1a223c29c1e6ee5fe7c2bd2440b3f355d25f57d7e7fa31de5ad87470791a9c4c

Sharing

Copy URL Twitter E-mail

General

Target

1a223c29c1e6ee5fe7c2bd2440b3f355d25f57d7e7fa31de5ad87470791a9c4c
Size

180KB
MD5

8909150378ecc0d4c4c9e6d226c00520
SHA1

395ef3cf3396efae9ed68cc2ca6527675e44ec27
SHA256

1a223c29c1e6ee5fe7c2bd2440b3f355d25f57d7e7fa31de5ad87470791a9c4c
SHA512

dc3b507449d81c8480c239492b794283d28359f92ac5189a3d9a4dc876a392a40196e71589c9c8f4f47ddedb7124dd73a97a2d8a87f9dbd10f14657c87ed4812
SSDEEP

3072:Z7+KCR5CKM1fc90QSLeVcvIYJ89WTuQsGQU1O9XgCbFnYWgzDnEY:ZPCSKaUZcvZJ89WTuQsGQU1QNmfE

Score

N/A

Malware Config

Signatures

Files

1a223c29c1e6ee5fe7c2bd2440b3f355d25f57d7e7fa31de5ad87470791a9c4c
.dll windows x86

0995a064accab4be6f65d3d75ca0d678

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

SetServiceStatus
UnlockServiceDatabase
InitiateSystemShutdownA
AddAuditAccessObjectAce
I_ScSetServiceBitsW
EnumDependentServicesA
LsaGetUserName
SetFileSecurityA
SystemFunction002
NotifyBootConfigStatus
ConvertStringSidToSidA
SetServiceObjectSecurity
SetEntriesInAuditListA
GetAccessPermissionsForObjectA
CryptDestroyKey
GetMultipleTrusteeW
LsaQueryTrustedDomainInfoByName
RegDeleteValueW
ClearEventLogW
RegOpenKeyExW
RegCreateKeyExA
GetTrusteeTypeW
OpenSCManagerW
DecryptFileW
RegReplaceKeyW
FileEncryptionStatusW
AccessCheckByTypeResultList
RegQueryValueExW
ConvertSidToStringSidA
ImpersonateSelf
CryptDestroyHash
GetUserNameA
LogonUserA
SystemFunction021
InitializeAcl
AllocateAndInitializeSid
LookupAccountSidW
StartServiceCtrlDispatcherA
OpenBackupEventLogA
GetServiceKeyNameW
SystemFunction016
SystemFunction010

comctl32

ImageList_GetIcon
DrawStatusTextW
FlatSB_EnableScrollBar
ImageList_Create
CreateStatusWindowW
PropertySheetA
FlatSB_GetScrollProp
ord5
ImageList_GetImageCount
FlatSB_SetScrollPos
ImageList_AddIcon
ord17
ImageList_DrawIndirect
ord8
FlatSB_GetScrollInfo
DestroyPropertySheetPage
ord13
InitCommonControlsEx
FlatSB_GetScrollRange
ImageList_SetFilter
FlatSB_SetScrollRange
ImageList_SetDragCursorImage
ImageList_Destroy
ImageList_GetIconSize
ImageList_EndDrag
_TrackMouseEvent
ImageList_Duplicate
ImageList_DragLeave
ImageList_BeginDrag
ImageList_Read
ord6
ord3
InitializeFlatSB

gdi32

CreateFontW
GetDeviceCaps
GetEnhMetaFileDescriptionW
StretchBlt
GdiGetPageCount
OffsetClipRgn
RectVisible
DPtoLP
SetMiterLimit
RectInRegion
GetPaletteEntries
GdiPlayJournal
GetGlyphOutlineW
SetPixel
Escape
CreateDIBitmap
RoundRect
AddFontResourceW
SetBitmapDimensionEx
CreateDiscardableBitmap
GdiDeleteSpoolFileHandle
AngleArc
CreateICW
AddFontMemResourceEx
ExtTextOutW
GetViewportExtEx
SetMapMode
CreateHatchBrush
CreateFontIndirectW
SetWinMetaFileBits
EudcUnloadLinkW
GetKerningPairsA
GetROP2
CreateDIBPatternBrush
GetEnhMetaFileHeader
SetICMProfileA
GetNearestPaletteIndex
PlayMetaFileRecord
CopyEnhMetaFileW
PolyTextOutA
OffsetRgn
GetMetaFileBitsEx
GetTextMetricsA

kernel32

VirtualAlloc
GetFileTime
GetCommProperties
IsValidLocale
LoadLibraryA
CreateProcessA
CreateConsoleScreenBuffer
LeaveCriticalSection
HeapFree
IsDebuggerPresent
GetSystemTime
FindFirstChangeNotificationW
MulDiv
GetDiskFreeSpaceExA
GetModuleHandleA
GetVersion
VerifyConsoleIoHandle
CommConfigDialogA
BackupWrite
SetConsoleDisplayMode
GetNumberFormatA
SetEnvironmentVariableW
HeapReAlloc
TerminateProcess
WriteConsoleOutputCharacterW
GetProcAddress
GetMailslotInfo
QueryDosDeviceW
GetHandleInformation

opengl32

glGetTexParameterfv
glTexCoord4fv
glFogiv
glColor4uiv
glRasterPos2s
glLoadIdentity
glPixelZoom
glRectdv
glLightModelfv
glIsEnabled
glTexEnviv
glColor4d
glFrustum
glStencilMask
glTexGend
glMaterialfv
glHint
glDrawBuffer
glIndexubv

shell32

ShellAboutA
SHInvokePrinterCommandA
RegenerateUserEnvironment
ShellExecuteA
ShellExecuteW
ExtractIconA
CheckEscapesW
RealShellExecuteExW
SHGetSpecialFolderPathW
SHBrowseForFolderA
SHAddToRecentDocs
StrRChrIW
StrChrA
StrNCmpIA
SHEmptyRecycleBinW
SHGetDiskFreeSpaceA
StrChrIW
ExtractAssociatedIconExW
SheChangeDirExW
SHQueryRecycleBinA
DragQueryFileA
SHGetPathFromIDListW
SHEmptyRecycleBinA
StrStrIW
FindExecutableW
FindExecutableA
StrCmpNW
InternalExtractIconListA
ExtractAssociatedIconW
SHQueryRecycleBinW
SHGetMalloc
SHGetFileInfoA
ord179
ShellExecuteExA
SHGetPathFromIDListA
StrNCmpIW
SheChangeDirA
FreeIconList
ShellExecuteExW
SheSetCurDrive
StrChrIA
StrCmpNIW
SHGetDesktopFolder
StrNCmpW
SHGetDataFromIDListW
SHAppBarMessage
ExtractIconExW
StrStrA
StrRChrW
StrStrW
StrRStrIA
ExtractIconW
SHBrowseForFolderW
SHGetInstanceExplorer
Shell_NotifyIconA
ExtractAssociatedIconExA
RealShellExecuteExA
SHGetSpecialFolderLocation
SHChangeNotify
SHUpdateRecycleBinIcon
StrChrW

shlwapi

UrlCreateFromPathW
StrFromTimeIntervalW
PathSetDlgItemPathW
PathCommonPrefixW
PathAppendW
StrFormatByteSizeW
UrlEscapeW
PathRelativePathToA
SHQueryValueExA
SHOpenRegStreamA
UrlIsNoHistoryA
PathAddBackslashW
PathRemoveArgsA
PathIsSystemFolderA
PathCompactPathA
UrlGetPartA
UrlApplySchemeW
SHDeleteEmptyKeyA
UrlEscapeA
StrPBrkA
PathIsURLA
SHSetValueW
PathMatchSpecA
PathFindExtensionW
SHQueryInfoKeyA
PathGetDriveNumberA
SHRegOpenUSKeyA
UrlIsOpaqueW
PathIsContentTypeA
PathRemoveFileSpecA
StrCSpnIA
PathCanonicalizeW
PathIsSameRootA
StrTrimA
UrlCompareA
UrlCreateFromPathA
PathRemoveBlanksW
PathMakeSystemFolderA
SHOpenRegStreamW
SHRegWriteUSValueA
UrlUnescapeA
PathUnquoteSpacesA
PathCompactPathExA
IntlStrEqWorkerA
ChrCmpIA
SHRegEnumUSValueW
UrlCompareW
PathMatchSpecW
SHRegGetUSValueW
StrCSpnA
PathFindFileNameW
StrNCatW
PathSearchAndQualifyA
PathIsFileSpecA
UrlCanonicalizeA
UrlGetPartW
PathCommonPrefixA
StrCSpnIW
SHDeleteKeyA
UrlIsW
SHRegQueryInfoUSKeyW
UrlCanonicalizeW
PathRemoveExtensionW
SHSetValueA
PathAddBackslashA
PathIsDirectoryA
PathMakeSystemFolderW
UrlApplySchemeA
UrlIsNoHistoryW
PathIsSameRootW
SHRegDeleteUSValueW
StrCmpW
PathFindNextComponentW
SHQueryValueExW
StrFromTimeIntervalA
StrCatW
UrlUnescapeW
SHRegQueryUSValueW
PathIsUNCW
PathMakePrettyW
PathCombineA
PathAddExtensionW

user32

ChangeDisplaySettingsExW
CreateWindowStationA
LoadImageA
DrawAnimatedRects
GetKeyboardLayoutNameA
DefMDIChildProcA
CharToOemA
OpenInputDesktop
GetKBCodePage
CharLowerA
LoadAcceleratorsA
MapVirtualKeyA
CreateDialogIndirectParamA
GetMenuItemCount
GetWindowContextHelpId
DrawMenuBar
ScrollDC
SendMessageA
GetShellWindow
SetWindowLongA
EnumDisplayMonitors
ValidateRect
SetThreadDesktop
GetFocus
SetCursorPos
DdeKeepStringHandle
CharLowerBuffA
SetScrollRange
SetUserObjectInformationA
DdeDisconnect
CloseWindow
GetCursorInfo
CreateAcceleratorTableW
DrawTextExA
DdeGetData
CopyIcon
DrawTextExW
DdeQueryConvInfo
ActivateKeyboardLayout
GetWindowLongW
DdeSetUserHandle
SetProcessWindowStation
WaitMessage
OemToCharBuffA
GetWindowWord
CreateIconFromResourceEx
GrayStringW
ScrollWindowEx
DragDetect
CheckMenuItem
ShowWindow
InsertMenuW
ChangeMenuA
LoadImageW
FindWindowExW
GetListBoxInfo
wsprintfW
SetUserObjectInformationW
GetClipboardOwner
GetNextDlgGroupItem
LoadIconA
EnumWindows
DdeInitializeW
SendIMEMessageExA
CreateDialogParamA
OemKeyScan
DdePostAdvise
SetClassWord
SetFocus
CharUpperBuffA
MessageBoxExW
VkKeyScanW
WINNLSGetEnableStatus
SendMessageTimeoutW
ScrollChildren
GetClipCursor
IsZoomed
GetCursor
GetKeyState
GetMenuInfo
DefDlgProcA
SetWindowRgn
IsWindowVisible
CharPrevA
InsertMenuA
DestroyIcon
TranslateAcceleratorW
CreateCursor
GetWindowRect
GetKeyNameTextW
DdeCmpStringHandles
CopyAcceleratorTableA
RealGetWindowClassA
LoadStringA
GetMenuContextHelpId

winspool.drv

EnumPrinterDataW
ExtDeviceMode
PrinterMessageBoxW
GetPrinterDataW
EnumPrintersA
ord201
SpoolerDevQueryPrintW
EnumPrintProcessorsW
DeletePrinterDataExA
DeviceCapabilitiesA
DeletePrintProvidorA
SetFormW
WritePrinter
AddPrintProvidorA
GetJobA
DEVICECAPABILITIES
ord208
DEVICEMODE
GetPrinterDriverA
DevQueryPrint
DocumentPropertiesA
EnumPrinterDriversA
CommitSpoolData
ResetPrinterW
EnumFormsW
EnumPrintProcessorDatatypesA
ord101
ord103
ord256
EnumFormsA
SetPrinterDataExA
DeletePrintProvidorW
EnumJobsA
FindClosePrinterChangeNotification
DeviceCapabilitiesW

msvcrt

_mbscoll
_mbsnbicmp
_ismbchira
_unlink
fwrite
feof
fsetpos
__p___mb_cur_max
ftell
vfprintf
_spawnlp
fprintf
fwprintf
fclose
_adj_fdiv_m16i
_fstati64
_wexecv
fread
fputc
_mbsnset
sprintf
fseek
strftime
_memicmp
vprintf
fopen
_mbcasemap
fputs
_mbstok
printf
memset
_c_exit
ferror
_CIsin

Exports

Exports

Buscoc
Psmms
Tbriz
Yillqxfvv

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0995a064accab4be6f65d3d75ca0d678

Headers

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

opengl32

shell32

shlwapi

user32

winspool.drv

msvcrt

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 120KB - Virtual size: 116KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 120KB - Virtual size: 116KB

.reloc
Size: 8KB - Virtual size: 4KB