5bd19cc10fd0bfac43bbed472cd76c732effcb4b0a23a181be3656f03a1b24b8

Sharing

Copy URL Twitter E-mail

General

Target

5bd19cc10fd0bfac43bbed472cd76c732effcb4b0a23a181be3656f03a1b24b8
Size

460KB
MD5

a824f0cf61a257cd0de53a2182cbe6c0
SHA1

14d9cbbcc402a54ebcff4227cf3c89a44384eb47
SHA256

5bd19cc10fd0bfac43bbed472cd76c732effcb4b0a23a181be3656f03a1b24b8
SHA512

1f1468d9c7bad7e7c6ffd662fad77374fb5550941002230289e7fc181ed31f85f3bde7345096101e25a1b39abc5e264e5e555b0b6df90a0de3413e25a86b5919
SSDEEP

6144:RXhZREGVSwg1BpIMt52J9SwTztKCn0Xz32JjpDJxCQzL5dgbU6Om7hThp3nNs:cGVS7zpIMt8JbUODJYQzb6OmpW

Score

N/A

Malware Config

Signatures

Files

5bd19cc10fd0bfac43bbed472cd76c732effcb4b0a23a181be3656f03a1b24b8
.dll windows x86

9b66fdf15b065475a14b8c789e202b5c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlSetEnvironmentVariable
RtlAppendAsciizToString
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
RtlInitString
RtlFreeUnicodeString
RtlDestroyEnvironment
_strcmpi
LdrAccessResource
NtClose
NtDeleteKey
NtQueryKey
NtOpenKey
ZwAllocateVirtualMemory
RtlCreateEnvironment
NtWriteFile
NtCreateFile
NtQueryInformationThread
NtQueryObject
RtlDosPathNameToNtPathName_U
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlFreeHeap
RtlAllocateHeap
NtQueryValueKey
NtQueryVolumeInformationFile
DbgBreakPoint
RtlUnwind
NtDeleteValueKey
DbgPrint
NtQueryInformationFile
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlFormatCurrentUserKeyPath
NtQueryDirectoryFile
NtOpenFile
RtlQueryEnvironmentVariable_U
NtMapViewOfSection
NtCreateSection
NtUnmapViewOfSection
NtProtectVirtualMemory
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtQuerySystemInformation
NtQueryVirtualMemory
RtlxAnsiStringToUnicodeSize
NlsMbCodePageTag
RtlDoesFileExists_U
RtlGetFullPathName_U
RtlUnicodeStringToInteger
RtlExpandEnvironmentStrings_U
NtQueryAttributesFile
NtQueryInformationProcess
RtlGetVersion
NtSetInformationFile
RtlInitAnsiString
RtlGUIDFromString
NtEnumerateValueKey
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeString
RtlCopyUnicodeString
RtlUpcaseUnicodeToMultiByteN
LdrFindResource_U

kernel32

SetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringA
IsBadWritePtr
GetLastError
InitializeCriticalSectionAndSpinCount
CloseHandle
DuplicateHandle
GetDriveTypeA
GetFileAttributesA
GetEnvironmentVariableA
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingW
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
FreeResource
SetFileAttributesA
CopyFileA
MoveFileA
GetTempFileNameA
DeleteFileA
IsBadStringPtrA
IsBadCodePtr
GetBinaryTypeW
GetCurrentThreadId
GetProcAddress
GetModuleHandleA
WaitForSingleObject
SetEvent
ResetEvent
CreateThread
CreateEventW
WideCharToMultiByte
ExpandEnvironmentStringsW
GetFileAttributesW
GlobalFree
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetSystemDirectoryW
GetCurrentDirectoryW
GetVersionExW
QueryPerformanceCounter
QueryPerformanceFrequency
Module32First
CreateToolhelp32Snapshot
GetModuleHandleW
ExitProcess
CreateProcessW
FindResourceW
DeviceIoControl
CreateFileW
IsBadStringPtrW
SetUnhandledExceptionFilter
SetErrorMode
GetCurrentThread
CompareStringA
LocalFree
LocalAlloc
lstrlenA
GetShortPathNameA
IsBadReadPtr
SetProcessAffinityMask
FindClose
FindNextFileW
CopyFileW
FindFirstFileW
GetWindowsDirectoryW
GetModuleFileNameW
GetVolumeNameForVolumeMountPointW
lstrlenW
GetShortPathNameW
GetDriveTypeW
GetLogicalDriveStringsW
SetFilePointer
ReadFile
MultiByteToWideChar
CreateProcessA
Sleep
GetEnvironmentVariableW
DeleteFileW
GetSystemWindowsDirectoryW
SetEnvironmentVariableW
IsDBCSLeadByte
FreeLibrary
LoadLibraryW
GetCurrentProcessId
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
HeapCreate
HeapAlloc
HeapFree
HeapReAlloc
ReleaseMutex
GetLocalTime
CreateMutexA
VirtualProtect
InterlockedCompareExchange
GetSystemInfo
DebugBreak
InterlockedDecrement
InterlockedIncrement
GetLongPathNameW
GetFullPathNameW
lstrcmpiW
SearchPathW
GlobalAlloc
TlsSetValue
GetVersionExA
TlsFree
TlsGetValue
TlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
WriteFile
InterlockedExchange
VirtualQuery
HeapSize
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
GetUserDefaultUILanguage
lstrcmpiA
GetCommandLineA

user32

IsWindowVisible
PostMessageA
EnumDisplaySettingsA
ChangeDisplaySettingsA
IsCharAlphaA
GetActiveWindow
GetDC
ReleaseDC
DefWindowProcA
IsWindow
CharNextA
CharUpperW
EnumDisplaySettingsW
GetSystemMetrics
wvsprintfA
SetForegroundWindow
ShowCursor

gdi32

GetObjectType
DeleteObject
GetCurrentObject
GetPaletteEntries
SetSystemPaletteUse
CreatePalette
SelectPalette
GetDIBits
CreateDIBSection
CreateCompatibleDC
SetViewportOrgEx
GetDeviceCaps
RealizePalette
DeleteDC

advapi32

RegOpenKeyW
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetUserNameW
RegCreateKeyW
RegQueryValueExA
RegSetValueExA
RegEnumKeyExW
OpenProcessToken
OpenThreadToken
GetTokenInformation
CopySid
RegEnumKeyW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
LookupPrivilegeValueW

shell32

SHGetFolderPathA
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetMalloc

shlwapi

StrRStrIA
StrCmpNIA

ole32

CoInitialize

userenv

GetUserProfileDirectoryA
GetAllUsersProfileDirectoryW
GetUserProfileDirectoryW

winspool.drv

GetPrinterA
ord201
ClosePrinter
OpenPrinterA
EnumPrintersA
ord203

Exports

Exports

GetHookAPIs
NotifyShims

Sections

.text
Size: 346KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b66fdf15b065475a14b8c789e202b5c

Headers

File Characteristics

Imports

ntdll

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

userenv

winspool.drv

Exports

Exports

Sections

.text Size: 346KB - Virtual size: 345KB

.data Size: 22KB - Virtual size: 35KB

.rsrc Size: 65KB - Virtual size: 65KB

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 346KB - Virtual size: 345KB

.data
Size: 22KB - Virtual size: 35KB

.rsrc
Size: 65KB - Virtual size: 65KB

.reloc
Size: 25KB - Virtual size: 25KB