c8ee519b45ed667bcf407904b8ac8f135e703c4440b503acc8cde95e64b7fb32

Sharing

Copy URL Twitter E-mail

General

Target

c8ee519b45ed667bcf407904b8ac8f135e703c4440b503acc8cde95e64b7fb32
Size

461KB
MD5

eb4daf7b7ba63c03280e1f5373bfcacf
SHA1

1393d2dbc82f44c337a3a7f0fefe4a3a269475d1
SHA256

c8ee519b45ed667bcf407904b8ac8f135e703c4440b503acc8cde95e64b7fb32
SHA512

127f18c6146ce5c8a267bc8d7b0ef3e23bb48a1f1279aa5c147870c5c96997d4984657a1b5a43aab897d17aeeb39800b2dfff30ddb39d4eb2559a72f10d0f043
SSDEEP

1536:aEXPKX6NkdZ3Ghx6qbhJiXhJLjA8GI3GbPNanR70OpEJjdSynPMCG:awPKX6NdTKhJLjpqInSOpEZdS0P2

Score

N/A

Malware Config

Signatures

Files

c8ee519b45ed667bcf407904b8ac8f135e703c4440b503acc8cde95e64b7fb32
.exe windows x86

c5ab0e6ccd6ea8e310e026a31dc17ddd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

ntohl
htonl

kernel32

LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
GetProcAddress
GetVersionExW
WideCharToMultiByte
FindNextFileW
FindFirstFileW
LeaveCriticalSection
EnterCriticalSection
LockResource
FindResourceExW
lstrlenA
ResumeThread
DeleteTimerQueueTimer
CreateProcessW
CreateTimerQueueTimer
ReleaseMutex
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
WriteFile
SetFileAttributesW
CreateDirectoryW
CreateMutexW
SizeofResource
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
MultiByteToWideChar
FreeLibrary
SetEvent
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GetModuleHandleW
CreateEventW
CreateThread
Sleep
GetModuleFileNameW
lstrcmpiW
RaiseException
lstrlenW
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
DeleteTimerQueueEx
CreateTimerQueue
GetLastError
GlobalHandle
GlobalUnlock
GlobalFree
CreateFileW
GetFileSize
GlobalAlloc
GlobalLock
ReadFile
CloseHandle
HeapSize
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SetLastError
GetUserDefaultLCID
GetLocaleInfoW
GetCurrentProcessId
GetLocalTime
GetFileAttributesW
OpenMutexW
GlobalReAlloc
LoadLibraryW

user32

CharNextW
LoadStringW
CharUpperW
PostThreadMessageW
GetMessageW
TranslateMessage
UnregisterClassA
DispatchMessageW
MessageBoxW

winspool.drv

EnumPrintersW

advapi32

SetSecurityDescriptorDacl
DeregisterEventSource
ReportEventW
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
RegisterEventSourceW
FreeSid
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegEnumKeyExW
ControlService
DeleteService
CreateServiceW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
SetServiceStatus

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize
CoTaskMemAlloc
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoResumeClassObjects
CoTaskMemRealloc

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysFreeString
SysStringLen
SysAllocString

msvcr80

_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
??3@YAXPAX@Z
memset
memcpy_s
_vsnwprintf_s
__CxxFrameHandler3
_beginthreadex
malloc
free
_putws
_CxxThrowException
wcscpy_s
wcsncpy_s
wcscat_s
??_V@YAXPAX@Z
_recalloc
??_U@YAPAXI@Z
_time64
calloc
??2@YAPAXI@Z
memmove_s
wcsstr
_mbsspn
_mbscspn
_mbscmp
atoi
memcpy
_wcsnicmp
strstr
wcsrchr
_wfsopen
fwprintf
vfwprintf
fclose
_wsplitpath_s
_wtol
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

winhttp

WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpSendRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpCrackUrl

gdi32

ExtEscape
DeleteDC
CreateDCW

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 360KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5ab0e6ccd6ea8e310e026a31dc17ddd

Headers

File Characteristics

Imports

ws2_32

kernel32

user32

winspool.drv

advapi32

shell32

ole32

oleaut32

msvcr80

winhttp

gdi32

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 360KB - Virtual size: 361KB

.rsrc Size: 8KB - Virtual size: 6KB

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 360KB - Virtual size: 361KB

.rsrc
Size: 8KB - Virtual size: 6KB