6c31adaef9a3a5fd31f5ec09e89cc46491c591d5a9c1557b79d86436b5ed4515

Sharing

Copy URL Twitter E-mail

General

Target

6c31adaef9a3a5fd31f5ec09e89cc46491c591d5a9c1557b79d86436b5ed4515
Size

678KB
MD5

2455cd13b304ed89e13a284a044f7480
SHA1

db098ee4bae7ad00949a7872fa2e97085f88501f
SHA256

6c31adaef9a3a5fd31f5ec09e89cc46491c591d5a9c1557b79d86436b5ed4515
SHA512

12e22764ee701dc61c89606cd2efc6821d8dc9a6ddeb97c54a25dbc6d0dbf6c53b841faca56c043886b9ccea8e35e2d155b7a1c56bc782258acee56e9ed4c820
SSDEEP

12288:dbmx78CF4UP1y9wc4BVz3Qfogt6ym9Kt88+8fZDVvK:dbmJRPA98z3Qfog4yuKq8fZDVvK

Score

N/A

Malware Config

Signatures

Files

6c31adaef9a3a5fd31f5ec09e89cc46491c591d5a9c1557b79d86436b5ed4515
.exe windows x86

4e1c0afb63e6b2ddd99f11988659e9be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTokenInformation
OpenThreadToken
OpenProcessToken
AdjustTokenPrivileges

kernel32

GetModuleHandleW
LCMapStringW
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
InitializeCriticalSection
CompareStringW
FormatMessageW
CloseHandle
GetCurrentThread
GetCurrentProcess
RegisterApplicationRestart
HeapSetInformation
LocalFree
GetLastError
CreateEventW
SetEvent
SwitchToThread
GetCurrentProcessId
GetStringTypeExW
lstrlenW
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
GetVersionExW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
HeapReAlloc

user32

EndDialog
GetWindowLongW
UpdateWindow
InvalidateRect
GetWindowTextLengthW
SetWindowLongW
DestroyWindow
FindWindowExW
IsDialogMessageW
IsWindow
PeekMessageW
GetWindowThreadProcessId
EnumWindows
GetDlgCtrlID
MessageBoxW
IsDlgButtonChecked
GetDlgItem
SetDlgItemTextW
ShowWindow
CreateDialogParamW
SetFocus
DialogBoxParamW
GetFocus
SetWindowTextW
EnableWindow
SendMessageW
GetWindowTextW
CheckRadioButton
LoadStringW
SendDlgItemMessageW
MoveWindow
GetWindowRect
GetClientRect
GetDesktopWindow
PostMessageW
GetDlgItemTextW
PostQuitMessage
SetCursor
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
MsgWaitForMultipleObjects

msvcrt

__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_controlfp
atol
sscanf
_vsnprintf
memcpy
_CxxThrowException
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_wtoi
_finite
iswspace
_wtol
wcscspn
wcschr
setlocale
mbstowcs
strstr
wcsstr
qsort
_vsnwprintf
swscanf_s
memset
__CxxFrameHandler3
__p__fmode
??1type_info@@UAE@XZ

wbemcomn

??4CVar@@QAEAAV0@ABV0@@Z
?Add@CVarVector@@QAEHAAVCVar@@@Z
?Empty@CVar@@QAEXXZ
?SetVarVector@CVar@@QAEXPAVCVarVector@@H@Z
??0CVarVector@@QAE@HHH@Z
?SetBSTR@CVar@@QAEHPAG@Z
??1CVarVector@@QAE@XZ
??4CVarVector@@QAEAAV0@AAV0@@Z
??YWString@@QAEAAV0@ABV0@@Z
?RemoveAt@CVarVector@@QAEHH@Z
?Size@CVarVector@@QAEHXZ
?FillCVarAt@CVarVector@@QAEXHAAVCVar@@@Z
?GetOleType@CVar@@QAEHXZ
?SetUnknown@CVar@@QAEXPAUIUnknown@@@Z
?SetAt@CFlexArray@@QAEXHPAX@Z
?UnbindPtr@WString@@QAEPAGXZ
??ACFlexArray@@QAEAAPAXH@Z
?RemoveAt@CFlexArray@@QAEHH@Z
?FillVariant@CVar@@QAEXPAUtagVARIANT@@H@Z
??1CVar@@QAE@XZ
??YWString@@QAEAAV0@PBG@Z
??YWString@@QAEAAV0@G@Z
??0CFlexArray@@QAE@HH@Z
??1CFlexArray@@QAE@XZ
?InsertAt@CFlexArray@@QAEHHPAX@Z
?GetNewVariant@CVar@@QAEPAUtagVARIANT@@XZ
??0WString@@QAE@PAGH@Z
??4WString@@QAEAAV0@PBG@Z
?GetAt@CFlexArray@@QBEPAXH@Z
??0WString@@QAE@XZ
?DeleteString@WString@@AAEXPAG@Z
?SetVariant@CVar@@QAEHPAUtagVARIANT@@H@Z
?Init@CVar@@AAEXXZ
?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z
?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z
??0CVarVector@@QAE@XZ

oleaut32

SysAllocStringLen
SysStringLen
GetErrorInfo
SysAllocString
VariantInit
SysFreeString
VariantClear

ole32

CoTaskMemAlloc
CoTaskMemFree
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4e1c0afb63e6b2ddd99f11988659e9be

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

wbemcomn

oleaut32

ole32

Sections

.text Size: 98KB - Virtual size: 98KB

.data Size: 1024B - Virtual size: 19KB

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 6KB - Virtual size: 5KB

.vmp0 Size: 508KB - Virtual size: 1.6MB

.text
Size: 98KB - Virtual size: 98KB

.data
Size: 1024B - Virtual size: 19KB

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 6KB - Virtual size: 5KB

.vmp0
Size: 508KB - Virtual size: 1.6MB