ad646a91ecad5fc433772660795913e6c4246f7f94e45f1a6ac6475e90e8fac3

Sharing

Copy URL Twitter E-mail

General

Target

ad646a91ecad5fc433772660795913e6c4246f7f94e45f1a6ac6475e90e8fac3
Size

137KB
MD5

73ef41eecb94fe4773168dbad6c240f0
SHA1

69f1e3fe0495be8aa1576ffd2f3f508e0792d9d0
SHA256

ad646a91ecad5fc433772660795913e6c4246f7f94e45f1a6ac6475e90e8fac3
SHA512

cbe86b84c87c45b3c1e0a25206da6bf02e488234e460669af2f032209f9b2d24389871c188e3b9c4508b8fe17588341501aaa068a26a5f5871cc9d0687191124
SSDEEP

3072:s+72oVUOW4sjYhCMjYdrvvcaKgCPdCwMbEd7SeGA7aHYcCqao/9VQ9:s+72oVUN4scIjbKgTzod7SeGA7aHYWVQ

Score

N/A

Malware Config

Signatures

Files

ad646a91ecad5fc433772660795913e6c4246f7f94e45f1a6ac6475e90e8fac3
.exe windows x86

fe7ec7524cc851585c694c3ad05031e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetEnvironmentVariableW
FileTimeToDosDateTime
GetTempFileNameW
HeapReAlloc
CreateMutexW
FindFirstFileW
SetEndOfFile
CreateProcessW
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
HeapFree
GetProcessHeap
IsBadReadPtr
SetFileTime
VirtualQueryEx
OpenProcess
Thread32First
WideCharToMultiByte
ReadProcessMemory
HeapDestroy
HeapCreate
Thread32Next
ReadFile
GetLocalTime
GlobalUnlock
GetTempPathW
GetFileSizeEx
OpenMutexW
VirtualProtectEx
VirtualAllocEx
FindClose
RemoveDirectoryW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
TlsAlloc
TlsFree
GetNativeSystemInfo
CreateRemoteThread
Process32FirstW
Process32NextW
SetFileAttributesW
WTSGetActiveConsoleSessionId
GlobalLock
WriteProcessMemory
GetCurrentProcessId
DuplicateHandle
OpenEventW
WaitForMultipleObjects
CreateEventW
GetVersionExW
VirtualFree
lstrcmpiA
Sleep
GetComputerNameW
SetErrorMode
GetCommandLineW
LoadLibraryA
GetFileAttributesExW
GetProcessId
VirtualAlloc
VirtualFreeEx
SetThreadContext
GetThreadContext
LocalFree
GetUserDefaultUILanguage
GetModuleFileNameW
MoveFileExW
MultiByteToWideChar
CreateThread
LoadLibraryW
CreateDirectoryW
FreeLibrary
ExitProcess
GetCurrentThreadId
SetLastError
GetTickCount
GetSystemTime
CloseHandle
EnterCriticalSection
GetProcAddress
GetPrivateProfileIntW
FlushFileBuffers
CreateFileW
GetFileAttributesW
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
GetModuleHandleW
ReleaseMutex
ResetEvent
SetThreadPriority
TerminateProcess
TlsSetValue
GetCurrentThread
SetEvent
WaitForSingleObject
TlsGetValue
ExpandEnvironmentStringsW
GetTimeZoneInformation
lstrcmpiW

user32

GetClipboardData
ToUnicode
DrawIcon
GetIconInfo
MapVirtualKeyW
CharLowerBuffA
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
OpenDesktopW
CloseDesktop
SetThreadDesktop
GetUserObjectInformationW
OpenWindowStationW
GetKeyboardState
GetMessageA
GetWindowRect
SetCapture
GetParent
GetClassLongW
GetCapture
SetCursorPos
CallWindowProcA
GetAncestor
PeekMessageW
PeekMessageA
SetWindowPos
GetCursorPos
RegisterClassExA
RegisterWindowMessageW
RegisterClassW
GetMenuItemID
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
MenuItemFromPoint
GetMenu
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
DefMDIChildProcA
EndMenu
CallWindowProcW
DispatchMessageW
DefFrameProcW
HiliteMenuItem
CharToOemW
RegisterClassA
TranslateMessage
GetTopWindow
ExitWindowsEx
IsRectEmpty
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharLowerA
SendMessageTimeoutW
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
GetWindowThreadProcessId
CharLowerW
GetSystemMetrics
EndPaint
GetUpdateRgn
GetMessageW
GetWindowDC
FillRect
PostMessageW
GetWindowInfo
DrawEdge
BeginPaint
GetUpdateRect
CharUpperW
SetWindowLongW
GetWindow
GetWindowLongW
DefWindowProcW
SendMessageW
PrintWindow
EqualRect
PostThreadMessageW
ReleaseDC
GetDCEx
IntersectRect
GetDC
GetShellWindow

advapi32

InitiateSystemShutdownExW
EqualSid
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
IsWellKnownSid
GetLengthSid
CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegSetValueExW
CryptHashData
ConvertSidToStringSidW

shlwapi

PathRenameExtensionW
PathRemoveFileSpecW
PathQuoteSpacesW
wvnsprintfA
StrCmpNIA
PathMatchSpecW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW
UrlUnescapeA
PathRemoveBackslashW
StrStrIW
StrStrIA
StrCmpNIW
PathIsURLW

shell32

SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW

secur32

GetUserNameExW

ole32

StringFromGUID2
CLSIDFromString
CoUninitialize
CoCreateInstance
CoInitializeEx

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDIBSection
SetViewportOrgEx
DeleteDC
GdiFlush
DeleteObject
SelectObject
SetRectRgn
CreateCompatibleDC
GetDeviceCaps
RestoreDC
SaveDC

ws2_32

accept
getsockname
WSAEventSelect
freeaddrinfo
recv
sendto
select
getaddrinfo
recvfrom
WSAIoctl
connect
WSAAddressToStringW
WSAStartup
shutdown
setsockopt
bind
socket
WSASetLastError
listen
getpeername
WSASend
closesocket
send
WSAGetLastError

crypt32

PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore
CryptUnprotectData

wininet

InternetQueryOptionA
InternetSetOptionA
InternetQueryOptionW
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpSendRequestW
InternetReadFile
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe7ec7524cc851585c694c3ad05031e4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

Sections

.text Size: 129KB - Virtual size: 129KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 129KB - Virtual size: 129KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB