f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15

Sharing

Copy URL

Twitter E-mail

General

Target

f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15
Size

68KB
MD5

7c0e6313c56b5bc829bc59c4829871c2
SHA1

64a27b5e46e4406ef488a23304ceea9a70d833c9
SHA256

f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15
SHA512

833479990c05344e8d833a9a07ebf5e87a8ccd00e0dae0d86e82f08050fec7190462e654652b8839596f2ce9b9adf918e2c400d2117d86b0d092018e89202fce
SSDEEP

768:LtRZ0NkZKDHOZcBHCE2a/ZOh+xqQKzvu+avgKvo9jd9cDgupNNpQcJJ9N0h/f4A/:JR2vOyTb/M+nKzvuIOo1f4

Score

N/A

Malware Config

Signatures

Files

f8be25e77aaa73c5c7c3c7345c7881ee2a3f76d7233388cca41b448219761e15
.dll windows x86

1e54bfda20dce8c7cb1574f673dfb9e3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryA
GetLastError
lstrlenA
DeviceIoControl
WideCharToMultiByte
MultiByteToWideChar
GetVolumeInformationA
FileTimeToSystemTime
GetPrivateProfileStringA
FindNextFileW
FindFirstFileW
FindFirstFileA
GetDriveTypeA
GetLogicalDriveStringsA
lstrcpyA
LocalAlloc
CopyFileA
GetModuleFileNameA
WritePrivateProfileStringA
DeleteFileA
GetTempPathA
lstrcmpiA
WinExec
GlobalFree
GlobalAlloc
LoadLibraryExA
GetFileSize
CreateFileMappingA
MapViewOfFile
GetModuleHandleA
UnmapViewOfFile
GetTickCount
CreateFileA
TerminateThread
GetCurrentProcessId
CreateThread
FreeConsole
Sleep
SetLastError
CreateEventA
GetProcAddress
WaitForSingleObject
CloseHandle
SetEvent
GetSystemDirectoryA
lstrcatA
LoadLibraryA
ExitProcess
FindClose

user32

wsprintfA
MessageBoxA

advapi32

RegCreateKeyExA
CreateServiceA
QueryServiceConfigA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderPathA

msvcrt

wcstombs
sprintf
malloc
??3@YAXPAX@Z
??2@YAPAXI@Z
wcslen
rand
srand
time
fclose
fseek
fwrite
fopen
strtok
atoi
sscanf
_snprintf
_CxxThrowException
_wfopen
wcschr
localtime
_snwprintf
_wcsnicmp
_except_handler3
strchr
??1type_info@@UAE@XZ
free
_initterm
_adjust_fdiv
_access
_itoa
_stricmp
strncpy
_beginthreadex
__CxxFrameHandler
fread

wininet

HttpSendRequestA
InternetCloseHandle
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA

shlwapi

PathFileExistsA
StrStrIA

ws2_32

sendto
inet_addr
recvfrom
ntohs
gethostname
closesocket
WSAStartup
WSAGetLastError
socket
inet_ntoa
htons

msvcp60

?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

netapi32

Netbios

crypt32

CertFreeCertificateContext
CertCreateCertificateContext
CertGetNameStringW

Exports

Exports

LpkPresent
ScriptApplyDigitSubstitution
ScriptApplyLogicalWidth
ScriptBreak
ScriptCPtoX
ScriptCacheGetHeight
ScriptFreeCache
ScriptGetCMap
ScriptGetFontProperties
ScriptGetGlyphABCWidth
ScriptGetLogicalWidths
ScriptGetProperties
ScriptIsComplex
ScriptItemize
ScriptJustify
ScriptLayout
ScriptPlace
ScriptRecordDigitSubstitution
ScriptShape
ScriptStringAnalyse
ScriptStringCPtoX
ScriptStringFree
ScriptStringGetLogicalWidths
ScriptStringGetOrder
ScriptStringOut
ScriptStringValidate
ScriptStringXtoCP
ScriptString_pLogAttr
ScriptString_pSize
ScriptString_pcOutChars
ScriptTextOut
ScriptXtoCP
ServiceMain
UspAllocCache
UspAllocTemp
UspFreeMem

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e54bfda20dce8c7cb1574f673dfb9e3

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

wininet

shlwapi

ws2_32

msvcp60

netapi32

crypt32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 22KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 28KB - Virtual size: 68KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 24KB - Virtual size: 22KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 28KB - Virtual size: 68KB

.reloc
Size: 4KB - Virtual size: 3KB