d40767e039e3b7d452ea9b8a947ed133c02bb77a89e920d0c5eeb49e45e88b49

Sharing

Copy URL Twitter E-mail

General

Target

d40767e039e3b7d452ea9b8a947ed133c02bb77a89e920d0c5eeb49e45e88b49
Size

161KB
MD5

48465f231ba468f2e2dcdd79d61fd3c8
SHA1

174309e076835564c20f20df3750475fd58f3c91
SHA256

d40767e039e3b7d452ea9b8a947ed133c02bb77a89e920d0c5eeb49e45e88b49
SHA512

fbc3a17856d4b3c102de3f849d6182a493d1adf6683936a0150e896adee330ce8f0206de35d4252211d23251810d4cb9b19ba9e9d95a543037b6a182f928c5ce
SSDEEP

3072:QJkGUJ7El8UWT5BSLEGHRGGhzI3uQYXXYwWX8U3r+XU2FmPc4ocAa13bK+HY:UkGUiiT14LEGxNY58U3rOU2gPcOpK+

Score

N/A

Malware Config

Signatures

Files

d40767e039e3b7d452ea9b8a947ed133c02bb77a89e920d0c5eeb49e45e88b49
.exe windows x86

531e782cce1c6de717ffc35c382de89d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionAndSpinCount
GetOEMCP
SetSystemTime
SetComputerNameW
InterlockedPushEntrySList
GetFileTime
lstrcmpW
LoadLibraryA
FindNextChangeNotification
EnumerateLocalComputerNamesW
RequestWakeupLatency
GetConsoleCharType
ReleaseActCtx
GetConsoleMode
AddAtomW
LockFileEx
PrepareTape
VirtualAlloc
GetFileSizeEx
SetFirmwareEnvironmentVariableA
QueryActCtxW
GetOverlappedResult
WriteConsoleOutputCharacterA
WriteConsoleA
GetStringTypeW
GetNativeSystemInfo
CreatePipe
EnumResourceNamesW
IsProcessInJob
GetEnvironmentStringsW
CompareStringW
DeleteVolumeMountPointA
GetCurrentConsoleFont
CreateDirectoryExW
GetTimeZoneInformation
RtlCaptureContext
HeapFree
GetCommConfig
GetFullPathNameA
ReleaseSemaphore
ReadConsoleA
GetSystemInfo
NlsGetCacheUpdateCount
IsValidCodePage
UnlockFileEx
UnmapViewOfFile
FindFirstFileExW
SetDefaultCommConfigA
OpenWaitableTimerW
ReplaceFileW
WaitCommEvent
GetVersionExW
WritePrivateProfileStructW
GetNumberOfConsoleInputEvents
SetThreadContext
CloseProfileUserMapping
GetThreadContext
OpenEventA
QueueUserWorkItem
_hread
GetDiskFreeSpaceExW
LZOpenFileA
CreateTimerQueue
AddLocalAlternateComputerNameA
SetLocalPrimaryComputerNameW
FindFirstFileW
FindNextVolumeA
GetStartupInfoA
GetTimeFormatA
GetNamedPipeHandleStateA
GetTempFileNameA
CancelTimerQueueTimer
GetCommandLineW
GetNamedPipeInfo
ReadConsoleInputExW
TzSpecificLocalTimeToSystemTime
GetProcessShutdownParameters
HeapCompact
LocalFileTimeToFileTime
TransactNamedPipe
GetPrivateProfileStringA
ReadFile
CreateMailslotA
CancelDeviceWakeupRequest
SetLocaleInfoW
RtlMoveMemory
lstrcmpiW
WaitNamedPipeA
CreateFileMappingW
SetVolumeMountPointA
GetStartupInfoW
GetFullPathNameW
WriteFileGather
SetConsoleTextAttribute
WriteConsoleInputVDMW
SetMailslotInfo
SetCommState
BeginUpdateResourceA
GetProcessHeap
GetCurrentActCtx
RemoveLocalAlternateComputerNameA

msctf

TF_CreateCicLoadMutex
TF_CreateCategoryMgr
TF_CreateThreadMgr
TF_GetGlobalCompartment
TF_PostAllThreadMsg
TF_UninitSystem
TF_InitSystem
TF_CreateLangBarItemMgr
TF_GetThreadFlags
TF_CreateDisplayAttributeMgr
TF_IsCtfmonRunning
TF_RunInputCPL
TF_CreateInputProcessorProfiles
TF_CreateLangBarMgr
DllGetClassObject
TF_InvalidAssemblyListCacheIfExist
TF_GetThreadMgr

comdlg32

ReplaceTextW
WantArrows
FindTextA
PrintDlgExA
CommDlgExtendedError
dwOKSubclass
LoadAlterBitmap
ChooseFontA
GetSaveFileNameA
PrintDlgExW
FindTextW
ChooseFontW
dwLBSubclass
GetOpenFileNameA
GetFileTitleW
GetFileTitleA
PrintDlgW
GetOpenFileNameW
ChooseColorA
PrintDlgA
ReplaceTextA
Ssync_ANSI_UNICODE_Struct_For_WOW
ChooseColorW
PageSetupDlgA
GetSaveFileNameW

gdi32

Polygon
SetStretchBltMode
CombineRgn
CreateBitmap
PlayMetaFileRecord
DdEntry1
RemoveFontMemResourceEx
FrameRgn
DdEntry22
EngStrokeAndFillPath
GetSystemPaletteEntries
CopyEnhMetaFileA
DeleteObject
SetLayoutWidth
GetCharABCWidthsI
PolyBezier
BRUSHOBJ_pvGetRbrush
DdEntry4
GdiReleaseDC
PolyPatBlt
EngDeletePalette
GdiSetServerAttr
GdiEntry4
DdEntry45
EudcUnloadLinkW
SelectClipPath
EnumObjects
DdEntry3
GetBkColor
EngCreateClip
CreateFontIndirectA
GetBrushAttributes
SetICMProfileW
DeviceCapabilitiesExA
BitBlt
UnrealizeObject
CreateFontIndirectExA
CreateSolidBrush

msvcirt

?delbuf@ios@@QAEXH@Z
??0logic_error@@QAE@ABV0@@Z
?peek@istream@@QAEHXZ
?open@fstream@@QAEXPBDHH@Z
?base@streambuf@@IBEPADXZ
??_8stdiostream@@7Bistream@@@
??1stdiobuf@@UAE@XZ
??_Eexception@@UAEPAXI@Z
??6ostream@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
??0strstream@@QAE@ABV0@@Z
??0strstream@@QAE@PADHH@Z
??_Eifstream@@UAEPAXI@Z
?ws@@YAAAVistream@@AAV1@@Z
?setbuf@strstreambuf@@UAEPAVstreambuf@@PADH@Z
??0ifstream@@QAE@H@Z
?setf@ios@@QAEJJ@Z
??_7streambuf@@6B@
??0istrstream@@QAE@PADH@Z
?get@istream@@QAEAAV1@PAEHD@Z
?put@ostream@@QAEAAV1@E@Z
?clog@@3Vostream_withassign@@A
??_8ofstream@@7B@
?sync@istream@@QAEHXZ
?setbuf@ifstream@@QAEPAVstreambuf@@PADH@Z
?sputbackc@streambuf@@QAEHD@Z
?seekoff@filebuf@@UAEJJW4seek_dir@ios@@H@Z
?unbuffered@streambuf@@IAEXH@Z
?seekoff@streambuf@@UAEJJW4seek_dir@ios@@H@Z
?getline@istream@@QAEAAV1@PACHD@Z
??0istrstream@@QAE@PAD@Z
?setmode@filebuf@@QAEHH@Z
??_Efilebuf@@UAEPAXI@Z
??_Gofstream@@UAEPAXI@Z
??_Difstream@@QAEXXZ
?lockptr@streambuf@@IAEPAU_CRT_CRITICAL_SECTION@@XZ

dhcpsapi

DhcpScanMDatabase
DhcpServerBackupDatabase
DhcpServerQueryDnsRegCredentials
DhcpAddMScopeElement
DhcpDsClearHostServerEntries
DhcpDeleteSubnet
DhcpModifyClass
DhcpRpcFreeMemory
DhcpGetVersion
DhcpGetServerBindingInfo
DhcpSetOptionInfo
DhcpEnumOptions
DhcpAddSubnetElement
DhcpCreateOption
DhcpRemoveOption
DhcpScanDatabase
DhcpServerQueryAttribute
DhcpGetAllOptionValues
DhcpGetMibInfo
DhcpServerRedoAuthorization
DhcpEnumSubnetClientsV4
DhcpEnumMScopeElements
DhcpServerQueryAttributes
DhcpEnumSubnets
DhcpSetSubnetInfo
DhcpServerGetConfig
DhcpSetOptionValueV5
DhcpSetMScopeInfo
DhcpRemoveSubnetElementV5
DhcpSetServerBindingInfo
DhcpServerRestoreDatabase
DhcpGetMCastMibInfo
DhcpEnumMScopeClients
DhcpGetClientInfo
DhcpRemoveOptionValueV5

msvcrt

exit
_ftime64
modf
_pwctype
_onexit
_cgetws
_mbcjmstojis
div
_wcsdup
_wutime
__CxxLongjmpUnwind
__p__commode
?set_new_handler@@YAP6AXXZP6AXXZ@Z
__getmainargs
_ismbcl0
_fcvt
_findnext
_lfind
_mbsnccnt
__lc_codepage
__crtCompareStringA
_tzname
__set_app_type
_setmode
_unloaddll
_pipe
_flushall
__p__winminor
__badioinfo
qsort
ldiv

imagehlp

SymGetSymNext64
SymRegisterFunctionEntryCallback64
SymGetLineNext
SymSetOptions
ImageDirectoryEntryToData
SymEnumSymbols
ImageNtHeader
SymMatchString
SymFunctionTableAccess64
SymGetLineNext64
UnDecorateSymbolName
UpdateDebugInfoFile
SymGetSymNext
SymRegisterCallback64
SymGetTypeFromName
SymGetSearchPath
SymGetLinePrev
SymLoadModule
SymSetSearchPath
MapAndLoad
ImageEnumerateCertificates
RemoveRelocations
SymFromName
SearchTreeForFile
ImagehlpApiVersionEx
SymGetModuleInfoW64
SymEnumerateModules
SymGetLineFromAddr64
FindDebugInfoFileEx
MapDebugInformation
SymGetSymFromAddr
SymInitialize
SymGetLineFromName
GetTimestampForLoadedLibrary
SymGetLinePrev64
SymGetModuleInfo
SymEnumerateModules64
StackWalk
FindFileInPath
SymRegisterCallback
MakeSureDirectoryPathExists
ImageGetDigestStream
SymSetContext
RemovePrivateCvSymbolicEx

iyuv_32

AboutDialogProc
DllMain
DriverDialogProc
DriverProc

odbccp32

SQLInstallerErrorW
SQLRemoveDriverW
SQLGetInstalledDrivers
SQLPostInstallerErrorW
SQLValidDSN
SQLWriteFileDSNW
SQLConfigDriverW
SQLGetConfigMode
SQLPostInstallerError
SQLInstallDriverExW
SQLCreateDataSourceExW
SQLRemoveDSNFromIni
SQLReadFileDSN
SQLWritePrivateProfileStringW
SQLRemoveDriver
SQLLoadDriverListBox
SQLInstallDriverManagerW
SQLInstallODBCW
SQLRemoveTranslatorW
SQLWriteFileDSN
SQLRemoveDSNFromIniW
SQLGetTranslator
SQLInstallerError
SQLValidDSNW
SQLWriteDSNToIniW
SQLGetAvailableDrivers

dciman32

DCICreateOffscreen
DCIEndAccess
WinWatchNotify
DCISetDestination
GetWindowRegionData
WinWatchDidStatusChange
DCICreateOverlay
WinWatchOpen
DCIDestroy
GetDCRegionData
DCISetClipList
DCIDraw
WinWatchClose
DCICloseProvider
WinWatchGetClipList
DCIBeginAccess
DCIOpenProvider
DCISetSrcDestClip
DCIEnum
DCICreatePrimary

Sections

.tixt
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

531e782cce1c6de717ffc35c382de89d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msctf

comdlg32

gdi32

msvcirt

dhcpsapi

msvcrt

imagehlp

iyuv_32

odbccp32

dciman32

Sections

.tixt Size: 77KB - Virtual size: 77KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 41KB - Virtual size: 240KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 1024B

.tixt
Size: 77KB - Virtual size: 77KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 41KB - Virtual size: 240KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 1024B