8ec4bd5b2b68133fe5467f74ce6938792fcd368bd9a4c814a3024551ad504ba7

Sharing

Copy URL Twitter E-mail

General

Target

8ec4bd5b2b68133fe5467f74ce6938792fcd368bd9a4c814a3024551ad504ba7
Size

511KB
MD5

ff5c07f43e44a6f2030f7b7ddd5c3620
SHA1

7bc5409612d58cd6a8898da51220a54eca90e1e5
SHA256

8ec4bd5b2b68133fe5467f74ce6938792fcd368bd9a4c814a3024551ad504ba7
SHA512

d8a99c4271032cb2b5f609ac2a5f1118db628940a5bb998517dd5d735e91b64866a6a89df95677a994bccf2116865a3ba6f5af93c73e5a4cb3d2c5b8c306027f
SSDEEP

6144:mgVkBsD7S0i7bXQ9IlhiTIV/zQnTs/inxE2dCRxNkG9iQJ6W:r2B67l+bg9BIZQnpxE2dCmIie

Score

N/A

Malware Config

Signatures

Files

8ec4bd5b2b68133fe5467f74ce6938792fcd368bd9a4c814a3024551ad504ba7
.dll windows x86

f8003f8c9eb64649a7e39420b6538fac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_ltoa
_itoa
isdigit
_stricmp
_chmod
_snprintf
isspace
qsort
atoi
strrchr
atol
sprintf
strstr
_mbspbrk
calloc
free
malloc
bsearch
strtoul
_ultoa
_fullpath
tolower
strncmp
fclose
fprintf
fopen
strncpy
strtok
rename
_strnicmp
time
_filelength
_spawnv
_except_handler3
_adjust_fdiv
_initterm
strspn
_strcmpi
strchr
_mbscspn
_mbstrlen
strpbrk
memmove
toupper
strcspn
_chdrive
_chdir
_getdrive
_fstat

ntdll

RtlAdjustPrivilege
RtlInitializeBitMap
RtlFindClearBits
RtlSetBits
RtlClearBits
RtlFreeUnicodeString
NtCreateEvent
NtOpenEvent
RtlAnsiStringToUnicodeString
RtlInitAnsiString
NtClose
NtWaitForMultipleObjects
NtSetEvent
DbgPrint
DbgPrompt
DbgUserBreakPoint
NtOpenFile
RtlDosPathNameToNtPathName_U
NtDeviceIoControlFile
RtlExtendedLargeIntegerDivide
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
NtQuerySystemEnvironmentValue
NtSetSystemEnvironmentValue
RtlEqualUnicodeString
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlPrefixUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
NtQueryDirectoryObject
RtlCopyUnicodeString
NtOpenDirectoryObject
NtAdjustPrivilegesToken
NtOpenProcessToken
NtSetDefaultLocale

kernel32

GetCurrentProcess
GetEnvironmentVariableA
OpenProcess
GetCurrentProcessId
GetVersion
ExpandEnvironmentStringsA
CopyFileA
GetComputerNameA
SetComputerNameA
WriteProfileStringW
GetLocaleInfoW
VirtualProtect
GlobalMemoryStatus
GetSystemInfo
GetSystemTime
GetACP
GetOEMCP
FlushFileBuffers
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
Sleep
MoveFileExA
lstrcpynA
FindNextFileA
CreateFileA
_lwrite
_lcreat
SetFileAttributesA
_lclose
_lread
_llseek
_lopen
lstrcmpiA
GetTickCount
InterlockedIncrement
GetModuleFileNameA
GetSystemDirectoryA
lstrlenA
GetCommandLineA
ExitProcess
lstrcpyA
OpenFile
HeapDestroy
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
IsDBCSLeadByte
OutputDebugStringA
lstrcatA
lstrcmpA
GetLastError
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetFileAttributesA
FindClose
FindFirstFileA
CreateDirectoryA
QueryDosDeviceA
GetDriveTypeA
MoveFileA
WinExec
GetVolumeInformationA
GetPrivateProfileStringA
GetWindowsDirectoryA
FileTimeToDosDateTime
GetFileTime
DeleteFileA
SetFileTime
CompareFileTime
SetErrorMode
RemoveDirectoryA
WritePrivateProfileStringA
WriteProfileStringA
VirtualAlloc
GetDiskFreeSpaceA
FreeLibrary
LoadLibraryA
GetProcAddress
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetCurrentThreadId
GetFullPathNameA

user32

ReleaseCapture
GetCapture
CharLowerBuffA
SetCapture
CharLowerA
LoadKeyboardLayoutA
SendMessageTimeoutA
PtInRect
FillRect
CharUpperBuffA
MoveWindow
GetWindowThreadProcessId
EnableWindow
GetMenuState
SetWindowsHookExA
UnhookWindowsHookEx
CreateWindowExA
IsWindowEnabled
ExitWindowsEx
DestroyWindow
SetActiveWindow
CallNextHookEx
KillTimer
FlashWindow
SetTimer
GetClientRect
UpdateWindow
InvalidateRect
ReleaseDC
GetDC
DispatchMessageA
TranslateMessage
IsDialogMessageA
GetMessageA
LoadCursorA
GetSystemMetrics
SendMessageA
DefWindowProcA
SetWindowPos
SetCursor
PostQuitMessage
EndPaint
LoadStringA
LoadBitmapA
BeginPaint
MessageBeep
wsprintfA
IsWindow
PostMessageA
SetDlgItemTextA
EndDialog
MessageBoxA
DialogBoxParamA
ShowOwnedPopups
SetForegroundWindow
GetLastActivePopup
wvsprintfA
CharUpperA
CharNextA
SetFocus
GetFocus
PeekMessageA
CharPrevA
GetWindowRect
InflateRect
FrameRect
SetWindowWord
GetWindowWord
ShowWindow
CreateDialogParamA
SetWindowTextA
SendDlgItemMessageA
GetSysColor
GetWindowTextA
UnregisterClassA
RegisterClassA
DefDlgProcA
CheckDlgButton
IsDlgButtonChecked
GetKeyState
GetDlgItem
GetParent
DrawFocusRect
CheckRadioButton
WinHelpA
GetPropA
SetClassLongA
LoadIconA
GetClassLongA
SetPropA
SetWindowLongA
GetWindowLongA
EnumChildWindows
EnableMenuItem
GetSystemMenu
GetClassNameA
GetDesktopWindow
GetActiveWindow
AttachThreadInput

gdi32

CreateFontIndirectA
SetBkMode
GetObjectA
ExtTextOutA
GetDeviceCaps
PatBlt
DeleteObject
StretchBlt
SetBkColor
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
SetTextColor
CreatePatternBrush
GetNearestColor
RectVisible
CreateCompatibleBitmap
SaveDC
IntersectClipRect
SetStretchBltMode
RestoreDC
GetPixel
CreateBitmap
CreateSolidBrush
GetTextMetricsA
GetStockObject
GetTextExtentPointA

advapi32

RegDeleteValueA
SetFileSecurityA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
IsValidSecurityDescriptor
RegOpenKeyExA
RegFlushKey
RegEnumKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumValueA
InitiateSystemShutdownA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
CreateServiceA
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
LookupPrivilegeValueA
GetFileSecurityA

lz32

LZClose
LZInit
LZSeek
LZRead

winspool.drv

ClosePrinter
AddPrinterDriverA
AddMonitorA
AddPrinterA
GetPrinterDriverDirectoryA

shell32

ShellAboutA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

imagehlp

CheckSumMappedFile

cabinet

ord23
ord20
ord21
ord22

userenv

ord103
ord105
ord107
ord101

Exports

Exports

ServiceMain
AppendBackSlash
ArcPathToDosPath
AreCharsInString
BinaryFileSubst
CheckConfigType
CheckDriveExternal
CheckFileExistance
CheckPathFullPathSpec
CheckPrivilegeExists
ConfigFileAppend
ConfigFileSubst
CopySingleFile
DelFile
DeleteAllConnections
DeleteNetConnection
Delnode
DoesDirExist
DoesFileExist
DosPathToArcPath
DosPathToNtPath
EnablePrivilege
ExpandSz
FindFileInstances
GenerateSortedIndexList
GetAnsiCodepage
GetCountry
GetCrashDumpSize
GetDevicemapValue
GetDosPathVar
GetEisaSlotInformation
GetEnvVar
GetFileCreationTime
GetFileLastAccessTime
GetFileLastWriteTime
GetFloppyDriveLetters
GetHardDriveFileSystems
GetHardDriveFreeSpace
GetHardDriveLetters
GetHardDriveTotalSpace
GetInstalledOSNames
GetLanguage
GetLoadedEnvVar
GetMCABusInformation
GetMemorySize
GetMyBusType
GetMyBusTypeList
GetMyComputerName
GetMyComputerType
GetMyKeyboardType
GetMyPointerType
GetMyUserName
GetMyVideoType
GetNVRAMVar
GetNtBootInfo
GetNtDir
GetNtDrive
GetOemCodepage
GetPciInformation
GetPlatform
GetPrinterDriverDir
GetProcessor
GetSelectedKeyboard
GetSelectedPointer
GetSelectedVideo
GetSizeOfFile
GetSystemDate
GetTypeOfDrive
GetUnusedDrives
GetUserAccounts
GetWindowsNtDir
GetWindowsNtSysDir
GetWindowsNtVersion
GetWindowsPath
IsUniprocessorSystem
LegacyInfGetModifiedSvcList
LegacyInfInterpret
LegacyInfLookUpSymbol
LegacyInfRemoveInfSymbol
LegacyInfSetSymbolValue
NetNameCheck
NtPathToDosPath
ProcessForUNC
RenFile
SetCurrentLayout
SetCurrentLocale
SetEnvVar
SetMyComputerName
SetNVRAMVar
SetupAddPrinter
SetupAddPrinterDriver
SetupAddPrinterMonitor
SetupChangeServiceConfig
SetupChangeServiceStart
SetupCreateService
SetupStrncmp
ShutdownRemoteSystem
ShutdownSystem
SumListItems
TestAdmin
ToLower
VdmFixup
WhiteSpaceCheck
dll_main

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 336KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8003f8c9eb64649a7e39420b6538fac

Headers

File Characteristics

Imports

msvcrt

ntdll

kernel32

user32

gdi32

advapi32

lz32

winspool.drv

shell32

version

imagehlp

cabinet

userenv

Exports

Exports

Sections

.text Size: 158KB - Virtual size: 157KB

.data Size: 4KB - Virtual size: 18KB

.rsrc Size: 336KB - Virtual size: 336KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 158KB - Virtual size: 157KB

.data
Size: 4KB - Virtual size: 18KB

.rsrc
Size: 336KB - Virtual size: 336KB

.reloc
Size: 11KB - Virtual size: 11KB