ccc6abc3d53e7eff1e195e4d738c3e2bffa30ba3cdee69bbb5331cf7e43f3ade

Sharing

Copy URL Twitter E-mail

General

Target

ccc6abc3d53e7eff1e195e4d738c3e2bffa30ba3cdee69bbb5331cf7e43f3ade
Size

100KB
MD5

657107281eef899d7e9625f500593ea6
SHA1

871ae7b976edc94b9639a690ef0e6d3c5a2322be
SHA256

ccc6abc3d53e7eff1e195e4d738c3e2bffa30ba3cdee69bbb5331cf7e43f3ade
SHA512

fac2d07c2fa13d989a55726a49516e8d5ce4070be73772671aa4bfe417a7566a7194806fa0915a384aaeb739c2796c1ea557bfbc28a63d27f7641146399c4a60
SSDEEP

1536:0lF1h7Snbnmb75lMt4sDSDb8BMu3B8G/pxp8VCx4xiMRrio+fJmmxX77P:2FPSnLmgtdDSDgR5BjEo8v+smxL

Score

N/A

Malware Config

Signatures

Files

ccc6abc3d53e7eff1e195e4d738c3e2bffa30ba3cdee69bbb5331cf7e43f3ade
.dll windows x86

1d9c139821b45c21e0a2b2296190acdf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LsaSetDomainInformationPolicy
SetThreadToken
InitializeSid
CryptDuplicateKey
LsaQueryDomainInformationPolicy
LookupAccountSidA
RegSaveKeyW
OpenSCManagerA
BuildExplicitAccessWithNameW
RegOpenKeyExW
CryptHashSessionKey
RegisterServiceCtrlHandlerW
GetServiceKeyNameW
CryptExportKey
AddAuditAccessAce
EnumServicesStatusW
GetAclInformation
LsaSetSecurityObject
LsaEnumerateAccountsWithUserRight
ChangeServiceConfigA
ConvertSecurityDescriptorToAccessNamedW
GetSidIdentifierAuthority
EnumDependentServicesW
IsTokenRestricted
RegDeleteValueA
StartServiceA
ConvertStringSidToSidW
SetServiceBits
ConvertStringSecurityDescriptorToSecurityDescriptorW
AreAnyAccessesGranted
ClearEventLogA
NotifyBootConfigStatus
TrusteeAccessToObjectW
LsaGetQuotasForAccount
SystemFunction026
ElfOpenEventLogW
LsaSetSystemAccessAccount
SystemFunction010
AllocateAndInitializeSid
GetTrusteeTypeA
QueryServiceObjectSecurity
ConvertStringSidToSidA
RegSaveKeyA
RegSetValueExA
SetEntriesInAuditListA
ElfReportEventW
RegUnLoadKeyA
GetNamedSecurityInfoExA
SetAclInformation
ConvertSidToStringSidA
LsaRetrievePrivateData
ObjectCloseAuditAlarmA
RegCreateKeyW
RemoveUsersFromEncryptedFile
RegFlushKey
LogonUserW
LsaSetQuotasForAccount
SetSecurityDescriptorDacl
OpenServiceW
CheckTokenMembership
ControlService
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetEffectiveRightsFromAclA
AccessCheckByTypeAndAuditAlarmA
LookupSecurityDescriptorPartsA
GetAuditedPermissionsFromAclW
CryptSignHashA
OpenEventLogW
ChangeServiceConfig2W
RegQueryValueExW
GetFileSecurityA
LsaGetRemoteUserName
SystemFunction028
AdjustTokenGroups
LogonUserA

comctl32

ImageList_Add
ImageList_GetDragImage
InitializeFlatSB
ord17
ImageList_DrawIndirect
ord16
ImageList_GetIconSize
ImageList_Destroy
ord2
ord13
ord8
InitCommonControlsEx
FlatSB_SetScrollInfo
ImageList_AddIcon
ord3
DestroyPropertySheetPage
ImageList_BeginDrag
ImageList_Remove
ImageList_GetImageRect
ImageList_EndDrag
ImageList_SetBkColor
PropertySheetA

gdi32

SelectClipRgn
OffsetClipRgn
GetRasterizerCaps
GetTextExtentPoint32W
RemoveFontMemResourceEx
GdiGetSpoolFileHandle
AngleArc
GdiGetDevmodeForPage
DescribePixelFormat
PolyBezierTo
CopyEnhMetaFileA
GetStockObject
SetPixelV
FillRgn
Polyline
SetColorAdjustment
GetTextExtentPointA
Polygon
GetCharWidthW
SetWinMetaFileBits

kernel32

VirtualAlloc
GetVersion
SetConsoleNumberOfCommandsW
SetConsoleInputExeNameW
VerLanguageNameW
ExitVDM
GetModuleHandleA
GetProcAddress
GetHandleInformation
VerLanguageNameA
LoadLibraryA
EnumResourceLanguagesA
VirtualProtectEx
IsValidLocale
CreateProcessW
lstrcpynA
WriteConsoleInputW
GetSystemTime
SetConsoleScreenBufferSize

shell32

RealShellExecuteW
SHGetInstanceExplorer
StrChrW
DoEnvironmentSubstW
WOWShellExecute
DuplicateIcon
ExtractIconExA
StrRChrIW
SHEmptyRecycleBinW
StrChrA
SHQueryRecycleBinA
StrRChrIA
Shell_NotifyIconW
StrStrIW
StrNCmpIW
SHFreeNameMappings
RealShellExecuteA
SHGetDataFromIDListA
StrCmpNIA
SHGetFileInfoA
StrRStrIA
StrNCmpA
ord180
StrRChrA
SHGetFileInfoW
ShellAboutW
Shell_NotifyIconA
SHFileOperationA
ShellExecuteW
SheGetDirA
SHGetMalloc
SHGetSpecialFolderPathA
ExtractAssociatedIconExW
ShellExecuteExA
DragQueryFileAorW
InternalExtractIconListA
StrStrIA
SheChangeDirExW
ShellHookProc
FindExecutableA
DoEnvironmentSubstA
StrRStrW
SHGetDataFromIDListW
SHGetDesktopFolder
StrCmpNA
RegenerateUserEnvironment
DragAcceptFiles
SHGetSpecialFolderPathW
StrNCmpIA
StrCmpNIW
SHChangeNotify
SHEmptyRecycleBinA
FreeIconList
ExtractAssociatedIconExA
ExtractIconExW
StrStrA

shlwapi

PathSearchAndQualifyA
SHRegCreateUSKeyA
SHRegQueryInfoUSKeyA
SHRegOpenUSKeyW
StrFromTimeIntervalW
SHDeleteValueW
StrIsIntlEqualA
PathIsDirectoryA
SHSetValueA
PathStripPathW
SHEnumValueA
PathIsUNCServerShareA
SHIsLowMemoryMachine
UrlHashA
StrToIntA
PathIsURLA
PathRemoveArgsA
SHRegOpenUSKeyA
PathCompactPathW
PathGetDriveNumberW
PathRemoveBackslashW
PathIsFileSpecW
SHQueryValueExW
PathFileExistsW
SHRegCreateUSKeyW
PathCreateFromUrlA
SHDeleteEmptyKeyA
PathCreateFromUrlW
PathCombineA
UrlIsOpaqueW
StrCSpnW
PathSearchAndQualifyW
UrlEscapeW
PathFindExtensionW
StrNCatA
PathIsContentTypeW
SHRegQueryUSValueW
UrlGetPartW
PathIsSameRootA
PathAddExtensionW
UrlCombineW
SHRegGetUSValueW
ChrCmpIA
PathRemoveExtensionA
PathIsPrefixW
PathFindOnPathA
PathUnquoteSpacesW
PathFindFileNameW
StrCSpnIA
PathUnquoteSpacesA
SHRegEnumUSKeyA
SHRegDeleteEmptyUSKeyW
SHGetInverseCMAP
SHEnumKeyExA
PathParseIconLocationW
StrFormatByteSizeA
StrDupW
PathIsRootA
PathBuildRootW
SHQueryInfoKeyA
SHRegEnumUSValueA
StrToIntW
PathRemoveExtensionW
PathAddBackslashA
StrCpyW
HashData

version

VerInstallFileA
VerQueryValueA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoA
VerFindFileA
VerInstallFileW
GetFileVersionInfoSizeW
VerFindFileW
GetFileVersionInfoSizeA

winmm

midiOutCachePatches
joyReleaseCapture
waveOutGetID
aux32Message
waveInStart
mciLoadCommandResource
mmioInstallIOProcA
mciDriverYield
OpenDriver
waveOutGetDevCapsA
mciGetDeviceIDA
waveOutGetVolume
waveOutPause
joyConfigChanged
waveOutClose
mmioSendMessage
timeBeginPeriod
mmioRenameA
midiInGetDevCapsA
waveInStop
mixerGetID
waveInGetDevCapsA
mmTaskCreate
midiInMessage
midiOutGetErrorTextW
joyGetThreshold
waveInGetPosition
waveInClose
waveOutGetPosition
DefDriverProc
mciGetDeviceIDFromElementIDW
mmioStringToFOURCCW
SendDriverMessage
midiOutCacheDrumPatches
auxSetVolume
waveInGetNumDevs

msvcrt

_mbsicmp
_mbsstr
_mbscmp
_mbsncat
fread
_setmode
feof
_wspawnvpe
__p__osver
__CxxFrameHandler
_wsystem
_wutime
fputc
strcmp
_mbsnset
_cprintf
_wstati64
_ismbblead
getwc
printf
_heapwalk
_mbsncpy
_unlink
fsetpos
scanf
fprintf
_atodbl
iswctype
_mbctombb
_wfindnext
ferror
_scalb
sprintf
_isctype
wcsncat
iswprint
exit
_mbsrchr
_pwctype
_ltoa
__iscsym
atoi
_wopen
fopen
_ismbstrail
fclose
_wfsopen
__argc
memset
_futime
_adj_fdivr_m32i
_mbsnbcat
__p__pctype
_utime
_ltow
strlen
_cexit
cos
_mbsspn
isleadbyte
_hypot
_errno
_mbscat
_heapchk
fwrite
_wtmpnam
ftell
fseek
_execl
fputs
isalnum
fwprintf
ceil

Exports

Exports

XMBTFSUL

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d9c139821b45c21e0a2b2296190acdf

Headers

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

shell32

shlwapi

version

winmm

msvcrt

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 52KB - Virtual size: 50KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 52KB - Virtual size: 50KB

.reloc
Size: 4KB - Virtual size: 3KB