96486fa4ec678b9114abc5486b131c3b6a93e13274db998df9544284bcbf3eb2

Sharing

Copy URL Twitter E-mail

General

Target

96486fa4ec678b9114abc5486b131c3b6a93e13274db998df9544284bcbf3eb2
Size

201KB
MD5

07381a79457aaadfe9d18de1d56a7ce0
SHA1

489024534bf01ee1ec6d0970a787e95c1ff367ae
SHA256

96486fa4ec678b9114abc5486b131c3b6a93e13274db998df9544284bcbf3eb2
SHA512

2b15f933e3207ade162793021786f8d4813178ea3331070e6dca2155be8da864f96f53b6acbd783e6f6def67fed06fef9d99cedbfbcda63dd5fa4625326b5be4
SSDEEP

6144:L17qqDLSpnEpNJbAyXYf9OwTxDfEr3PWFSX2taoZ:L12qnSp4D9XY3EjJ2EoZ

Score

N/A

Malware Config

Signatures

Files

96486fa4ec678b9114abc5486b131c3b6a93e13274db998df9544284bcbf3eb2
.exe windows x86

90b4a19d61e0b6e20ba4a7531ad987a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
LoadLibraryA
RemoveDirectoryW
QueryDosDeviceW
lstrcmpiW
FindNextFileW
VirtualProtect
CreateToolhelp32Snapshot
GetFileTime
ReleaseMutex
FileTimeToLocalFileTime
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetFileInformationByHandle
LocalFree
GetSystemTime
WriteProcessMemory
SetFileAttributesW
CreateThread
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitProcess
lstrcmpiA
WTSGetActiveConsoleSessionId
GetThreadContext
Thread32Next
GetProcessId
GetFileAttributesExW
GetNativeSystemInfo
GetVersionExW
VirtualAllocEx
GetModuleFileNameW
GetUserDefaultUILanguage
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleA
CreateRemoteThread
Process32FirstW
Process32NextW
TlsGetValue
TlsSetValue
TerminateProcess
ResetEvent
GetCommandLineW
SetErrorMode
GetComputerNameW
OpenEventW
DuplicateHandle
GetCurrentProcessId
SetHandleInformation
CreatePipe
GlobalLock
GlobalUnlock
lstrcpynW
HeapCreate
HeapDestroy
ReadProcessMemory
Sleep
LoadLibraryW
VirtualFreeEx
WideCharToMultiByte
VirtualProtectEx
VirtualAlloc
GetProcAddress
SetLastError
GetLastError
OpenMutexW
GetFileSizeEx
GetTempPathW
FlushFileBuffers
lstrlenW
MultiByteToWideChar
CreateFileW
GetTimeZoneInformation
MoveFileExW
ReadFile
Thread32First
OpenProcess
WriteFile
VirtualQueryEx
SetFileTime
IsBadReadPtr
GetProcessHeap
VirtualFree
GetModuleHandleW
CreateDirectoryW
HeapFree
GetLogicalDriveStringsW
SetFilePointerEx
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
CreateProcessW
FreeLibrary
SetEndOfFile
FindFirstFileW
CreateMutexW
HeapReAlloc
GetTempFileNameW
FileTimeToDosDateTime
GetEnvironmentVariableW
GetFileAttributesW
WaitForMultipleObjects
GetLocalTime
ExitThread
GetTickCount
TlsFree
CloseHandle
TlsAlloc
GetCurrentThreadId
CreateEventW
CreateFileMappingW
SetThreadPriority
GetCurrentThread
SetEvent
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
SetThreadContext

user32

SetWindowPos
GetCursorPos
IsWindow
ReleaseCapture
MapWindowPoints
GetMessagePos
IsRectEmpty
CharLowerW
GetTopWindow
LoadImageW
MsgWaitForMultipleObjects
WindowFromPoint
CharToOemW
TranslateMessage
GetWindowLongW
PeekMessageA
PeekMessageW
CharUpperW
SetWindowLongW
SendMessageTimeoutW
GetWindow
DispatchMessageW
RegisterClassExA
RegisterWindowMessageW
GetThreadDesktop
EqualRect
SetKeyboardState
GetSubMenu
DefDlgProcW
DefFrameProcA
OpenInputDesktop
OpenDesktopW
GetAncestor
SetCursorPos
GetCapture
GetClassLongW
GetWindowInfo
GetSystemMetrics
CreateDesktopW
SetProcessWindowStation
CloseWindowStation
CreateWindowStationW
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenWindowStationW
GetKeyboardState
ToUnicode
CharLowerBuffA
ExitWindowsEx
GetKeyboardLayoutList
GetClipboardData
DrawIcon
GetIconInfo
MapVirtualKeyW
EndPaint
GetUpdateRgn
GetWindowDC
FillRect
BeginPaint
DrawEdge
GetUpdateRect
IntersectRect
GetDCEx
MenuItemFromPoint
GetDC
GetMenu
PrintWindow
MessageBoxA
GetMessageA
GetWindowRect
GetMessageW
SetCapture
RegisterClassExW
GetMenuItemRect
TrackPopupMenuEx
SystemParametersInfoW
GetClassNameW
ReleaseDC
GetMenuState
DefWindowProcA
DefMDIChildProcW
SwitchDesktop
GetMenuItemCount
DefDlgProcA
PostThreadMessageW
DefMDIChildProcA
HiliteMenuItem
RegisterClassW
GetUserObjectInformationW
SendMessageW
PostMessageW
GetMenuItemID
GetParent
CallWindowProcA
EndMenu
CallWindowProcW
DefWindowProcW
DefFrameProcW
GetWindowThreadProcessId
RegisterClassA
GetShellWindow
CharLowerA

advapi32

CryptGetHashParam
OpenProcessToken
GetSidSubAuthority
CryptAcquireContextW
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
RegCreateKeyExW
CryptReleaseContext
RegQueryValueExW
CreateProcessAsUserW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
LookupPrivilegeValueW
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
CryptDestroyHash
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
CryptHashData
EqualSid
CreateProcessAsUserA
ConvertSidToStringSidW
GetLengthSid
RegEnumKeyExW
RegCreateKeyW
RegEnumKeyW
RegQueryInfoKeyW
IsWellKnownSid
SetSecurityInfo
InitiateSystemShutdownExW
RegDeleteValueW
RegEnumValueW

shlwapi

PathMatchSpecW
PathQuoteSpacesW
PathIsURLW
StrStrIW
StrStrIA
PathRenameExtensionW
StrCmpNIW
wvnsprintfA
StrCmpNIA
UrlUnescapeA
PathRemoveBackslashW
PathUnquoteSpacesW
PathAddExtensionW
PathCombineW
SHDeleteKeyW
PathSkipRootW
SHDeleteValueW
PathAddBackslashW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
wvnsprintfW

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

secur32

GetUserNameExW

ole32

CoSetProxyBlanket
CoUninitialize
CLSIDFromString
StringFromGUID2
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoCreateInstance

gdi32

CreateCompatibleBitmap
SelectObject
DeleteObject
GetDeviceCaps
DeleteDC
GetDIBits
CreateDIBSection
RestoreDC
SaveDC
SetRectRgn
GdiFlush
SetViewportOrgEx
CreateCompatibleDC

ws2_32

listen
send
closesocket
WSASetLastError
freeaddrinfo
socket
bind
recv
inet_addr
getpeername
recvfrom
sendto
WSASend
gethostbyname
WSAIoctl
WSAEventSelect
getsockname
accept
setsockopt
shutdown
WSAGetLastError
select
getaddrinfo
WSAStartup
WSAAddressToStringW
connect

crypt32

CryptUnprotectData
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertCloseStore
CertOpenSystemStoreW
CertDeleteCertificateFromStore

wininet

InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
HttpAddRequestHeadersW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpEndRequestW
HttpEndRequestA
InternetSetFilePointer
HttpOpenRequestW
HttpSendRequestW
InternetReadFileExA
InternetQueryDataAvailable
HttpSendRequestExW
HttpSendRequestExA
HttpAddRequestHeadersA
InternetSetStatusCallbackA
InternetCrackUrlA
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetQueryOptionW
InternetOpenA

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

netapi32

NetUserEnum
NetApiBufferFree
NetUserGetInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

waveOutGetVolume
PlaySoundA
PlaySoundW
waveOutSetVolume

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90b4a19d61e0b6e20ba4a7531ad987a8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

version

winmm

Sections

.text Size: 189KB - Virtual size: 189KB

.data Size: 2KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 189KB - Virtual size: 189KB

.data
Size: 2KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 7KB