CreateProcessA
TerminateProcess
ReadFile
GetEnvironmentVariableA
ExitThread
GetStartupInfoA
CreatePipe
ResumeThread
CreateThread
TerminateThread
CreateEventA
FindFirstFileA
FindClose
ResetEvent
FindNextFileA
lstrcmpA
lstrlenA
SetEvent
IsBadReadPtr
lstrcatA
lstrcpyA
CreateFileA
GetFileSize
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetSystemDirectoryA
CreateDirectoryA
GetLastError
SetLastError
lstrcmpiA
RemoveDirectoryA
CopyFileA
GetModuleFileNameA
WinExec
DeleteFileA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetCurrentProcess
Process32First
GetLogicalDrives
GetDriveTypeA
OpenProcess
Process32Next
CreateToolhelp32Snapshot
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
SetEnvironmentVariableA
WaitForSingleObject
MoveFileA
HeapFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThreadId
GetSystemTimeAsFileTime
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetFullPathNameA
GetCurrentDirectoryA
SetFilePointer
LCMapStringA
LCMapStringW
ExitProcess
RtlUnwind
GetConsoleCP
GetConsoleMode
RaiseException
GetModuleHandleA

user32

SetWindowsHookExA
DrawIconEx
GetIconInfo
GetCursorInfo
CallNextHookEx
MessageBoxA
UnhookWindowsHookEx

netapi32

NetApiBufferFree
NetUserGetInfo

wininet

InternetCheckConnectionA

iphlpapi

GetIpAddrTable

Exports

Exports

AdjustTokenPrivileges
GetUserNameA
GetUserNameW
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExW
RegCreateKeyW
RegDeleteKeyA
RegDeleteKeyW
RegDeleteValueA
RegDeleteValueW
RegEnumKeyA
RegEnumKeyExA
RegEnumKeyExW
RegEnumKeyW
RegEnumValueA
RegEnumValueW
RegFlushKey
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegQueryValueW
RegSetValueA
RegSetValueExA
RegSetValueExW
RegSetValueW
a
self_delete

Sections

.text
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SData
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c46897c8d5d6a2a7cf156e3b1408c30c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

gdi32

kernel32

user32

netapi32

wininet

iphlpapi

Exports

Exports

Sections

.text Size: 151KB - Virtual size: 150KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 5KB - Virtual size: 12KB

.SData Size: 512B - Virtual size: 4B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 151KB - Virtual size: 150KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 5KB - Virtual size: 12KB

.SData
Size: 512B - Virtual size: 4B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB