c5c649d4ba9aca4f348ad1d87216b02fae16c483b824aa8402932f2ad0184d85

Sharing

Copy URL Twitter E-mail

General

Target

c5c649d4ba9aca4f348ad1d87216b02fae16c483b824aa8402932f2ad0184d85
Size

607KB
MD5

a3269e92c6349e4b49faa4eff24086a8
SHA1

26bc05a3bd89a81eeff5157eb98902f139624fe8
SHA256

c5c649d4ba9aca4f348ad1d87216b02fae16c483b824aa8402932f2ad0184d85
SHA512

a3449b9b80ec74f764f83956814c54b23abfe62aec42f6eb144591bcbd37e5706d5ba5810ddc518971f5adff8eb5c3eb8d765f5ac9330a18a4cd5ba3da2c921a
SSDEEP

12288:tIOI1MusbOqzDxTyyfL844ZH+Dtr5csTE04:tIJ1MHiqvxWk+AA04

Score

N/A

Malware Config

Signatures

Files

c5c649d4ba9aca4f348ad1d87216b02fae16c483b824aa8402932f2ad0184d85
.exe windows x86

b7f8fd34a985a509f8f218cb5c1ba3fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegisterTraceGuidsW
RegOpenKeyExW
UnregisterTraceGuids
RegSetValueExW
TraceEvent
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
RegDeleteValueW
GetTraceEnableFlags
RegEnumValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
EncryptFileW
DecryptFileW
RegQueryValueExW

kernel32

LeaveCriticalSection
lstrlenW
HeapSetInformation
SizeofResource
LoadResource
RaiseException
FindResourceW
GetModuleHandleW
InterlockedIncrement
LoadLibraryExW
GetProcAddress
InterlockedDecrement
EnterCriticalSection
InitializeCriticalSection
GetModuleFileNameW
lstrcmpiW
MultiByteToWideChar
TryEnterCriticalSection
FindResourceExW
GetFileAttributesExW
LocalFree
FormatMessageW
GetProcessAffinityMask
GetFullPathNameW
GetCurrentProcess
QueryPerformanceFrequency
CloseHandle
GetCurrentThread
SetThreadAffinityMask
CreateEventW
SetEvent
Sleep
QueryPerformanceCounter
LockResource
FreeLibrary
GetLastError
GetStartupInfoW
InterlockedCompareExchange
GetVersionExA
CreateThread
GetVersionExW
CompareStringW
LocalAlloc
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SystemTimeToFileTime
GetSystemTime
GetCurrentProcessId
DeleteCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersion
GetFileAttributesW
GetModuleHandleA
GetExitCodeThread
GetSystemTimeAsFileTime
WaitForSingleObject
OutputDebugStringA
LoadLibraryW
SetLastError
ResetEvent
FlushInstructionCache
CreateProcessW
ExpandEnvironmentStringsW
IsWow64Process
DeleteFileW
CreateFileW
GetTempFileNameW
GetTempPathW
SetFileAttributesW
MoveFileExW
LoadLibraryA
BackupRead
BackupSeek
ReadFile
WriteFile
GetFileTime
GetProcessHeap
HeapFree
GetCurrentThreadId
GetTickCount
SetFileTime
DeviceIoControl
FindClose
RemoveDirectoryW

gdi32

DeleteObject

user32

DestroyWindow
RegisterClassExW
GetClassInfoExW
LoadCursorW
CharNextW
DestroyIcon
DispatchMessageW
PeekMessageW
LoadImageW
MessageBoxW
GetSystemMetrics
SetWindowLongW
MsgWaitForMultipleObjects
GetActiveWindow
CallWindowProcW
UnregisterClassA
GetWindowLongW
PostMessageW
DefWindowProcW
IsWindow
CreateWindowExW
SendMessageW
TranslateMessage

msvcr80

wcsrchr
swscanf_s
wcsstr
swprintf_s
_beginthreadex
_wcslwr_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
_CxxThrowException
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_cexit
__wgetmainargs
_amsg_exit
memset
_wutime32
calloc
_vscwprintf
vswprintf_s
memmove_s
free
memcpy_s
_purecall
malloc
memmove
_recalloc
wcsncpy_s
_vsnwprintf
wcstok_s
__CxxFrameHandler3
memcpy
_exit

shell32

SHCreateShellItem
ord75
ord155
SHBindToParent
CommandLineToArgvW
SHParseDisplayName

ole32

OleUninitialize
CoTaskMemRealloc
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoInitialize
CoUninitialize
PropVariantClear
CLSIDFromString

oleaut32

SysAllocString
VarUI4FromStr
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysStringLen

gdiplus

GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipDisposeImage
GdipCloneBitmapAreaI
GdipFree

shlwapi

PathFindFileNameW
SHRegEnumUSValueW
AssocQueryStringW
SHRegGetUSValueW
SHRegOpenUSKeyW
SHRegCloseUSKey
AssocGetPerceivedType
StrStrW
PathIsDirectoryEmptyW
ord158
UrlUnescapeW
SHStrDupW
PathRemoveFileSpecW
PathIsFileSpecW
PathFileExistsW
PathIsRelativeW
PathFindExtensionW
PathRenameExtensionW

wlxphotobase

?Delete@BasePrivate@@YAXPAX@Z
??1Exception@Base@@UAE@XZ
?New@BasePrivate@@YAPAXI_N@Z
?Throw@Base@@YGXJ@Z
?IsVistaOrGreater@OS@Base@@YG_NXZ
?ThrowLastError@Base@@YGXXZ
?GetBaseStringManager@String@Base@@SGAAVCAtlStringMgr@ATL@@XZ
?BaseAtlThrow@ATL@@YGXJ@Z

wlxphotosqm

?AddToStream@Sqm@@YGXKPBVTuple@1@@Z
?Startup@Sqm@@YGXXZ
?Shutdown@Sqm@@YGXXZ

metadatasys

WLXPSGetItemPropertyHandler

msi

ord90

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 403KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ddata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b7f8fd34a985a509f8f218cb5c1ba3fc

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcr80

shell32

ole32

oleaut32

gdiplus

shlwapi

wlxphotobase

wlxphotosqm

metadatasys

msi

Sections

.text Size: 111KB - Virtual size: 110KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 403KB - Virtual size: 404KB

.reloc Size: 11KB - Virtual size: 10KB

.ddata Size: 72KB - Virtual size: 72KB

.text
Size: 111KB - Virtual size: 110KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 403KB - Virtual size: 404KB

.reloc
Size: 11KB - Virtual size: 10KB

.ddata
Size: 72KB - Virtual size: 72KB