da3a5c320a45ae88641dc233246701055c2c5be36df7df78091f06008b1f45f6

Sharing

Copy URL Twitter E-mail

General

Target

da3a5c320a45ae88641dc233246701055c2c5be36df7df78091f06008b1f45f6
Size

2.2MB
MD5

eb0ae49241b7a29434b0ca18198c616c
SHA1

0def95b046bd2618330cbafa7ebfc3c0da39ffe0
SHA256

da3a5c320a45ae88641dc233246701055c2c5be36df7df78091f06008b1f45f6
SHA512

ff9403c695784fa582b90f578ddd49580767effdcf44501c5823e66d1a6f5280577e8165c2a1507e94b3cb4948dd270d109276668b198bab61dc45a6d12d2a68
SSDEEP

24576:MGYjkZHjB8wNFVX0nmZg6bMBgN6UaE7bFBzHyeUVA8sR7G9Mip5w2O85dN0VIw/v:MGcUHjmwbVYTKnrVC99hbf/N0VR/

Score

N/A

Malware Config

Signatures

Files

da3a5c320a45ae88641dc233246701055c2c5be36df7df78091f06008b1f45f6
.exe windows x86

b06a62109125c7fc6c616ff473dba590

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcslen
_adjust_fdiv
malloc
_initterm
free
wcschr
wcsrchr
_vsnwprintf
_purecall
memmove
strtoul
_wcsnicmp
_ltow
_wtol
swprintf
iswspace
iswprint
strtok
_stricmp
wcsncpy
_wcsicmp
_itow
wcscat
wcscmp
wcscpy
??3@YAXPAX@Z
??2@YAPAXI@Z
_except_handler3

kernel32

MapViewOfFile
DeleteFileW
GetCurrentDirectoryW
GetComputerNameW
SystemTimeToFileTime
WriteFile
LoadLibraryExA
lstrcatA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
WideCharToMultiByte
GetUserDefaultLCID
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
MultiByteToWideChar
LocalReAlloc
lstrlenA
lstrcpyA
LoadLibraryA
FormatMessageW
lstrlenW
lstrcmpA
FindResourceA
LoadResource
LockResource
FreeResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersionExA
DisableThreadLibraryCalls
FreeLibrary
OutputDebugStringA
LoadLibraryW
CompareFileTime
GetSystemTimeAsFileTime
CreateFileMappingA
InitializeCriticalSection
GetModuleFileNameW
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
LocalFree
GetCurrentThread
GetCurrentProcess
CloseHandle
SetLastError
GetProcAddress
GetModuleHandleW
GetLastError
GetModuleHandleA
SetEndOfFile
SetFilePointer
GetLocalTime
CreateFileA
ExpandEnvironmentStringsA
Sleep
DelayLoadFailureHook
GetFileSize
UnmapViewOfFile
GetComputerNameExW
ExpandEnvironmentStringsW
CreateFileW
GetACP
MulDiv
CompareStringA
CompareStringW
GetDateFormatA
GetTimeFormatA
DeleteCriticalSection

advapi32

GetUserNameW
FreeSid
EqualSid
AllocateAndInitializeSid
CloseServiceHandle
StartServiceW
UnlockServiceDatabase
CryptGetUserKey
CryptDestroyKey
CryptSetProvParam
CryptAcquireContextW
CryptGetProvParam
CryptReleaseContext
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenThreadToken
OpenProcessToken
GetTokenInformation
CryptGetKeyParam
RegOpenKeyExA
DuplicateToken
RegCreateKeyExA
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegQueryInfoKeyA
QueryServiceStatus
StartServiceA
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceConfigA
LockServiceDatabase
ChangeServiceConfigA
CryptAcquireContextA

wintrust

WinVerifyTrustEx
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WintrustGetDefaultForUsage
WTHelperGetKnownUsages
TrustIsCertificateSelfSigned

crypt32

CertFindCertificateInStore
CertSetEnhancedKeyUsage
CryptInitOIDFunctionSet
CryptGetDefaultOIDDllList
CryptGetDefaultOIDFunctionAddress
CryptFreeOIDFunctionAddress
CryptFindOIDInfo
CertGetValidUsages
CertFreeCertificateContext
CertDuplicateCertificateContext
CertDuplicateStore
CertGetEnhancedKeyUsage
CertFindExtension
CryptDecodeObject
CryptEncodeObject
CertGetSubjectCertificateFromStore
CertOpenStore
CertCloseStore
CertGetCertificateContextProperty
CertGetPublicKeyLength
CertGetCTLContextProperty
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CryptMsgVerifyCountersignatureEncoded
CertFindAttribute
CryptMsgControl
CryptFormatObject
CertGetNameStringW
CertGetStoreProperty
CryptMsgDuplicate
CertFreeCTLContext
CryptQueryObject
CryptFindLocalizedName
CertEnumSystemStore
CertEnumPhysicalStore
CertCompareCertificate
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertSaveStore
CertDeleteCertificateFromStore
CryptEnumOIDInfo
CryptMsgEncodeAndSignCTL
CertAddCTLContextToStore
CertSetCTLContextProperty
CertCreateCTLContext
CryptSIPRetrieveSubjectGuid
CryptDecodeObjectEx
CertEnumCTLsInStore
CertVerifyTimeValidity
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetCertificateChain
CertCreateCertificateChainEngine
PFXExportCertStore
PFXExportCertStoreEx
CryptAcquireCertificatePrivateKey
CertFreeCRLContext
CertGetCRLFromStore
PFXVerifyPassword
CertAddCRLContextToStore
CertFindCTLInStore
CertFindCRLInStore
CryptFindCertificateKeyProvInfo
PFXImportCertStore
CertCreateCertificateContext
CertNameToStrW
CertSetCertificateContextProperty

user32

MapDialogRect
SetRect
CreateWindowExW
PostMessageW
DestroyIcon
CheckRadioButton
IsDlgButtonChecked
GetSysColor
IsWindowVisible
GetDialogBaseUnits
GetFocus
UpdateWindow
GetNextDlgTabItem
GetClientRect
DrawFocusRect
LoadCursorA
SetCursor
GetWindowRect
MapWindowPoints
FillRect
InvalidateRect
GetSysColorBrush
LoadBitmapW
GetDesktopWindow
LoadStringA
SendDlgItemMessageA
SetDlgItemTextW
SendMessageA
SetWindowTextA
GetDC
ReleaseDC
WinHelpW
ShowWindow
GetDlgItem
GetWindowTextW
EnableWindow
SetFocus
DialogBoxParamW
PeekMessageA
IsWindowEnabled
LoadIconA
GetUpdateRect
CallWindowProcA
BeginPaint
EndPaint
DrawIcon
wsprintfA
SetWindowPos
GetParent
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
GetDlgItemTextA
SetClassLongA
GetWindowLongA
MonitorFromWindow
GetMonitorInfoW
GetWindow
CopyRect
LoadCursorW
DestroyWindow
SystemParametersInfoA
MessageBoxExW
PostMessageA
RegisterClipboardFormatA
CreateWindowExA
MoveWindow
GetWindowDC
SetCapture
SetWindowLongA
ReleaseCapture
GetWindowLongW
DrawTextExW
SendDlgItemMessageW
EndDialog
SetWindowLongW
SetWindowTextW
SendMessageW
LoadStringW
MessageBoxW

gdi32

CreatePalette
CreateDIBitmap
RealizePalette
SelectPalette
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
SetBkColor
CreateBitmap
GetObjectA
GetTextExtentPoint32W
GetBkColor
CreateFontIndirectA
GetDeviceCaps
CreateFontIndirectW
GetObjectW
SetPixel
DeleteObject

rpcrt4

RpcNetworkIsProtseqValidA
RpcBindingFromStringBindingA
RpcBindingFree
UuidCreate
UuidToStringA
RpcStringFreeA
NdrClientCall2
RpcStringBindingComposeA
RpcEpResolveBinding

netapi32

DsGetDcNameW
NetGetDCName
NetApiBufferFree

wininet

InternetCrackUrlW
InternetCanonicalizeUrlW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

jliqbadlpbcb
RunOnmeEmProcegs

Sections

.text
Size: 41KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b06a62109125c7fc6c616ff473dba590

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

wintrust

crypt32

user32

gdi32

rpcrt4

netapi32

wininet

version

Exports

Exports

Sections

.text Size: 41KB - Virtual size: 43KB

.data Size: 2.1MB - Virtual size: 2.1MB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 41KB - Virtual size: 43KB

.data
Size: 2.1MB - Virtual size: 2.1MB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 8KB - Virtual size: 8KB