57128804aceb5ee6b770428320b777e2243c13193fd655bf43c959cc34554114

Sharing

Copy URL

Twitter E-mail

General

Target

57128804aceb5ee6b770428320b777e2243c13193fd655bf43c959cc34554114
Size

280KB
MD5

06e672fb2ff510d2e1a2800de4a2c8f0
SHA1

cd91e478eaedaaa4292a6e31a3d3fc3435c20ce2
SHA256

57128804aceb5ee6b770428320b777e2243c13193fd655bf43c959cc34554114
SHA512

cae523e7b17e78e11371540d3fa2266e94091b6eb8c3de26bfc3e66b3e7380536b2d7abf033edcaadb9bbb94fb5279a09665cb0aa3ab2edb9bfedcbb02630c7a
SSDEEP

6144:soMEHOa2n1au9g3UKSSeCMm8UDjFYnAWBTTsMKV7Y9VyEf9u26i:3b2n1pekKDvjFYndDKdEfQ2

Score

N/A

Malware Config

Signatures

Files

57128804aceb5ee6b770428320b777e2243c13193fd655bf43c959cc34554114
.dll windows x86

7db15e15f603e26ffb84fcc4e6124f0c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateRemoteThread
WaitForSingleObject
Module32First
GetVersion
GetStdHandle
LocalAlloc
FreeConsole
OutputDebugStringA
WriteProcessMemory
MultiByteToWideChar
SetLastError
GetCurrentThreadId
FileTimeToLocalFileTime
GetWindowsDirectoryA
GetSystemDefaultLangID
GetSystemInfo
GetCurrentProcess
VirtualAllocEx
lstrcmpiA
ReadProcessMemory
GetEnvironmentVariableW
VirtualQueryEx
GlobalReAlloc
GlobalSize
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateDirectoryA
RemoveDirectoryA
MoveFileA
WideCharToMultiByte
GetExitCodeThread
GetLocalTime
SystemTimeToFileTime
GetFileAttributesA
SetFileAttributesA
SetConsoleTextAttribute
GlobalAlloc
CopyFileA
DeleteFileA
FindClose
SetCurrentDirectoryA
FindFirstFileA
FileTimeToSystemTime
FindNextFileA
CreateFileMappingA
MapViewOfFile
GetFileSize
UnmapViewOfFile
GetCurrentDirectoryA
CreateFileA
WinExec
FormatMessageA
GetProcessHeap
HeapAlloc
HeapFree
GetVersionExA
GetProcAddress
FreeLibrary
GetComputerNameA
LoadLibraryA
GetTickCount
GetStartupInfoA
GetSystemDirectoryA
WriteFile
ReadFile
Sleep
GetLastError
ExitThread
CreateThread
TerminateThread
WaitForMultipleObjects
TerminateProcess
CreatePipe
Module32Next
OpenProcess
GlobalUnlock
GlobalFree
GlobalLock
GlobalMemoryStatus
GetModuleFileNameA
GetCurrentProcessId
GetDriveTypeA
GetModuleHandleA
GetLogicalDrives
Process32First
GetDiskFreeSpaceA
CreateToolhelp32Snapshot
SetFileTime
Process32Next
MoveFileExA
GetVolumeInformationA
CreateProcessA
GetStringTypeA
LCMapStringA
GetExitCodeProcess
IsBadReadPtr
HeapDestroy
GetEnvironmentVariableA
ExitProcess
GetCommandLineA
GetSystemTime
CloseHandle
GetTimeZoneInformation
InterlockedIncrement
InterlockedDecrement
RtlUnwind
LocalFree
LCMapStringW
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
DeleteCriticalSection
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
FlushFileBuffers
SetUnhandledExceptionFilter
SetHandleCount
GetFileType
GetCPInfo
GetACP
GetOEMCP
SetEnvironmentVariableA
HeapSize
SetFilePointer
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeW
SetStdHandle
RaiseException
IsBadCodePtr
SetEndOfFile
CompareStringA
CompareStringW

user32

GetDesktopWindow
ClipCursor
GetClipCursor
MessageBoxA
RedrawWindow
SetWindowTextA
DrawTextA
GetCursorPos
OpenClipboard
EnableWindow
IsClipboardFormatAvailable
SetClipboardData
GetAsyncKeyState
GetKeyState
GetWindowTextA
GetWindowTextLengthA
GetForegroundWindow
EmptyClipboard
CloseClipboard
GetClipboardData
GetSystemMetrics
SendMessageA
PostThreadMessageA
CloseDesktop
ExitWindowsEx
DestroyIcon
CloseWindowStation
SystemParametersInfoA
PostMessageA
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
GetUserObjectInformationA
OpenInputDesktop
ReleaseDC
GetDC
keybd_event
mouse_event
GetMessageA

gdi32

CreateDIBSection
CreateCompatibleDC
CreateFontIndirectA
SelectObject
BitBlt
CreateCompatibleBitmap
GetStockObject
SelectPalette
GetObjectA
GetDIBits
DeleteObject
RealizePalette
GetDeviceCaps
SetTextColor
CreateDCA
DeleteDC
SetBkMode

advapi32

RegDeleteValueA
SetServiceStatus
RegCloseKey
RegSetValueExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
CreateServiceA
StartServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
ControlService
QueryServiceStatus
ChangeServiceConfigA
QueryServiceConfigA
RegisterServiceCtrlHandlerA
RegCreateKeyA
GetUserNameA
DeleteService
EnumServicesStatusExA
QueryServiceConfig2A
QueryServiceStatusEx
RegQueryInfoKeyA
RegOpenKeyA
RegEnumKeyA

shell32

SHGetFileInfoA
ShellExecuteA

ole32

CoTaskMemFree
CoInitialize
CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString
VariantClear

iphlpapi

GetAdaptersInfo
SetTcpEntry
GetTcpTable

psapi

GetModuleFileNameExA
EnumProcessModules

ws2_32

inet_addr
htonl
bind
listen
accept
__WSAFDIsSet
htons
setsockopt
WSAStartup
socket
WSAGetLastError
ntohs
connect
select
WSACleanup
gethostbyname
inet_ntoa
recv
send
closesocket

winmm

waveInStart
waveInReset
waveInOpen
waveInClose
waveInUnprepareHeader
waveInAddBuffer
waveOutGetNumDevs
midiOutGetNumDevs
waveOutGetDevCapsA
midiOutGetDevCapsA
PlaySoundA
mciSendStringA
waveInPrepareHeader

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetCloseHandle

netapi32

NetApiBufferFree
NetUserDel
NetUserAdd
NetUserEnum

avicap32

capGetDriverDescriptionA

msvfw32

ICOpen
ICSendMessage
ICClose
ICImageCompress
ICCompress

Exports

Exports

AddUser
DelUser
GetSysInfo
GetUser
InstallPE
InstallRT
InstallSA
InstallSB
InstallServiceA
InstallServiceB
MyConfigService
MyDeleteService
MyInstallService
MyListService
MyStartService
MyStopService
MyViewService
PEmain
PSLIST
ServiceMain
UninstallPE
UninstallRT
UninstallSA
UninstallSB
UninstallServiceA
UninstallServiceB
clonemain
nt2Kfindpass
win2003findpass

Sections

.text
Size: 180KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7db15e15f603e26ffb84fcc4e6124f0c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

psapi

ws2_32

winmm

wininet

netapi32

avicap32

msvfw32

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 176KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 64KB - Virtual size: 547KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 180KB - Virtual size: 176KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 64KB - Virtual size: 547KB

.reloc
Size: 16KB - Virtual size: 15KB