ba72ad6fba10a91c6ef559fd191b853058fbfb8c806c129cca736334649dac79

Sharing

Copy URL

Twitter E-mail

General

Target

ba72ad6fba10a91c6ef559fd191b853058fbfb8c806c129cca736334649dac79
Size

259KB
MD5

faeb61179f0e78fd0cb6641217679dbd
SHA1

c811432a633ea6aa2beb900cac5471c5bee5d4d8
SHA256

ba72ad6fba10a91c6ef559fd191b853058fbfb8c806c129cca736334649dac79
SHA512

cf933dd39d199e61b385f6c77adbd86500d80d081176482150c76ddfe4dbb97cb4582fa3fd80a5d88804479a24f11773738e386c98ebeb70760283f0dd4000a1
SSDEEP

6144:THDPQ5WAnW22AGpKyGeckja+XmImt6aC0UDr:TjNAnrDGSecktmIm8aC/

Score

N/A

Malware Config

Signatures

Files

ba72ad6fba10a91c6ef559fd191b853058fbfb8c806c129cca736334649dac79
.exe windows x86

a696be513d022705196a31b44d0fd145

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
VirtualFree
FlushFileBuffers
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
SetEndOfFile
GetProcessHeap
ReadFile
GetTickCount
GetLocalTime
Sleep
GetModuleFileNameA
GetCommandLineA
GetTempPathA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
MoveFileA
CreateMutexA
GetLastError
lstrcpyA
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
GetFileAttributesExA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
HeapCreate
WriteFile
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement

user32

wsprintfA
GetClassLongA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyA

ole32

CoInitialize

shell32

ShellExecuteA

shlwapi

PathFileExistsA
PathFindFileNameA
PathIsDirectoryA
PathGetArgsA
PathRemoveBlanksA

ws2_32

recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send

netapi32

Netbios

comsvcs

RecycleSurrogate
CoEnterServiceDomain

crypt32

PFXExportCertStore
CryptVerifyCertificateSignature
CertRegisterPhysicalStore
CertCreateCertificateContext
CertStrToNameW
CertEnumSystemStore
CryptBinaryToStringA
CertSetCRLContextProperty
CryptGetOIDFunctionValue
CryptSetOIDFunctionValue
CryptDecodeMessage
CryptGetDefaultOIDDllList
PFXIsPFXBlob
CryptVerifyDetachedMessageSignature
CertFreeCertificateContext
CertEnumCRLContextProperties
CertOIDToAlgId
CertEnumCertificateContextProperties
PFXImportCertStore
CertAddCTLContextToStore
CryptSignMessageWithKey
CryptInitOIDFunctionSet
CryptSignAndEncodeCertificate
CryptGetOIDFunctionAddress
CertGetEnhancedKeyUsage
CertCreateContext
CryptGetMessageSignerCount
CryptMsgCalculateEncodedLength
CryptMemAlloc
CryptVerifyCertificateSignatureEx
CertCloseStore
CryptRegisterDefaultOIDFunction
CryptRegisterOIDInfo
CertRDNValueToStrW
CryptGetAsyncParam
CertVerifyRevocation
CryptMemFree
CryptMsgUpdate
CertVerifyCertificateChainPolicy
CertStrToNameA
CertFreeCertificateChain
CertSerializeCertificateStoreElement
CryptMsgGetParam
CryptMsgSignCTL
CryptEncodeObjectEx
CryptDecryptAndVerifyMessageSignature
CryptSetAsyncParam
CertNameToStrA
CertDuplicateCertificateContext
CertComparePublicKeyInfo
CryptInstallDefaultContext
CertCreateCTLEntryFromCertificateContextProperties
CertSerializeCRLStoreElement
CertEnumCRLsInStore
CryptEnumOIDFunction
CryptFindCertificateKeyProvInfo
CryptHashPublicKeyInfo
CertFreeCRLContext
CertAddEncodedCertificateToSystemStoreW
CertRemoveEnhancedKeyUsageIdentifier
CryptUnregisterOIDFunction
CertFindSubjectInSortedCTL
CryptFindOIDInfo
CertAddCRLLinkToStore
CertAddCRLContextToStore
CertSetEnhancedKeyUsage
CertGetIntendedKeyUsage
PFXVerifyPassword
CertGetStoreProperty
CertFindExtension
CryptCreateKeyIdentifierFromCSP
CertFindCertificateInStore
CryptFormatObject
CertVerifyValidityNesting
CryptVerifyDetachedMessageHash
PFXExportCertStoreEx
CertRegisterSystemStore
CertCreateCertificateChainEngine
CertCreateCRLContext
CryptGetMessageCertificates

imm32

ImmGetRegisterWordStyleA
ImmSetCompositionFontA
ImmGetCompositionFontW
ImmSetCandidateWindow
ImmSetCompositionFontW
ImmGetDefaultIMEWnd
ImmGetCompositionWindow
ImmGetCompositionStringW
ImmGetCompositionStringA
ImmEnumInputContext
ImmIsUIMessageW
ImmUnregisterWordW
ImmEnumRegisterWordA
ImmEscapeW
ImmGetImeMenuItemsA
ImmGetConversionStatus
ImmSimulateHotKey
ImmGetVirtualKey
ImmGetCandidateWindow
ImmInstallIMEW
ImmAssociateContextEx
ImmGetCandidateListA
ImmIsUIMessageA
ImmGetRegisterWordStyleW
ImmSetConversionStatus
ImmDisableTextFrameService
ImmGetOpenStatus
ImmEnumRegisterWordW
ImmDisableIME
ImmGetGuideLineA
ImmGetProperty
ImmSetCompositionWindow
ImmGetCompositionFontA
ImmSetCompositionStringA
ImmIsIME
ImmAssociateContext
ImmGetIMEFileNameW
ImmGetStatusWindowPos

iphlpapi

GetExtendedUdpTable
SetIfEntry
GetIpStatisticsEx
GetIfTable
GetUdpStatisticsEx
GetIcmpStatistics
GetPerAdapterInfo
GetIcmpStatisticsEx
GetTcpStatisticsEx
SetTcpEntry
GetTcpStatistics
DeleteIpNetEntry
GetIpAddrTable
EnableRouter
SetIpTTL
RestoreMediaSense
IpRenewAddress
GetInterfaceInfo
DisableMediaSense
CreateIpForwardEntry
GetUdpStatistics
NotifyAddrChange
GetIpErrorString

msi

ord181
ord247
ord213
ord113
ord112
ord268
ord96
ord211
ord276
ord10
ord93
ord265
ord223
ord237
ord275
ord224
ord40
ord255
ord195
ord243
ord225
ord246
ord154
ord45
ord172
ord16
ord8
ord239
ord87
ord229
ord259
ord230
ord242
ord210
ord56
ord168
ord266
ord110
ord84
ord59
ord175
ord273
ord257
ord157
ord258
ord253
ord55
ord95
ord269
ord215
ord216
ord60
ord82
ord178
ord179
ord231
ord263
ord205
ord131
ord240
ord108
ord277
ord173
ord104
ord214
ord180
ord81
ord88
ord177
ord42
ord192
ord90
ord250
ord39
ord11
ord6
ord89
ord208
ord244
ord251
ord252
ord85
ord260
ord109
ord44
ord270
ord272
ord126

msimg32

GradientFill
AlphaBlend

msvfw32

DrawDibClose
DrawDibTime
ICInfo
ICInstall
ICImageCompress
DrawDibProfileDisplay
ord2
ICOpenFunction
MCIWndCreateA
DrawDibDraw
ICImageDecompress
ICRemove
ICCompressorChoose
ICClose
DrawDibBegin
DrawDibChangePalette
MCIWndCreateW
ICSeqCompressFrameEnd
ICLocate

mswsock

AcceptEx
GetAcceptExSockaddrs
WSARecvEx

Sections

.text
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a696be513d022705196a31b44d0fd145

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

shlwapi

ws2_32

netapi32

comsvcs

crypt32

imm32

iphlpapi

msi

msimg32

msvfw32

mswsock

Sections

.text Size: 170KB - Virtual size: 169KB

.rdata Size: 66KB - Virtual size: 66KB

.data Size: 4KB - Virtual size: 21KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 170KB - Virtual size: 169KB

.rdata
Size: 66KB - Virtual size: 66KB

.data
Size: 4KB - Virtual size: 21KB

.reloc
Size: 17KB - Virtual size: 17KB