6c68351612ba0b32a55d6ee7a7da408e11caac791a7d305a7957dd081bd38071

Sharing

Copy URL Twitter E-mail

General

Target

6c68351612ba0b32a55d6ee7a7da408e11caac791a7d305a7957dd081bd38071
Size

143KB
MD5

7d8f62b3dec7e294dfe63f81d23bb3e6
SHA1

1dc92694b30210efe15b2907b51e2aa9651dba5b
SHA256

6c68351612ba0b32a55d6ee7a7da408e11caac791a7d305a7957dd081bd38071
SHA512

3b54a0c4c68076c3f9f074093d051f772e9133d578519c8145ae246d037c22d5ba6e94bf383caeb4bf86fdf8eaa51dede1d04d3a6b671a55df0e1e6d2e639010
SSDEEP

3072:xnMj+czIZcfmlOkh/rIVputi+lI6+qEucT5I+kOb:xnMj+Mnm0k90zt6N65Iab

Score

N/A

Malware Config

Signatures

Files

6c68351612ba0b32a55d6ee7a7da408e11caac791a7d305a7957dd081bd38071
.dll windows x86

a1e823ff122c41530f36e2339e7c06b1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedExchange
MoveFileExA
GetWindowsDirectoryA
GetTickCount
GetModuleHandleA
OutputDebugStringA
HeapAlloc
GetProcessHeap
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
CreateToolhelp32Snapshot
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
GetCurrentThreadId
ExitProcess
FreeConsole
LocalSize
lstrcmpiA
RaiseException
Process32First
Process32Next
GetShortPathNameA
DeviceIoControl
GetLocalTime
GetSystemDirectoryA
InitializeCriticalSection
SetLastError
GetModuleFileNameA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
CreateProcessA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
lstrcatA
ExpandEnvironmentStringsA
GetPrivateProfileSectionNamesA
lstrlenA
OpenProcess
GetFileAttributesA
Sleep
CancelIo
lstrcpyA
CreateEventA
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
FreeLibrary
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
LoadLibraryA
GetProcAddress
TerminateThread
CloseHandle
TerminateProcess

user32

SendMessageA
SystemParametersInfoA
keybd_event
MapVirtualKeyA
mouse_event
SetCapture
WindowFromPoint
BlockInput
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
SetCursorPos
GetDesktopWindow
ReleaseDC
LoadCursorA
GetCursorInfo
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
PostThreadMessageA
GetInputState
MoveWindow
GetWindowRect
ShowWindow
FindWindowA
GetWindowThreadProcessId
IsWindowVisible
CloseDesktop
SetThreadDesktop
IsWindow
CloseWindow
CreateWindowExA
DispatchMessageA
EnumWindows
GetKeyState
GetAsyncKeyState
DestroyCursor
GetForegroundWindow
GetWindowTextA
GetCursorPos
ExitWindowsEx
TranslateMessage
GetMessageA
wsprintfA
CharNextA
GetDC
MessageBoxA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop

gdi32

CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteObject

advapi32

RegCloseKey
GetTokenInformation
LookupAccountSidA
SetServiceStatus
RegisterServiceCtrlHandlerA
LookupPrivilegeValueA
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
IsValidSid
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
LsaFreeMemory
RegQueryValueA
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
ChangeServiceConfigA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
CreateProcessAsUserA

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteA

shlwapi

SHDeleteKeyA

msvcrt

_strnicmp
_itoa
_mbsupr
_stricmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
realloc
strncat
_snprintf
sprintf
puts
_strcmpi
wcscpy
_errno
strchr
strncpy
strncmp
atoi
_mbsstr
_mbsrchr
strcat
strrchr
malloc
free
strcmp
_except_handler3
strcpy
_CxxThrowException
memcmp
strstr
strlen
_ftol
ceil
memmove
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
memset

winmm

waveOutOpen
waveInGetNumDevs
waveOutPrepareHeader
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutWrite
waveInUnprepareHeader
waveOutGetNumDevs

ws2_32

recv
ntohs
socket
gethostbyname
htons
closesocket
select
send
gethostname
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
ioctlsocket
__WSAFDIsSet
recvfrom
inet_addr
getsockname
bind
getpeername
sendto
listen
accept
inet_ntoa

userenv

GetProfilesDirectoryA
CreateEnvironmentBlock
GetUserProfileDirectoryA

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

netapi32

NetLocalGroupAddMembers
NetUserAdd

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile

msvfw32

ICOpen
ICSeqCompressFrameEnd
ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICClose
ICCompressorFree

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA

psapi

EnumProcessModules
GetModuleFileNameExA

Exports

Exports

aaaaa
bbbbb
ccccc
hi
start

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1e823ff122c41530f36e2339e7c06b1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

winmm

ws2_32

userenv

msvcp60

netapi32

wininet

msvfw32

wtsapi32

psapi

Exports

Exports

Sections

.text Size: 134KB - Virtual size: 134KB

.rsrc Size: 1024B - Virtual size: 784B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 134KB - Virtual size: 134KB

.rsrc
Size: 1024B - Virtual size: 784B

.reloc
Size: 6KB - Virtual size: 6KB