aa0f0f07851cf1e3f9365c86beaf1cc6bc4e0989cf04716f4ab9157424b3355b

Sharing

Copy URL

Twitter E-mail

General

Target

aa0f0f07851cf1e3f9365c86beaf1cc6bc4e0989cf04716f4ab9157424b3355b
Size

208KB
MD5

7f368828194e4423042eddb14029dcf9
SHA1

8f7272ecbcd7e6e3629ebb27da4d74629ee97b59
SHA256

aa0f0f07851cf1e3f9365c86beaf1cc6bc4e0989cf04716f4ab9157424b3355b
SHA512

535ab0b7e2dafc7e1b84c8e44a1078e8326ee5bcbce1650cbde25559b979110a985797fdc8598b09f26b3575770b69951a42f3d64a2c9a977331b0aee81c4567
SSDEEP

3072:oaRiuDIbF0FJzg2zYJ74YI0qSw+JfytZRouoV8c3GhIhxNftq95Y4:liAIZ0FVgSW74YtU7AWhIPNfm53

Score

N/A

Malware Config

Signatures

Files

aa0f0f07851cf1e3f9365c86beaf1cc6bc4e0989cf04716f4ab9157424b3355b
.dll windows x86

618b37de095831e6c8cd0b178ee7bd7c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

newdev

UpdateDriverForPlugAndPlayDevicesA

shlwapi

StrStrIA
PathRemoveFileSpecA
StrTrimA
SHDeleteKeyA

psapi

GetModuleBaseNameA
EnumProcessModules
EnumProcesses

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

msi

ord114
ord120
ord73
ord17
ord117
ord170
ord31
ord144
ord8
ord160
ord159
ord124
ord103
ord49

kernel32

HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
LocalFree
GlobalFree
GlobalAlloc
lstrlenA
InterlockedDecrement
ExpandEnvironmentStringsA
Sleep
CloseHandle
CreateFileA
GetLastError
GetCurrentProcess
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExA
SetLastError
lstrcmpiA
TerminateProcess
OpenProcess
GetStringTypeA
FreeLibrary
GetProcAddress
LoadLibraryA
WriteFile
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
WideCharToMultiByte
lstrcpynA
GlobalUnlock
GlobalLock
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
TlsSetValue
TlsFree
InterlockedIncrement
GetCPInfo
MultiByteToWideChar
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
LCMapStringW
LCMapStringA
GetOEMCP
TlsAlloc
TlsGetValue
GetModuleHandleA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
GetACP

user32

DialogBoxParamA
SystemParametersInfoA
GetDlgItem
SendDlgItemMessageA
ShowWindow
SetFocus
SetForegroundWindow
SetActiveWindow
GetWindowRect
GetSystemMetrics
GetParent
MoveWindow
SendMessageA
EndDialog

advapi32

RegSetValueExA
ControlService
StartServiceA
QueryServiceStatus
CreateServiceA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenSCManagerA
OpenServiceA
CloseServiceHandle

shell32

SHGetFolderPathA
ShellExecuteA

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
OleRun

oleaut32

VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayGetElement
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysFreeString
SysAllocString
GetErrorInfo

Exports

Exports

?hpqGetMachineInfo@@YAJXZ
?hpqIsCompaq@@YAHXZ
hpqDisplayUninstallPrompt
hpqExecuteWmiInfSection
hpqGetBiosVersion
hpqGetBrand
hpqGetBrandEx
hpqGetFileVersion
hpqGetHPTargetDir
hpqGetKbcBiosVersion
hpqGetMachineId
hpqGetModelName
hpqGetOsBuildNumber
hpqGetOsInfo
hpqGetProcessorFamily
hpqGetProcessorInfo
hpqGetProcessorName
hpqGetSerialNumber
hpqGetServiceStatus
hpqGetTargetDir
hpqGetTotalMemory
hpqGetUserSID
hpqGetUuid
hpqInfoRegister
hpqInfoUnRegister
hpqInstallService
hpqIsAdministrator
hpqIsAppInstalled
hpqIsClassSupported
hpqIsCompaqFamily
hpqIsHPPortable
hpqIsHpFamily
hpqIsQuickPlaySupported
hpqMSIExecuteWmiInfSection
hpqMSIExtractFileFromBinaryTable
hpqMSIGetBrandEx
hpqMSIGetBrandID
hpqMSIGetMachineId
hpqMSIGetModelName
hpqMSIInstallWmiService
hpqMSIIsAdministrator
hpqMSIIsCompaqFamily
hpqMSIIsHPFamily
hpqMSIIsHPPortable
hpqMSISetUninstallInfo
hpqMSIUninstallWmiService
hpqMSIUpdatePnPDriver
hpqOpenService
hpqStartService
hpqStopService
hpqTerminateApp
hpqUpdatePnPDriver
hpqWmiExecMethodEx
hpqZeroForegroundLockTimeout

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

618b37de095831e6c8cd0b178ee7bd7c

Headers

File Characteristics

Imports

newdev

shlwapi

psapi

version

msi

kernel32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 81KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 8KB

.text Size: 76KB - Virtual size: 76KB

.text
Size: 84KB - Virtual size: 81KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 8KB

.text
Size: 76KB - Virtual size: 76KB