6d40a89f97ce540d7cca6c05d0fa976a3258f86a182817f1a80264f76f8be4ef

Sharing

Copy URL Twitter E-mail

General

Target

6d40a89f97ce540d7cca6c05d0fa976a3258f86a182817f1a80264f76f8be4ef
Size

63KB
MD5

1cf3af820998954fd174b0a3507ea503
SHA1

ca9f133b8bbcc82126a193b95574a7328e366a39
SHA256

6d40a89f97ce540d7cca6c05d0fa976a3258f86a182817f1a80264f76f8be4ef
SHA512

5e8a2fcee5c9eae1374509ee553943d6645e98b89cc6b991e51af35c776ca0dc34ccc53cbae7c4b4e132157cb9fef27d246b7d50bed7fe53be2ef4209db9cb15
SSDEEP

1536:BsCBUiHnaPMypgiTIS91+3v09TNRZB3MFPOIoswPaCZnMbQxVv:BsXi60CTISH+3v09TNRZB3MFPOIZOh5t

Score

N/A

Malware Config

Signatures

Files

6d40a89f97ce540d7cca6c05d0fa976a3258f86a182817f1a80264f76f8be4ef
.exe windows x86

64580560bf7ba8f01fe51aa9fc57ff12

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
VirtualAlloc
WriteFile
CloseHandle
GetCompressedFileSizeA
lstrlenA
AddConsoleAliasA
GetFileAttributesW
GetConsoleTitleA
GetCurrentThread
ReadFile
CreateFileA
CopyFileA
lstrlenW
GetCurrentProcess
GetConsoleWindow
GetACP
lstrcmpA
lstrcmpW
GetLocalTime
AddAtomA
GetCommandLineA
VirtualFree
GetVersion
GetCurrentThreadId
GetCompressedFileSizeW
GetStartupInfoW
GetFileAttributesA
GetCurrentProcessId
AddConsoleAliasW
GetConsoleTitleW
GetSystemTime

scrobj

DllRegisterServerEx
DllRegisterServer
DllRegisterServerExA
DllInstall
DllUnregisterServerEx
GenerateTypeLib
DllGetClassObject
DllUnregisterServer
DllRegisterServerExW
DllCanUnloadNow
GenerateTypeLibW

sqlwid

strerror_
wstrlen
_lopen_
OpenFile_
_hwrite_
_lwrite_
GetProcAddress_

iashlpr

MemFreeIas
MemAllocIas
DllRegisterServer
DllGetClassObject
ShutdownIas
ConfigureIas
AllocateAttributes
DllUnregisterServer
FreeAttributes
DllCanUnloadNow
InitializeIas
DoRequest
MemReallocIas

d3d8thk

OsThunkDdGetDriverState
OsThunkD3dContextDestroyAll
OsThunkDdGetAvailDriverMemory
OsThunkDdWaitForVerticalBlank
OsThunkDdColorControl
OsThunkDdDeleteSurfaceObject
OsThunkDdSetOverlayPosition
OsThunkDdSetColorKey
OsThunkDdGetBltStatus
OsThunkDdGetDC
OsThunkDdUnlockD3D
OsThunkDdFlip
OsThunkDdAlphaBlt
OsThunkDdReleaseDC
OsThunkD3dContextDestroy
OsThunkDdQueryDirectDrawObject
OsThunkDdCreateD3DBuffer
OsThunkDdDeleteDirectDrawObject
OsThunkD3dValidateTextureStageState
OsThunkDdQueryMoCompStatus
OsThunkDdGetMoCompFormats
OsThunkDdBlt
OsThunkD3dContextCreate
OsThunkDdSetGammaRamp
OsThunkDdCanCreateD3DBuffer
OsThunkDdUpdateOverlay
OsThunkDdGetScanLine
OsThunkDdEndMoCompFrame
OsThunkDdCreateSurface
OsThunkDdCreateDirectDrawObject

user32

GetWindowTextA
DdeKeepStringHandle
PeekMessageA
wvsprintfW
GetDesktopWindow
GetClientRect
EnableScrollBar
SetLastErrorEx
FindWindowA
GetTopWindow
EnumPropsExW
GetForegroundWindow
GetWindowTextW
DlgDirSelectComboBoxExW
LoadCursorFromFileW
SetRectEmpty
GetWindowRect
FindWindowW
CallWindowProcA
DrawCaptionTempA

iassvcs

IASRegisterComponent
IASAllocateUniqueID
DllUnregisterServer
IASSetMaxNumberOfThreads
IASInitialize
IASVariantChangeType
IASReportEvent
DllRegisterServer
DllCanUnloadNow
DllGetClassObject
IASRequestThread
IASUninitialize

dsuiext

DsBrowseForContainerW
DllUnregisterServer
DllGetClassObject
DllRegisterServer
DsGetFriendlyClassName
DllInstall
DllCanUnloadNow
DsGetIcon
DsBrowseForContainerA

mapistub

BMAPIGetReadMail
BMAPISaveMail
FBadRglpNameID@8
PropCopyMore@16
FBadRglpszA@8
ScUNCFromLocalPath@12
FBadRglpszW@8
MNLS_CompareStringW@24
MAPIAdminProfiles
IsBadBoundedStringPtr@8
FixMAPI
CbOfEncoded@4
OpenTnefStreamEx@32
MAPIDetails
FtAdcFt@20
HrSetOmiProvidersFlagsInvalid
MapStorageSCode@4
cmc_logoff
cmc_send_documents
MNLS_lstrcpyW@8
GetAttribIMsgOnIStg@12
MAPIAllocateMore
HrIStorageFromStream@16
HrAddColumnsEx@20
BMAPIFindNext
BMAPIDetails
SzFindCh@8
OpenStreamOnFile

wshtcpip

WSHStringToAddress
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetSocketInformation
WSHGetWinsockMapping
WSHGetWildcardSockaddr
WSHIoctl
WSHSetSocketInformation
WSHJoinLeaf
WSHGetProviderGuid
WSHOpenSocket2
WSHAddressToString
WSHGetWSAProtocolInfo
WSHOpenSocket
WSHNotify
WSHGetSockaddrType

w32topl

ToplIterAdvance
ToplIterGetObject
ToplVertexInit
ToplVertexGetParent
ToplListCreate
ToplListAddElem

actxprxy

GetProxyDllInfo
DllUnregisterServer
DllGetClassObject
DllCanUnloadNow
DllRegisterServer

rpcns4

RpcNsBindingLookupNext
RpcNsBindingImportBeginA
RpcNsBindingUnexportA
RpcNsBindingExportPnPA
RpcNsGroupMbrInqBeginW
RpcNsMgmtEntryDeleteA
RpcNsMgmtEntryDeleteW

uniplat

UnimodemNotifyTSP
UnimodemDeviceIoControlEx
UnimodemWaitCommEventEx
ReinitOverStruct
CancelUnimodemTimer
SetUnimodemTimer
UmPlatformDeinitialize
UmPlatformInitialize
SyncDeviceIoControl
StopMonitoringHandle
UnimodemWriteFileEx
WinntIsWorkstation
StopMonitorThread
UnimodemQueueUserAPC
FreeOverStruct
CallEnding
AllocateOverStructEx
MonitorHandle
CreateOverStructPool
CreateUnimodemTimer
DestroyOverStructPool
StartMonitorThread
CallBeginning
FreeUnimodemTimer
ResetCallCount
UnimodemReadFileEx

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

64580560bf7ba8f01fe51aa9fc57ff12

Headers

File Characteristics

Imports

kernel32

scrobj

sqlwid

iashlpr

d3d8thk

user32

iassvcs

dsuiext

mapistub

wshtcpip

w32topl

actxprxy

rpcns4

uniplat

Sections

.text Size: 35KB - Virtual size: 35KB

.rsrc Size: 2KB - Virtual size: 1KB

.data Size: 24KB - Virtual size: 24KB

.text
Size: 35KB - Virtual size: 35KB

.rsrc
Size: 2KB - Virtual size: 1KB

.data
Size: 24KB - Virtual size: 24KB