fa52eff5e3d114e975eeae9966b74ce51a16670c552bed09d2a588b36fcd3e1d

Sharing

Copy URL Twitter E-mail

General

Target

fa52eff5e3d114e975eeae9966b74ce51a16670c552bed09d2a588b36fcd3e1d
Size

159KB
MD5

ee24a6254ecefa81a51c9878ebaf56ae
SHA1

19d066feac87cc11f818cc52b5142b48135f64c4
SHA256

fa52eff5e3d114e975eeae9966b74ce51a16670c552bed09d2a588b36fcd3e1d
SHA512

e334ef020904daad82620f64e6d6a814406038568b1b993c556ec4c6de7983becf69d94b2e4be4df7b1765310e9dacd38e051d1c662c32ac52125d3d28338402
SSDEEP

3072:exQnyeJZdWL3Pb7lyRArWA70jgcnuhz2jWMBCdXUnElvbe:hysOL/Ndrr70jgWiCWMBCdXUEZS

Score

N/A

Malware Config

Signatures

Files

fa52eff5e3d114e975eeae9966b74ce51a16670c552bed09d2a588b36fcd3e1d
.dll windows x86

66924d040a5f97a2f1529dea84648d7d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
WideCharToMultiByte
GetThreadLocale
GetStartupInfoA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrcmpi
lstrcat
WriteFile
WaitForSingleObject
VirtualAlloc
TerminateProcess
Sleep
SetThreadPriority
SetPriorityClass
SetFilePointer
SetEvent
ResumeThread
ReadFile
OpenProcess
MoveFileA
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalMemoryStatus
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryA
GetVersionExA
GetTickCount
GetThreadPriority
GetTempPathA
GetSystemInfo
GetSystemDirectoryA
GetProcAddress
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocalTime
GetLastError
GetFileSize
GetExitCodeThread
GetDriveTypeA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetComputerNameA
FreeLibrary
FindNextFileA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnterCriticalSection
DeviceIoControl
DeleteFileA
DeleteCriticalSection
CreateProcessA
CreatePipe
CreateFileA
CreateEventA
CreateDirectoryA
CopyFileA
CloseHandle
Sleep
VirtualProtect
VirtualProtect
ExitProcess

user32

GetKeyboardType
MessageBoxA
CharNextA
CreateWindowExA
mouse_event
keybd_event
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
ShowWindow
SetWindowsHookExA
SetWindowLongA
SetThreadDesktop
SetCursorPos
SendMessageA
ReleaseDC
RegisterClassA
PostMessageA
PeekMessageA
OpenInputDesktop
OpenDesktopA
OemToCharA
MsgWaitForMultipleObjects
MessageBoxA
IsWindowVisible
IsWindow
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowLongA
GetUserObjectInformationA
GetTopWindow
GetThreadDesktop
GetSystemMetrics
GetParent
GetWindow
GetMessageA
GetForegroundWindow
GetDesktopWindow
GetDC
GetCursorPos
GetClassNameA
GetClassInfoA
ExitWindowsEx
DispatchMessageA
DestroyWindow
DefWindowProcA
CloseDesktop
CallNextHookEx

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegFlushKey
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
AdjustTokenPrivileges
StartServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenServiceA
OpenSCManagerA
EnumServicesStatusA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen

gdi32

SetDIBColorTable
SelectPalette
SelectObject
RealizePalette
PatBlt
GetSystemPaletteEntries
GetStockObject
GetPaletteEntries
GetObjectA
GetDeviceCaps
GetDIBits
GetDIBColorTable
GdiFlush
DeleteObject
DeleteDC
CreatePalette
CreateICA
CreateHalftonePalette
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
BitBlt

wsock32

WSACleanup
WSAStartup
WSAGetLastError
gethostbyname
socket
shutdown
setsockopt
send
recv
ioctlsocket
inet_ntoa
inet_addr
htons
getsockname
connect
closesocket

ws2_32

inet_addr

winmm

waveInUnprepareHeader
waveInStart
waveInReset
waveInPrepareHeader
waveInOpen
waveInClose
waveInAddBuffer

msacm32

acmStreamUnprepareHeader
acmStreamPrepareHeader
acmStreamConvert
acmStreamReset
acmStreamSize
acmStreamClose
acmStreamOpen

shell32

ShellExecuteA
SHFileOperation

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

urlmon

URLDownloadToFileA

avicap32

capGetDriverDescriptionA
capCreateCaptureWindowA

imm32

ImmReleaseContext
ImmGetCompositionStringA
ImmGetContext

Exports

Exports

MainService
MainWork
ServiceMain

Sections

CODE
Size: - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

866
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mackt
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sytem
Size: - Virtual size: 1000B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sytem
Size: - Virtual size: 1000B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Katja
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66924d040a5f97a2f1529dea84648d7d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

gdi32

wsock32

ws2_32

winmm

msacm32

shell32

wininet

urlmon

avicap32

imm32

Exports

Exports

Sections

CODE Size: - Virtual size: 118KB

DATA Size: - Virtual size: 7KB

BSS Size: - Virtual size: 2KB

.idata Size: - Virtual size: 6KB

.edata Size: - Virtual size: 116B

.reloc Size: - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 3KB

866 Size: - Virtual size: 8KB

.reloc Size: - Virtual size: 512B

.mackt Size: - Virtual size: 8KB

sytem Size: - Virtual size: 1000B

sytem Size: - Virtual size: 1000B

.Katja Size: - Virtual size: 4KB

.vmp0 Size: - Virtual size: 25KB

.vmp1 Size: 154KB - Virtual size: 153KB

.reloc Size: 512B - Virtual size: 128B

CODE
Size: - Virtual size: 118KB

DATA
Size: - Virtual size: 7KB

BSS
Size: - Virtual size: 2KB

.idata
Size: - Virtual size: 6KB

.edata
Size: - Virtual size: 116B

.reloc
Size: - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 3KB

866
Size: - Virtual size: 8KB

.reloc
Size: - Virtual size: 512B

.mackt
Size: - Virtual size: 8KB

sytem
Size: - Virtual size: 1000B

sytem
Size: - Virtual size: 1000B

.Katja
Size: - Virtual size: 4KB

.vmp0
Size: - Virtual size: 25KB

.vmp1
Size: 154KB - Virtual size: 153KB

.reloc
Size: 512B - Virtual size: 128B