4efe2b4e35bbffd891e45ad48e4d01496ce60567d36afadbc443c00e8c0d6139

Sharing

Copy URL Twitter E-mail

General

Target

4efe2b4e35bbffd891e45ad48e4d01496ce60567d36afadbc443c00e8c0d6139
Size

58KB
MD5

eef3375866e1a3eb9b53e877eb66afc0
SHA1

51ec625a7c7f5d2c4527e0ff78ed4d1ce83c42cf
SHA256

4efe2b4e35bbffd891e45ad48e4d01496ce60567d36afadbc443c00e8c0d6139
SHA512

daa5f79674f8f14c54fc82bcf9aee7878a0555e71888d3ed1940dbf7a38c0a83b4fb3ad284cb1d11c5e0f0fb966dcd79206d0a49d0342db795798de8625fc4cc
SSDEEP

768:gGB6Dq6A7doms6X8N4R5+lxfuqpmzSslUrHIv4QyhnU/QdOL92ovAg+eyDU:TWqp7q+X8qR5+lx5vr1TjdOxXyDU

Score

N/A

Malware Config

Signatures

Files

4efe2b4e35bbffd891e45ad48e4d01496ce60567d36afadbc443c00e8c0d6139
.dll windows x86

ea30512ff032a8f28f3b4be6988c4da0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ExitWindowsEx
SetThreadDesktop
GetActiveWindow
GetUserObjectInformationA
EnumChildWindows
SetWindowsHookExW
GetForegroundWindow
OpenWindowStationA
SetProcessWindowStation
CreateDesktopA
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
IsWindow
SendMessageA
DestroyWindow
GetMessageA
DispatchMessageA
ShowWindow
BringWindowToTop
UpdateWindow
EnumWindows
GetWindowThreadProcessId
GetWindowTextA
CharUpperA
wsprintfA
OpenDesktopA
PostMessageA
SetCursorPos
SendInput
GetThreadDesktop
OpenInputDesktop
MessageBoxA

gdi32

DeleteDC
GetDeviceCaps
CreateDCA
CreateCompatibleDC
DeleteObject
CreateCompatibleBitmap
GetDIBits
BitBlt
SelectObject

advapi32

RegCreateKeyExA
LookupPrivilegeValueA
OpenProcessToken
ImpersonateSelf
OpenThreadToken
ChangeServiceConfigA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegQueryValueExA
CreateServiceA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
QueryServiceConfigA
EnumServicesStatusA
DeleteService
ControlService
StartServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
AdjustTokenPrivileges

shell32

SHEmptyRecycleBinA
ShellExecuteA
SHFileOperationA

ole32

CreateStreamOnHGlobal

ws2_32

connect
socket
bind
setsockopt
listen
accept
ntohs
getsockname
select
recv
send
WSASocketA
WSADuplicateSocketA
WSAStartup
inet_addr
gethostbyname
inet_ntoa
closesocket
htons

shlwapi

SHDeleteKeyA
StrCmpNIA
StrRChrA
StrStrA
StrCmpW
StrToIntA
StrChrA

psapi

EnumProcesses
GetModuleFileNameExA

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile

imm32

ImmGetCompositionStringW
ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext

msvcrt

_adjust_fdiv
_initterm
strstr
strchr
malloc
wcscmp
free
__CxxFrameHandler
_beginthread
??2@YAPAXI@Z
??3@YAXPAX@Z

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

kernel32

GetLastError
lstrcmpA
FindNextFileA
FindFirstFileA
lstrcmpiA
GetCurrentProcessId
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
DuplicateHandle
SetStdHandle
CreatePipe
GetStdHandle
CreateProcessA
DeviceIoControl
GetOEMCP
GetACP
GetComputerNameA
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
GetVersion
QueryPerformanceCounter
GetDriveTypeA
lstrcpyA
MoveFileA
FindClose
LoadLibraryA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetProcAddress
CreateThread
GetFileAttributesA
ExitProcess
lstrlenW
WideCharToMultiByte
GetLocalTime
GetSystemDirectoryA
GetModuleFileNameA
GetStartupInfoA
CallNamedPipeA
OpenEventA
lstrcatA
CreateNamedPipeA
ConnectNamedPipe
FlushFileBuffers
WriteFile
GetTempPathA
SetPriorityClass
lstrlenA
GetFileSize
DeleteFileA
GlobalAlloc
GlobalLock
lstrcpyW
WaitForMultipleObjects
GetCurrentThreadId
DisconnectNamedPipe
SetFilePointer
GetPriorityClass
GetCurrentThread
GetThreadPriority
SetEvent
GetVolumeInformationA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
CreateDirectoryA
GetFileAttributesExA
Sleep
WaitForSingleObject
ResetEvent
ReleaseMutex
GlobalFree
CreateEventA
CreateMutexA
CreateFileA
GetFileSizeEx
SetFilePointerEx
ReadFile
CloseHandle
GetTickCount
QueryPerformanceFrequency
SetThreadPriority

Exports

Exports

DoMainWork
DoService
ServiceMain

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Share
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

vip
Size: 512B - Virtual size: 520B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ea30512ff032a8f28f3b4be6988c4da0

Headers

File Characteristics

Imports

user32

gdi32

advapi32

shell32

ole32

ws2_32

shlwapi

psapi

wininet

imm32

msvcrt

avicap32

kernel32

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 1024B - Virtual size: 1KB

Share Size: 4KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 3KB

vip Size: 512B - Virtual size: 520B

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 1024B - Virtual size: 1KB

Share
Size: 4KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 3KB

vip
Size: 512B - Virtual size: 520B