9ca04205791efbe39c25a04d40ed25796b9f4bf28375a18f4e9fa2395b9ddd7a

Sharing

Copy URL Twitter E-mail

General

Target

9ca04205791efbe39c25a04d40ed25796b9f4bf28375a18f4e9fa2395b9ddd7a
Size

462KB
MD5

d50cf5ea4f0a24b259679deb34484690
SHA1

fa9bccc30a8f823bc1f234c682a67902aec34857
SHA256

9ca04205791efbe39c25a04d40ed25796b9f4bf28375a18f4e9fa2395b9ddd7a
SHA512

902bcbca87db7012da6b2b0ec5598e0c8ca615baacebc44ee28156e59b6d4a4d34dca71060442138bd2223d2bc2dd9b3dbf490d82b9cf8d8841e9458962a6c69
SSDEEP

6144:edWwqej/oytm1r7LcwmIsez6pGil26DQL8dKXVYMWSPxxflxvyd/L204gL0qlmvB:gWhej/bt8DcnOclmCTfB2sV2zosr

Score

N/A

Malware Config

Signatures

Files

9ca04205791efbe39c25a04d40ed25796b9f4bf28375a18f4e9fa2395b9ddd7a
.dll windows x86

b70f9347f634d408194f6612f8b7ece6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AddAuditAccessAceEx
AllocateAndInitializeSid
ControlService
CryptGetUserKey
DestroyPrivateObjectSecurity
EqualSid
GetSidIdentifierAuthority
GetSidLengthRequired
GetTokenInformation
LookupPrivilegeValueA
LsaCreateTrustedDomain
LsaGetSystemAccessAccount
NotifyBootConfigStatus
OpenProcessToken
OpenServiceA
QueryServiceStatus
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
SetThreadToken
SystemFunction001
SystemFunction030

kernel32

CloseHandle
ContinueDebugEvent
CopyFileA
CreateProcessA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommConfig
GetCommState
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessPriorityBoost
GetStartupInfoA
GetSystemDirectoryA
GetTickCount
GetVersionExA
GetWindowsDirectoryA
Heap32First
LoadLibraryA
LoadModule
LocalFileTimeToFileTime
QueryPerformanceCounter
ReadFile
SetLastError
SetTapePosition
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
VerSetConditionMask
VirtualAlloc
WaitForSingleObject
lstrlenA

msvcrt

strncpy
strcspn
sqrt
sprintf
getchar
exp
exit
_strupr
_strnicmp
_setmbcp
_scalb
_onexit
_initterm
_exit
_except_handler3
_controlfp
_cexit
_c_exit
_adjust_fdiv
__setusermatherr
__set_app_type
__p__fmode
__p__commode
__p__amblksiz
__p___wargv
__getmainargs
__dllonexit
__CxxFrameHandler
_XcptFilter
strstr
_CIexp

shell32

SHGetFolderPathW
ShellExecuteW

user32

SetForegroundWindow
SendMessageA
ScrollWindowEx
PtInRect
PostMessageA
PeekMessageA
MessageBoxA
LoadIconA
IsWindow
GetWindowRect
SetThreadDesktop
FillRect
ExitWindowsEx
ExcludeUpdateRgn
EnumWindows
EnumThreadWindows
EnableWindow
DrawIcon
DispatchMessageA
CheckRadioButton
BlockInput
AdjustWindowRect
ShowScrollBar
FrameRect
TranslateMessage

Exports

Exports

ASTFromFile
AsString
ClearFreeList
ReleaseThread
create_info_struct
set_shift
vSetTargetPathA

Sections

.text
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b70f9347f634d408194f6612f8b7ece6

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

shell32

user32

Exports

Exports

Sections

.text Size: 125KB - Virtual size: 125KB

.rdata Size: 206KB - Virtual size: 205KB

.data Size: 108KB - Virtual size: 111KB

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 125KB - Virtual size: 125KB

.rdata
Size: 206KB - Virtual size: 205KB

.data
Size: 108KB - Virtual size: 111KB

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 6KB - Virtual size: 6KB