1b248d5d450e8b3b8a3d9f82738f40ff0715e872a8b6eea76fdab29621aaca90

Sharing

Copy URL Twitter E-mail

General

Target

1b248d5d450e8b3b8a3d9f82738f40ff0715e872a8b6eea76fdab29621aaca90
Size

84KB
MD5

fc6a0e5ba68e2ec726b531cbad8a7abf
SHA1

8338e8ee5f96e5bcd3c5a0c48b5d03872d456437
SHA256

1b248d5d450e8b3b8a3d9f82738f40ff0715e872a8b6eea76fdab29621aaca90
SHA512

2c0a2e87a8ca95b18ac2ac5ab606b91e4136f26875d278203c5696559dec38497af897da7b6d81cf9db90d43083515e87d59a853688ab8cc5572f8a85e39acf4
SSDEEP

1536:1Wn1xJQfR3K3XGCGMaAaY38PvHpjikIJUa764QKWwcICS4Ar/ZW2h58G:1Wn1HwNK3PGMaAJRk4UyrQye2h58G

Score

N/A

Malware Config

Signatures

Files

1b248d5d450e8b3b8a3d9f82738f40ff0715e872a8b6eea76fdab29621aaca90
.exe windows x86

bb5dc4a505a6514c48539e0aa3720353

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
strtoul
strncpy
_CIpow
strchr
calloc
free
sprintf
wcstok
atol
strtok
atoi
_wtoi
mbstowcs
_itow
ceil
_wcsupr
_wcslwr
exit
toupper
srand
rand
swprintf

kernel32

lstrlenA
PeekNamedPipe
CreateProcessW
WriteFile
TerminateThread
Sleep
GetExitCodeProcess
TerminateProcess
ReadFile
GetStartupInfoW
DisconnectNamedPipe
CreatePipe
CloseHandle
GetThreadContext
GetFileSize
CreateMutexW
SetThreadContext
WaitForSingleObject
GetModuleHandleW
OpenProcess
GetModuleFileNameW
CreateFileW
GetTempPathW
GetLastError
GetProcAddress
VirtualAllocEx
ReleaseMutex
WriteProcessMemory
ResumeThread
lstrcmpW
lstrcmpA
FindFirstFileW
SetFilePointer
GetDriveTypeW
GetEnvironmentVariableW
GetLogicalDriveStringsW
CreateDirectoryW
lstrlenW
GetFileSizeEx
MoveFileW
FindClose
FindNextFileW
GetDiskFreeSpaceExW
DeleteFileW
ExitProcess
SetPriorityClass
MoveFileExW
GetCurrentProcess
GetCurrentThread
SetProcessPriorityBoost
CopyFileW
SetThreadPriority
GetShortPathNameW
GetDateFormatW
GetTimeFormatW
GetLocalTime
GetCurrentThreadId
CreateThread
GlobalMemoryStatus
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetErrorMode
SetUnhandledExceptionFilter
SetEvent
GlobalAlloc
ResetEvent
CreateEventW
FreeLibrary
LoadLibraryW
GetVersion
GetSystemDirectoryA
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetStdHandle
CreateEventA
GetVolumeInformationW
lstrcpyW
GetSystemTime
lstrcatW
GetLocaleInfoW
GetSystemDirectoryW
GetTickCount
GetComputerNameW
SetFilePointerEx

user32

ExitWindowsEx
GetLastInputInfo
EnumDesktopWindows
PostMessageW
GetClientRect
ShowWindow
IsWindow
SendMessageW
GetWindowThreadProcessId
mouse_event
GetMessageW
GetKeyState
SetCursorPos
TranslateMessage
GetAsyncKeyState
GetKeyNameTextW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
GetDesktopWindow
MapVirtualKeyW
GetWindowDC
GetWindowRect
wvsprintfA
GetSystemMetrics
GetWindowTextW
GetForegroundWindow
PeekMessageW
CharNextW
DispatchMessageW
GetKeyboardState
wsprintfW
GetDCEx
IsWindowVisible
keybd_event
VkKeyScanW
SendInput
CallNextHookEx
SetKeyboardState

gdi32

SetBitmapBits
CreateCompatibleBitmap
DeleteDC
CreateDIBSection
StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
SetStretchBltMode

advapi32

ControlService
StartServiceW
ChangeServiceConfigW
RegEnumKeyExW
RegQueryInfoKeyW
EnumServicesStatusExW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
GetUserNameW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
CloseServiceHandle
DeleteService
QueryServiceConfig2W

shell32

ord680
ShellExecuteExW
SHChangeNotify
SHFileOperationW
ShellExecuteW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CreateStreamOnHGlobal

oleaut32

VariantClear
VariantInit

wininet

DeleteUrlCacheEntryW

urlmon

URLDownloadToFileW

setupapi

SetupDiRemoveDevice
SetupDiSetClassInstallParamsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiChangeState
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW

gdiplus

GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusShutdown

ws2_32

send
gethostbyname
gethostbyaddr
closesocket
WSASetLastError
getservbyname
socket
recv
WSACleanup
getservbyport
setsockopt
ntohs
htons
WSAGetLastError
htonl
inet_addr
WSAStartup
inet_ntoa
connect
gethostname
WSAIoctl

winmm

waveInClose
waveInPrepareHeader
waveInOpen
waveInAddBuffer
waveInUnprepareHeader
waveInStart

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bb5dc4a505a6514c48539e0aa3720353

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

urlmon

setupapi

gdiplus

ws2_32

winmm

Sections

.text Size: 58KB - Virtual size: 58KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 3KB - Virtual size: 203KB

.text
Size: 58KB - Virtual size: 58KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 3KB - Virtual size: 203KB