87d5964e158ac08920c78ca059d12d7776779cdc6e104bfb41b01d74ed959440

Sharing

Copy URL Twitter E-mail

General

Target

87d5964e158ac08920c78ca059d12d7776779cdc6e104bfb41b01d74ed959440
Size

574KB
MD5

6852fd23e675b450454bb7d7c56c5c56
SHA1

2ffc2789b616efeebc8b4006274c22e4ebc8ff97
SHA256

87d5964e158ac08920c78ca059d12d7776779cdc6e104bfb41b01d74ed959440
SHA512

5698d90186f334f8096a40fc361205fb1c272dd84faf70c8354210d60ebabcb07d5b1f2fae0ad2a4ac0786eae916121edd1a854865dfeb79e25d823bcee250ac
SSDEEP

12288:FTC9IKOkpM6OZwdw37fm3C0AV8LXqs76J9Na:FTCiKY6Ouq3jm3C0AVuR76J90

Score

N/A

Malware Config

Signatures

Files

87d5964e158ac08920c78ca059d12d7776779cdc6e104bfb41b01d74ed959440
.exe windows x86

a50fa46227d71ec0c5f3204fb2130337

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord491
ord5426
ord6193
ord5856
ord1165
ord772
ord5602
ord500
ord5977
ord1662
ord2644
ord5949
ord6563
ord5945
ord3356
ord3090
ord5947
ord3658
ord3621
ord2406
ord3566
ord1634
ord1633
ord5781
ord2858
ord2371
ord6051
ord1768
ord5286
ord3393
ord4418
ord3728
ord567
ord810
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6168
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord640
ord6190
ord6017
ord323
ord4266
ord4532
ord2115
ord3282
ord3291
ord6266
ord3909
ord1084
ord4688
ord3749
ord5142
ord3016
ord4847
ord6376
ord2078
ord326
ord4270
ord3737
ord818
ord2144
ord773
ord6373
ord5603
ord3614
ord4215
ord2576
ord3649
ord1637
ord1143
ord5677
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3396
ord4616
ord3733
ord561
ord815
ord2430
ord2613
ord5568
ord2910
ord4237
ord4718
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5278
ord2641
ord1658
ord4430
ord5248
ord4421
ord3618
ord674
ord3865
ord2455
ord1135
ord2447
ord2550
ord366
ord1105
ord6278
ord291
ord2757
ord910
ord2574
ord4396
ord3635
ord693
ord2857
ord4238
ord697
ord395
ord4181
ord6896
ord3281
ord3905
ord6688
ord686
ord3991
ord2445
ord2088
ord384
ord2092
ord5625
ord3431
ord4118
ord2855
ord3397
ord3716
ord795
ord2567
ord4390
ord3569
ord609
ord1764
ord6362
ord2405
ord2016
ord4214
ord2573
ord4395
ord3634
ord692
ord6316
ord3084
ord5639
ord2070
ord2091
ord2108
ord4282
ord4279
ord6867
ord6865
ord6238
ord1644
ord5597
ord913
ord1172
ord700
ord398
ord3434
ord2776
ord912
ord699
ord397
ord3433
ord5589
ord4192
ord909
ord3638
ord696
ord3930
ord394
ord5586
ord3430
ord4180
ord3568
ord5706
ord283
ord5871
ord4128
ord4292
ord2746
ord2836
ord2099
ord4199
ord5446
ord6390
ord5436
ord6379
ord613
ord3490
ord4078
ord1834
ord289
ord3688
ord2705
ord3995
ord6004
ord2579
ord4400
ord3389
ord3724
ord804
ord6777
ord4254
ord1900
ord1683
ord2520
ord5284
ord4433
ord2046
ord4425
ord771
ord497
ord2400
ord6868
ord2606
ord6655
ord4120
ord3470
ord3285
ord3298
ord5845
ord2876
ord6451
ord2877
ord6437
ord1258
ord2111
ord1761
ord4709
ord2629
ord1230
ord5784
ord472
ord755
ord470
ord2036
ord2440
ord1569
ord6279
ord2634
ord926
ord860
ord6024
ord768
ord4253
ord2854
ord414
ord3979
ord713
ord3657
ord5817
ord5600
ord5855
ord5617
ord859
ord927
ord6654
ord539
ord501
ord1083
ord536
ord4273
ord941
ord715
ord415
ord1085
ord1081
ord1008
ord3312
ord6565
ord4124
ord5616
ord924
ord6211
ord3871
ord2756
ord5605
ord2769
ord2010
ord3694
ord4829
ord5283
ord4371
ord4352
ord4942
ord4970
ord4899
ord5154
ord5156
ord5155
ord823
ord5618
ord542
ord3798
ord802
ord5679
ord4272
ord2755
ord942
ord4197
ord3087
ord6195
ord535
ord540
ord2810
ord537
ord922
ord940
ord925
ord825
ord2637
ord324
ord538
ord861
ord858
ord800
ord641
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4370
ord5261
ord4229
ord2859
ord3133
ord4219
ord4294
ord5830

msvcrt

towupper
memcmp
_wcsicmp
_wcsnicmp
wcscmp
wcscpy
wcscat
wcstol
towlower
free
malloc
__setusermatherr
_adjust_fdiv
__p__fmode
__p__commode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
__CxxFrameHandler
memset
memcpy
wcslen
_controlfp
?terminate@@YAXXZ
_onexit
_initterm
swprintf
wcsrchr
_wtoi64
wcsncpy
exit
_wtoi
wcsncmp
wcschr
time
wcsstr
memmove
_wcslwr
atof
strchr
toupper
_purecall
__RTDynamicCast
_c_exit
_exit
_XcptFilter
_cexit
_wcmdln
__wgetmainargs
__dllonexit

advapi32

LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
OpenSCManagerW
EnumServicesStatusW
CloseServiceHandle
RegDeleteKeyW
CloseEventLog
ReadEventLogW
OpenEventLogW
RegCloseKey
RegEnumValueW
RegOpenKeyW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW

kernel32

GetLastError
RemoveDirectoryW
MoveFileW
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
GetProcAddress
LoadLibraryW
CreateFileW
GetDriveTypeW
GetModuleFileNameW
DeleteFileW
CopyFileW
UnmapViewOfFile
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetTickCount
GetSystemTimeAsFileTime
OpenEventW
Sleep
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
LockResource
LoadResource
SizeofResource
FindResourceW
LocalAlloc
GetCurrentThreadId
LocalFree
GetFileAttributesW
HeapFree
HeapAlloc
GetProcessHeap
CloseHandle
GetFileTime
GetWindowsDirectoryW
GetCurrentProcessId
CreateThread
GetShortPathNameW
ProcessIdToSessionId
GetVersionExW
CreateMutexW
OpenMutexW
GetCommandLineW
GetSystemWindowsDirectoryW
WaitForSingleObject
MapViewOfFile
CreateFileMappingW
WriteFile
GetTempPathW
GetProcessTimes
OpenProcess
FreeLibrary
TerminateProcess
QueryPerformanceCounter

gdi32

GetCurrentObject
SetTextColor
GetClipBox
CreateFontIndirectW
GetObjectW
CreatePen
GetTextMetricsW
GetPixel
Rectangle
CreatePatternBrush
GetStockObject
Ellipse
BitBlt
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
PatBlt
LPtoDP
DPtoLP
GetWindowExtEx
GetViewportExtEx
GetMapMode
CreateSolidBrush
CreatePolygonRgn
CreateCompatibleDC
CreateCompatibleBitmap
SetPixel
DeleteDC
SelectObject
GetTextExtentPoint32W
DeleteObject
GetTextColor

user32

LoadBitmapW
DestroyCursor
GetWindowLongW
SendMessageW
UnhookWindowsHookEx
SetCursor
ReleaseCapture
GetParent
CallNextHookEx
PostMessageW
IsWindowVisible
PtInRect
EnumChildWindows
WindowFromPoint
CallWindowProcW
SetWindowsHookExW
SetCapture
SetWindowLongW
SetWindowPos
MoveWindow
GetDC
CreateWindowExW
SetFocus
ScreenToClient
GetDlgItem
SetWindowTextW
ShowWindow
GetDlgCtrlID
GetWindow
SendDlgItemMessageW
MessageBoxW
LoadCursorW
GetWindowRect
SetWindowRgn
SetClassLongW
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
GetAsyncKeyState
GetWindowThreadProcessId
GetForegroundWindow
KillTimer
SetTimer
SetLayeredWindowAttributes
RegisterClassExW
LoadIconW
DefWindowProcW
CopyRect
EnableMenuItem
GetSubMenu
BeginPaint
EndPaint
UpdateWindow
InvalidateRect
TabbedTextOutW
DrawTextW
GrayStringW
GetMessagePos
SetForegroundWindow
DispatchMessageW
TranslateMessage
GetMessageW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetMenuItemCount
LoadMenuW
MsgWaitForMultipleObjects
PeekMessageW
SetMenuItemInfoW
GetMenuItemInfoW
RegisterWindowMessageW
SystemParametersInfoW
FindWindowW
CreatePopupMenu
DeleteMenu
AppendMenuW
SetMenuDefaultItem
GetMenuItemID
GetMenuStringW
InsertMenuW
ModifyMenuW
GetMenu
SetMenu
PostQuitMessage
wsprintfW
GetSystemMetrics
GetKeyState
FindWindowExW
GetClassNameW
EnumWindows
DestroyIcon
DrawStateW
GetSysColor
GetMenuItemRect
IsMenu
IsRectEmpty
GetDesktopWindow
IsWindow
GetSysColorBrush
GetIconInfo
GetClientRect
ClientToScreen
OffsetRect
GetWindowDC
SetRect
InvertRect
ReleaseDC
DestroyWindow
EnableWindow

ntdll

NtQueryDirectoryFile
NtCreateFile
NtClose
NtQueryDirectoryObject
NtOpenDirectoryObject
RtlInitUnicodeString
NtOpenKey

psapi

GetModuleFileNameExW

shell32

SHFileOperationW
ShellExecuteExW
DragQueryFileW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
ord165
SHGetFolderPathW
ExtractIconExW
ShellExecuteW

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Draw
ImageList_GetIcon
ImageList_GetImageCount
ImageList_GetImageInfo
ImageList_Remove

comdlg32

ChooseColorW
GetOpenFileNameW

gdiplus

GdiplusStartup
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream

wininet

InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetOpenW

ole32

CoInitialize
CreateClassMoniker
GetRunningObjectTable
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance

sbiedll

_SbieApi_GetWork@12
_SbieDll_GetStartError@0
_SbieDll_StartSbieSvc@4
_SbieApi_CallServer@4
_SbieApi_FreeReply@4
_SbieApi_GetVersion@4
_SbieDll_StartSbieDrv@4
_SbieDll_FormatMessage0@4
_SbieDll_FormatMessage1@8
_SbieApi_EnumBoxes@8
_SbieApi_MonitorControl@8
_SbieDll_KillAll@8
_SbieApi_QueryConf@20
_SbieApi_QueryBoxPath@28
_SbieDll_TranslateNtToDosPath@4
_SbieDll_GetAllUsersPath@0
_SbieDll_GetUserPath@0
_SbieDll_GetDrivePath@4
_SbieApi_EnumProcessEx@16
_SbieApi_QueryProcess@20
_SbieApi_DisableForceProcess@8
SbieApi_Log
_SbieApi_MonitorGet@8
_SbieDll_GetLanguage@4
_SbieDll_RunFromHome@16
_SbieApi_CallZero@4
_SbieDll_CanElevateOnVista@0
_SbieDll_DeviceChange@8
_SbieDll_KillOne@4
_SbieDll_FormatMessage2@12
_SbieDll_FormatMessage@8
_SbieApi_ReloadConf@4
_SbieApi_GetLicense@4
_SbieApi_SetLicense@8

Sections

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tc
Size: 194KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a50fa46227d71ec0c5f3204fb2130337

Headers

DLL Characteristics

File Characteristics

Imports

mfc42u

msvcrt

advapi32

kernel32

gdi32

user32

ntdll

psapi

shell32

comctl32

comdlg32

gdiplus

wininet

ole32

sbiedll

Sections

.text Size: 262KB - Virtual size: 262KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 114KB - Virtual size: 113KB

.tc Size: 194KB - Virtual size: 196KB

.text
Size: 262KB - Virtual size: 262KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 114KB - Virtual size: 113KB

.tc
Size: 194KB - Virtual size: 196KB