e535e51e4dffce01e75d89178b81638a786920763a0564af602652430650f48b

Sharing

Copy URL Twitter E-mail

General

Target

e535e51e4dffce01e75d89178b81638a786920763a0564af602652430650f48b
Size

124KB
MD5

f55dcbc64d8fd7cc6d0a632ace841708
SHA1

918b0de367ca5babab5ac3518969e6ba264151a0
SHA256

e535e51e4dffce01e75d89178b81638a786920763a0564af602652430650f48b
SHA512

d2a438bd18617e2ed0b3727aa65fb4307217db022b0e3409f8d6eada11ef381adeb1c2b16080cd448615df062feb492fedd3a621c757b3d5df6001645b1f5afa
SSDEEP

3072:09eTxSuvonEL3jGBBjpQRY4HTMlpbBzIEgiqOdjN+Q:geTxSHY3iBBjeYsYrbBzIEg2xt

Score

N/A

Malware Config

Signatures

Files

e535e51e4dffce01e75d89178b81638a786920763a0564af602652430650f48b
.dll windows x86

9aa0ca844e6b065d490e578789089b9b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
LoadLibraryA
CreateFileMappingW
QueryPerformanceCounter
ExpungeConsoleCommandHistoryA
GetExitCodeThread
FindNextVolumeMountPointW
OpenWaitableTimerA
SearchPathW
GetFileAttributesExA
FileTimeToLocalFileTime
CreateFileA
SetCalendarInfoW
GetWindowsDirectoryA
GetConsoleCommandHistoryW
GetModuleHandleA
CreateDirectoryExW
Process32Next
GetProcessHeaps
SetLastConsoleEventActive
SetConsoleCursorPosition
GetNextVDMCommand
GetAtomNameW
LocalUnlock
AddConsoleAliasW
lstrcatW
GetProfileStringW
LoadLibraryW
GetBinaryTypeA
LockFileEx
SetVolumeLabelA
EnumResourceLanguagesW
EnumDateFormatsExA
SizeofResource
ReadFile
TlsAlloc
IsBadWritePtr
VirtualAlloc
CompareStringA
WritePrivateProfileStructW
CreateSemaphoreA
WritePrivateProfileSectionW
RequestWakeupLatency
GetSystemTime
GetConsoleCP
GetPrivateProfileIntA
VerLanguageNameW
SetPriorityClass
UnhandledExceptionFilter
DeleteTimerQueue
OpenFile
GetProcAddress
lstrcmpA
WritePrivateProfileStructA
SetConsolePalette
GetVersion
Module32Next
FindResourceExA
SetThreadIdealProcessor
FindFirstVolumeMountPointA
FatalExit
AddAtomW
GetHandleInformation
GetStdHandle
LockFile
IsValidLocale
OpenFileMappingW
SetConsoleInputExeNameA
BackupRead
FindClose
PostQueuedCompletionStatus
SetThreadPriority
VirtualProtect

user32

OpenDesktopW
DdeFreeStringHandle

advapi32

SetNamedSecurityInfoW
OpenServiceW
RegOpenKeyW
SystemFunction019
CryptImportKey
TrusteeAccessToObjectA
SystemFunction002
ConvertSidToStringSidW
CryptVerifySignatureA
RegDeleteKeyW
SetSecurityInfoExW
ElfReportEventW
CryptSetProviderW
CheckTokenMembership
GetEffectiveRightsFromAclW
LsaGetRemoteUserName
ElfChangeNotify
RemoveUsersFromEncryptedFile
MakeAbsoluteSD
LogonUserA
SystemFunction010
GetSecurityDescriptorDacl
GetTokenInformation
LsaEnumerateTrustedDomains
ControlService
FileEncryptionStatusA
SetEntriesInAuditListA
RegQueryInfoKeyW
AccessCheckByTypeAndAuditAlarmW
LsaEnumerateTrustedDomainsEx
SystemFunction028
AddUsersToEncryptedFile
SystemFunction007
CryptDestroyKey
LsaSetQuotasForAccount
SystemFunction030
LsaOpenPolicy
RegOpenKeyExW
CryptEnumProviderTypesW
GetAclInformation
GetServiceDisplayNameW
AllocateLocallyUniqueId
RegQueryValueW
RegSetValueExW
CryptCreateHash
ConvertSecurityDescriptorToAccessA
AccessCheckAndAuditAlarmA
GetTrusteeTypeA
StartServiceW
AdjustTokenPrivileges
RegEnumKeyA
LsaQueryTrustedDomainInfoByName
RegCreateKeyExW
ElfRegisterEventSourceW
ChangeServiceConfigA
RegCreateKeyW
GetNamedSecurityInfoExA
CopySid
CryptGetUserKey
CryptSetProvParam
RegisterEventSourceW
AddAuditAccessAce
CryptGetKeyParam
GetExplicitEntriesFromAclA
LsaQueryInformationPolicy
SystemFunction005
BackupEventLogA
RegEnumKeyExW
ReadEventLogW
ObjectDeleteAuditAlarmA
SetEntriesInAclW
RegRestoreKeyA
ObjectPrivilegeAuditAlarmA
I_ScSetServiceBitsW
LsaSetSystemAccessAccount
AddAuditAccessObjectAce
FileEncryptionStatusW
RegNotifyChangeKeyValue
GetNamedSecurityInfoW
RegQueryMultipleValuesW

comctl32

ImageList_AddMasked
ord7
FlatSB_SetScrollProp
_TrackMouseEvent
ord6
ImageList_GetImageRect
ord4
FlatSB_GetScrollRange
ImageList_GetImageCount
ImageList_Merge
ord5
ImageList_Write
ImageList_Remove
ImageList_GetBkColor
ImageList_Draw
ImageList_BeginDrag
ImageList_Destroy
ord17
CreateStatusWindowW
PropertySheetA
FlatSB_SetScrollPos
ImageList_Copy
FlatSB_GetScrollPos
ImageList_GetIcon
ImageList_ReplaceIcon
FlatSB_GetScrollProp
ImageList_SetFilter
CreatePropertySheetPageW
ImageList_SetBkColor
ImageList_GetIconSize
ImageList_GetDragImage
ImageList_DrawEx
ImageList_AddIcon
ImageList_Duplicate
ord16
ImageList_EndDrag
ImageList_Create
ImageList_Replace
ImageList_LoadImageA
FlatSB_EnableScrollBar

opengl32

glTexGenfv
glTexCoordPointer
glNormal3d
GlmfEndGlsBlock
glRasterPos4i
glFrontFace
glColor3i
glEvalCoord2f
glColor4fv
wglGetCurrentDC
wglUseFontOutlinesW
glMap1d
glPixelStoref
glPushAttrib
glVertex4dv
glReadBuffer
glTexGenf
glRotatef
glRectdv
glColor3bv
glCopyTexSubImage1D
glLoadMatrixf
glRasterPos4fv
glTexCoord2s
glMapGrid1d
glDebugEntry
wglRealizeLayerPalette
glIndexiv
glDepthMask
glNormal3iv
glTexCoord2fv
glRenderMode
glVertexPointer
glEdgeFlagv
glRasterPos4iv
glTexCoord4i
glDrawPixels
wglCreateContext
glPixelMapuiv
glVertex4f
glNormal3dv
glBitmap
glClearStencil
glAccum
glLoadIdentity
glTexParameterfv
glGetMaterialfv
glIndexfv
glEdgeFlagPointer
glEnableClientState
wglChoosePixelFormat
wglGetProcAddress
glGetPolygonStipple
glMapGrid2f
glTexEnvfv
glDepthRange
glNormal3f
glGetTexParameterfv
glEvalCoord2dv
glNormal3bv
glVertex2i
glGetTexLevelParameterfv
glDeleteTextures
glTexImage2D
glNormal3fv
glReadPixels
glVertex3iv
glLineWidth
glRasterPos3sv
glGenLists
glEvalCoord2fv
glMateriali
glInterleavedArrays
glTexCoord1iv
glTranslatef
glEvalCoord1fv
glMultMatrixd
glVertex4iv
glVertex3f
glCopyTexImage2D
glFogf
glLightfv
glTexGendv
glOrtho
glCopyPixels
glPopMatrix
glCopyTexImage1D
glFogiv
glMap2f
glGetTexGendv
glTexCoord1d
glRectfv
glColor4d
glColor4ub
glPolygonMode
glFinish
glHint
glRasterPos3s
glTexCoord3f
glTexEnvi
glPopName

shell32

ExtractIconExA
ord180
StrCmpNW
StrRStrIA
DragQueryFileA
SHAppBarMessage
SHFileOperationA
CheckEscapesW
ShellAboutW
StrRStrA
FindExecutableA
DragQueryFileW
StrNCmpIW
ShellAboutA
SheSetCurDrive
ShellHookProc
DoEnvironmentSubstW
StrCmpNIA
ord179
StrNCmpA
DragFinish
StrStrA
SHGetSettings
StrRStrIW
WOWShellExecute
Shell_NotifyIconW
SHGetFileInfoW
StrChrIW
SHGetPathFromIDListW
DragQueryPoint
StrRChrIA
StrStrIW
StrRChrIW
SHBrowseForFolderW
SHGetDiskFreeSpaceA
ShellExecuteExW
SHBrowseForFolderA
DoEnvironmentSubstA
SHEmptyRecycleBinA
SHInvokePrinterCommandA
SHFileOperationW
CommandLineToArgvW
DuplicateIcon
SHInvokePrinterCommandW
SHGetPathFromIDListA
StrRStrW
SHUpdateRecycleBinIcon
FreeIconList
StrStrW
SheGetDirA
StrNCmpIA
SHLoadInProc
StrRChrA
SHGetSpecialFolderLocation
SHAddToRecentDocs
ExtractIconExW
RealShellExecuteExA
SHGetDesktopFolder
SHChangeNotify

shlwapi

PathRenameExtensionW
UrlApplySchemeA
UrlCombineA
PathIsContentTypeA
SHRegOpenUSKeyA
StrCSpnIW
StrDupA
PathSetDlgItemPathW
PathIsRootW
UrlHashA
PathGetDriveNumberW
PathIsRelativeW
SHOpenRegStreamA
SHRegDeleteEmptyUSKeyW
UrlApplySchemeW
PathSetDlgItemPathA
PathCreateFromUrlW
PathUnquoteSpacesA
StrToIntExW
PathStripToRootW
PathGetArgsA
PathFindExtensionA
StrToIntA
PathIsRelativeA
StrFormatByteSizeA
PathStripToRootA
PathIsSystemFolderW
PathMakeSystemFolderA
PathRelativePathToW
StrNCatA
PathIsSameRootW
PathFindFileNameA
SHRegCreateUSKeyA
UrlGetLocationW
PathCommonPrefixA
PathRemoveFileSpecA

version

VerQueryValueW
VerInstallFileW
VerFindFileW

winmm

midiOutGetDevCapsA
mmioRenameA
mixerGetControlDetailsW
midiInMessage
waveInMessage
waveOutPrepareHeader
auxSetVolume
midiOutGetErrorTextA
mixerGetLineControlsA
SendDriverMessage
mxd32Message
waveOutGetDevCapsA
waveOutReset
sndPlaySoundW
DriverCallback
waveInStop
mixerClose
timeGetDevCaps
waveOutGetErrorTextA
mmTaskBlock
waveOutRestart
mixerGetDevCapsA
mmioOpenW
mmDrvInstall
mmioInstallIOProcA
midiOutLongMsg
midiStreamPosition
midiInReset
waveOutWrite
joyGetDevCapsA
mmioCreateChunk
joyGetPos
auxGetNumDevs
waveInClose
waveInGetID
PlaySoundA
mixerGetLineControlsW
mciLoadCommandResource
WOW32ResolveMultiMediaHandle
mciGetErrorStringA
waveOutOpen
wid32Message
midiOutShortMsg
joyReleaseCapture
midiStreamOut
midiInAddBuffer
waveInGetErrorTextW
mmioSetBuffer
waveOutClose
timeKillEvent
waveOutSetPitch
midiInStop
midiInUnprepareHeader
midiOutOpen
mixerSetControlDetails
waveInGetErrorTextA
mmioAscend
NotifyCallbackData
waveInOpen
joyConfigChanged
tid32Message
auxOutMessage
midiInOpen
mmsystemGetVersion
midiStreamOpen
waveOutGetErrorTextW
midiStreamStop
mciGetCreatorTask
auxGetDevCapsA
midiOutCacheDrumPatches
mmioWrite
mciGetYieldProc
mmioSeek
midiStreamClose
midiOutClose
midiInGetErrorTextA
waveInGetDevCapsW
midiInClose

winspool.drv

AddPrinterConnectionA
GetPrinterDataA
DeletePrinterDataExW
EnumPrinterKeyA
DeletePrinterKeyW
ord208
AddPrintProcessorW
FindFirstPrinterChangeNotification
ord203
EnumPrintProcessorDatatypesW
EnumPrinterDataA
ADVANCEDSETUPDIALOG
EnumJobsW
EXTDEVICEMODE
GetPrinterW
OpenPrinterA
StartDocDlgA
EnumPrintProcessorDatatypesA
SetPrinterA
AddMonitorW
EnumFormsA
AdvancedSetupDialog
ord212
GetPrinterDataW
DeletePrintProvidorW
DeletePrinterConnectionA
GetPrinterDriverDirectoryW
ord103
ResetPrinterW
DeletePrinterDriverA
SetPortW
DeviceMode
QueryColorProfile
GetSpoolFileHandle
AddPrinterW
DeleteFormA
OpenPrinterW
DocumentPropertySheets
FreePrinterNotifyInfo
CreatePrinterIC
ExtDeviceMode
SetFormW
AddPrintProvidorA
GetJobW
DeletePrintProcessorW
GetPrinterDriverW
EnumPortsW
SpoolerPrinterEvent
GetFormW
QuerySpoolMode
SetJobA
SpoolerDevQueryPrintW

msvcrt

_mbspbrk
_mbsupr
_mbsicmp
_mbsninc
_mbscspn
__wgetmainargs
_tell
iswcntrl
_chdir
_strtime
_seh_longjmp_unwind
_splitpath
fputws
_ungetch
ftell
fputc
strcmp
_mbctombb
asctime
_ltow
__initenv
_wmkdir
fopen
__unDName
modf
_EH_prolog
_memccpy
tmpnam
_adj_fdivr_m32i
log10
memset
_mbsnbcnt
fwprintf
fseek
_wexecve
_mbsrev
ungetc
__p___argc
_mbcasemap
_set_error_mode
_wputenv
rewind
wcscat
_ismbstrail
_findfirst
__threadid
_unlink
feof
_makepath
printf
_lock
mktime
frexp
_wfdopen
_mbscpy
_putenv
__p__dstbias
fclose
_CIfmod
sprintf
_wsetlocale
_wenviron
_mbsdup
_commit
_tzname
_mbsnextc
_set_sbh_threshold
_mbctokata
remove
strrchr
_memicmp
atof
malloc
_ismbcl1
ungetwc
fsetpos
_i64tow
_CIatan2
fwrite
__mb_cur_max
_vsnprintf
wcsstr
_outpw
_chmod
_ismbcprint
fread
tanh
_strdate
_Getmonths
_daylight
_getdcwd
ispunct
_fputwchar
_findclose
isupper
fprintf
__argc
iswascii
strspn
_execlp
_onexit
_expand
fputs
_CItanh
_wspawnlp
_nextafter
_findnexti64
setvbuf
_getmbcp
_wasctime
atan2
mbtowc
ferror
_ismbcspace
_ctype

Exports

Exports

Bdsdebrbb
Biykobhi
Byhkl
Epccdem
Fezggd
Geqaiqa
Ihnzjh
Jxbiphop
Lcxuws
Ocsezadbnc
Oogbhs

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9aa0ca844e6b065d490e578789089b9b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

comctl32

opengl32

shell32

shlwapi

version

winmm

winspool.drv

msvcrt

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 52KB - Virtual size: 51KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 52KB - Virtual size: 51KB

.reloc
Size: 8KB - Virtual size: 6KB