a43a3474057248178bf386a1109cf582a1b57a8dbaed96d7ac1dbfba6296eea0

Sharing

Copy URL Twitter E-mail

General

Target

a43a3474057248178bf386a1109cf582a1b57a8dbaed96d7ac1dbfba6296eea0
Size

156KB
MD5

9b9cd75c893ae9d0863553703605a9fe
SHA1

a2c6b9f68db294b0ed51fcca539b2b4acafff729
SHA256

a43a3474057248178bf386a1109cf582a1b57a8dbaed96d7ac1dbfba6296eea0
SHA512

092d43401c51be72ddd250fe4e398bcb97759cc66b0aeb7622a78c8d15bc29d0f325256d1e0e69479c6c8c56e966e68b331cf1fbb7558cc9276694dd5fcc4649
SSDEEP

3072:gOEhF41OtLHNsRVA0X61PsmiDVPXqR8iGUXe59vlbgtB:5OtpsRG0X6PPYV+89Uu5llo

Score

N/A

Malware Config

Signatures

Files

a43a3474057248178bf386a1109cf582a1b57a8dbaed96d7ac1dbfba6296eea0
.dll windows x86

b3f942a7c8020c5da928ecdf9c8a2875

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
_CxxThrowException
putc
vfprintf
exit
rewind
fputc
_stricmp
_itoa
_strlwr
strlen
_strnicmp
fseek
ftell
_mbsicmp
_mbsnbcmp
memset
malloc
strchr
strncpy
_adjust_fdiv
_initterm
_onexit
__dllonexit
strncmp
_iob
fprintf
printf
sscanf
realloc
_except_handler3
time
srand
isalpha
isdigit
wcslen
memcpy
atoi
??2@YAPAXI@Z
calloc
??3@YAXPAX@Z
wcscmp
_mbsstr
memmove
_mbsnbicmp
_EH_prolog
strstr
strcat
free
strrchr
strcmp
strcpy
sprintf
__CxxFrameHandler
fwrite
fopen
fread
fclose
rand
strncat

kernel32

GetFileSize
CreateFileA
GetModuleFileNameA
GetModuleHandleA
lstrcmpA
GetProcAddress
LoadLibraryA
LocalFree
LocalAlloc
SetFileTime
WriteFile
SetFilePointer
GetSystemDirectoryA
WideCharToMultiByte
MultiByteToWideChar
ReadFile
Thread32First
CreateToolhelp32Snapshot
GetCurrentProcessId
ExitThread
CreateThread
GetTickCount
GetTempPathW
ResetEvent
WaitForSingleObject
FreeLibrary
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
SetEvent
GetCurrentProcess
CloseHandle
DeleteFileA
GetFileTime
Sleep
FindNextFileA
FindClose
FindFirstFileA
GetDriveTypeA
GetLogicalDrives
SetEndOfFile
SetFileAttributesA
GetTempPathA
QueryPerformanceCounter
CreateEventA
GetSystemTime
lstrcmpiA
GetVersionExA
GetLocaleInfoA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
SetNamedPipeHandleState
WaitNamedPipeW
FlushFileBuffers
CreateFileW
CreateProcessW
GetModuleFileNameW
GetLastError
GetCurrentThread
TlsSetValue
TlsAlloc
TlsFree
HeapFree
HeapAlloc
GetProcessHeap
TerminateThread
lstrlenA
lstrcatA
lstrcpyA
MoveFileA
Thread32Next
RaiseException
InterlockedExchange
SetLastError
VirtualAlloc
SuspendThread
SetThreadContext
GetThreadContext
FlushInstructionCache
ResumeThread
VirtualProtect
InterlockedCompareExchange
VirtualQuery

user32

IsWindowVisible
EnumThreadWindows
wsprintfW
KillTimer
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowThreadProcessId
CallNextHookEx
SendMessageTimeoutA
RegisterWindowMessageA
ScreenToClient
GetCursorPos
ToAsciiEx
GetKeyboardLayout
GetKeyboardState
GetAncestor
GetForegroundWindow
DrawTextW
wsprintfA
DrawTextA
DispatchMessageA
TranslateMessage
GetMessageA
FillRect
ReleaseDC
GetDC
ExitWindowsEx
SendMessageA
EnumChildWindows
GetClassNameA
GetSystemMetrics
SetTimer
AttachThreadInput
WindowFromPoint

gdi32

CreateSolidBrush
CreateFontIndirectA
CreateCompatibleDC
SetTextColor
SetBkColor
CreateCompatibleBitmap
DeleteDC
SelectObject
BitBlt
DeleteObject

advapi32

IsTextUnicode
RegQueryValueExA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegFlushKey
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegDeleteValueA
RegDeleteKeyA
CryptGetProvParam
RegEnumValueW
RegCloseKey

ole32

CoInitialize
CLSIDFromString
CoUninitialize

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
VariantCopy
SysFreeString
SysStringLen
GetErrorInfo
SysAllocString

secur32

EncryptMessage
DecryptMessage

ws2_32

WSAWaitForMultipleEvents
WSAEnumNetworkEvents
getsockname
WSAGetLastError
getpeername
gethostbyaddr
WSASend
send
select
recv
WSAStartup
gethostbyname
htons
socket
WSAEventSelect
connect
WSAIoctl
inet_ntoa
WSACreateEvent
closesocket

wininet

InternetSetStatusCallback
HttpSendRequestExA
InternetQueryDataAvailable
HttpSendRequestA
HttpSendRequestW
HttpOpenRequestA
InternetOpenUrlA
InternetReadFileExA
InternetWriteFile
InternetReadFile
InternetConnectA
GetUrlCacheEntryInfoA
InternetCloseHandle
InternetQueryOptionA

crypt32

CertDeleteCertificateFromStore
CertGetNameStringA
CertStrToNameA
CertCreateSelfSignCertificate
CertOpenStore
CertAddCertificateContextToStore
PFXExportCertStoreEx
CryptMemFree
CertFreeCertificateContext
PFXImportCertStore
CertEnumCertificatesInStore
CryptAcquireCertificatePrivateKey
CertCloseStore
CryptMemAlloc

Exports

Exports

NullExport

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 354KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3f942a7c8020c5da928ecdf9c8a2875

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

ole32

oleaut32

secur32

ws2_32

wininet

crypt32

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 115KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 9KB - Virtual size: 354KB

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 116KB - Virtual size: 115KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 9KB - Virtual size: 354KB

.reloc
Size: 14KB - Virtual size: 13KB