af7dc2d0c7c20c0fafbce2cb15ed9b02fa5b984a231e781ff4593c55132dbd97

Sharing

Copy URL Twitter E-mail

General

Target

af7dc2d0c7c20c0fafbce2cb15ed9b02fa5b984a231e781ff4593c55132dbd97
Size

132KB
MD5

207a4d53691b201a8163c656cea69739
SHA1

0cbef118992db6e6b35d0a95eb247bd3b4e0f66a
SHA256

af7dc2d0c7c20c0fafbce2cb15ed9b02fa5b984a231e781ff4593c55132dbd97
SHA512

af9d56871d9d0c23f2634df62a543c68756474fa1bcc33a0a839e40f5ae5f8aa55dd97584cc2d616b1558e16dc32dd245bb3c5ac2ba7097ab64abbaa540e8574
SSDEEP

3072:Yat+KtjcZZ2z5aBLQ9fLt//cVXj9QgtpIOFIpkK2Y2lu+ReC:YhCjcZZ2z5qQfHcVXj+op3Ix2Y1+ReC

Score

N/A

Malware Config

Signatures

Files

af7dc2d0c7c20c0fafbce2cb15ed9b02fa5b984a231e781ff4593c55132dbd97
.exe windows x86

54fb7e048a70d63f615e211daab0176e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LockResource
LoadResource
FindResourceExA
RaiseException
CreateFileMappingA
MapViewOfFile
lstrcatA
IsBadStringPtrA
OpenFileMappingA
FindFirstFileA
FindClose
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
FreeLibrary
TerminateProcess
OpenProcess
SetLastError
MoveFileExA
GetShortPathNameA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
CreateFileA
CreateEventA
GetCurrentProcess
GetModuleHandleA
IsBadWritePtr
IsBadStringPtrW
Sleep
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetExitCodeThread
VirtualFreeEx
SetFilePointer
WriteFile
GetLocalTime
GetCurrentThreadId
SystemTimeToFileTime
GetModuleFileNameA
GetTempPathA
GetComputerNameA
GetVolumeInformationA
SetErrorMode
GetTickCount
CreateProcessA
CopyFileA
SetCurrentDirectoryA
SetProcessPriorityBoost
SizeofResource
VirtualQuery
lstrcpyA
GetCurrentThread
GetSystemTimeAsFileTime
MulDiv
OpenEventA
SetEvent
LocalFree
GetFileAttributesA
RemoveDirectoryA
CreateDirectoryA
SetFileAttributesA
MoveFileA
lstrcmpA
FindNextFileA
GetTempFileNameA
ReadProcessMemory
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
GetCPInfo
GetOEMCP
HeapCreate
ExitProcess
GetStdHandle
GetCommandLineA
GetStartupInfoA
VirtualProtect
HeapSize
HeapReAlloc
HeapDestroy
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
RtlUnwind
FindResourceA
IsBadReadPtr
UnmapViewOfFile
DeleteFileA
GetSystemDirectoryA
VirtualAlloc
VirtualFree
GetProcessHeap
GetVersionExA
CloseHandle
GetLastError
WaitForSingleObject
ReleaseMutex
CreateMutexA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetThreadLocale
lstrcmpiA
GetStringTypeExA
CompareStringA
lstrlenW
InterlockedExchange
GetLocaleInfoA
GetACP
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
GetSystemInfo
IsBadCodePtr
SetStdHandle
FlushFileBuffers

user32

ExitWindowsEx
GetWindowLongA
GetParent
IsWindow
DialogBoxParamA
EndDialog
SetWindowTextA
GetSystemMetrics
SetWindowPos
GetWindowRect
DrawTextA
GetSysColor
GetWindowTextA
GetWindowTextLengthA
ReleaseDC
GetDC
GetDlgItem
SendMessageA
MessageBoxA
wsprintfA
FindWindowA
PostMessageA
GetWindowThreadProcessId
EnumWindows

gdi32

SetBkMode
DeleteObject
CreateFontIndirectA
GetDeviceCaps
GetObjectA
SetTextColor

advapi32

RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
GetSecurityInfo
LookupAccountSidA
GetUserNameA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
MakeAbsoluteSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
GetAclInformation
AddAce
InitializeAcl
CopySid
InitializeSid
GetSidLengthRequired
GetSidSubAuthority
IsValidSid
GetLengthSid
RegDeleteValueA

shell32

SHGetSpecialFolderPathA

ole32

CoUninitialize
CoInitialize
CLSIDFromProgID
CoCreateInstance

oleaut32

SysAllocStringLen
VariantClear
SysFreeString
SysAllocString
SysStringLen
VariantInit

shlwapi

PathCombineA
StrStrIA
StrToIntExA
SHSetValueA
SHGetValueA
wvnsprintfA
PathStripPathA
PathRemoveExtensionA
SHDeleteKeyA
PathUnquoteSpacesA
PathRemoveFileSpecA
PathRenameExtensionA

ws2_32

WSAStartup
closesocket
recv
send
ioctlsocket
socket
WSACleanup
__WSAFDIsSet
WSAGetLastError
select
gethostbyname
inet_addr
connect
htons
getsockopt

Sections

.text
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54fb7e048a70d63f615e211daab0176e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

Sections

.text Size: 103KB - Virtual size: 102KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 4KB - Virtual size: 17KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 103KB - Virtual size: 102KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 4KB - Virtual size: 17KB

.rsrc
Size: 1KB - Virtual size: 1KB