a0be83019e9d06a177fc1cad46edb9f39d3e94392dc1fb772a66084a0c7c39a7

Sharing

Copy URL Twitter E-mail

General

Target

a0be83019e9d06a177fc1cad46edb9f39d3e94392dc1fb772a66084a0c7c39a7
Size

273KB
MD5

fda65bee912adf70d9bd6e894554c2f1
SHA1

7fadae5306fe7ff032acd5f7bc4dd4eb9ea6045b
SHA256

a0be83019e9d06a177fc1cad46edb9f39d3e94392dc1fb772a66084a0c7c39a7
SHA512

ad57fad5b98edefd0b1eb4b6ff565c291250fbcbb7bb8ee7452e21fa7d34b010dc5995fb2102ce25dba4472be7ae55c3439b2c64de329eeb851c767a390bf29d
SSDEEP

6144:QeK9TBvpU7W6p4sbXf50yH4E/e60gZHBmBrj6k07XK7+ux+Kp8I7XpR:QeK9TBpUzOwfCyH4EGjg90lI8+ux+V4r

Score

N/A

Malware Config

Signatures

Files

a0be83019e9d06a177fc1cad46edb9f39d3e94392dc1fb772a66084a0c7c39a7
.exe windows x86

c1770df87b344115ff4ae1a52c2b2b14

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtTerminateProcess
LdrGetDllHandle
NtQueryInformationProcess
RtlUnwind
LdrLoadDll

kernel32

GetCurrentProcess
InterlockedCompareExchange
GetCurrentThread
FlushInstructionCache
VirtualAlloc
VirtualProtect
GetCurrentThreadId
ResumeThread
VirtualFree
LoadLibraryA
TlsAlloc
TlsFree
ExpandEnvironmentStringsW
GetSystemTime
CreateMutexW
OpenMutexW
ReleaseMutex
FreeLibrary
lstrcmpiW
SetThreadPriority
GetThreadPriority
GetEnvironmentVariableW
CreateProcessW
OpenProcess
Thread32First
Thread32Next
CreateToolhelp32Snapshot
TerminateThread
DuplicateHandle
lstrlenA
HeapReAlloc
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
MoveFileExW
UnregisterWait
RegisterWaitForSingleObject
VirtualQuery
ExitProcess
GetSystemTimeAsFileTime
LoadLibraryW
WTSGetActiveConsoleSessionId
VirtualFreeEx
GetProcessId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
LocalFree
lstrcatW
FindFirstFileW
FindClose
FindNextFileW
DosDateTimeToFileTime
VirtualAllocEx
WriteProcessMemory
RemoveDirectoryW
SetErrorMode
OpenEventW
lstrcpyA
lstrcmpA
GetVersionExW
GetComputerNameW
GetVolumeNameForVolumeMountPointW
QueryPerformanceCounter
SystemTimeToFileTime
GetTimeZoneInformation
GetLocalTime
GetExitCodeThread
WideCharToMultiByte
MultiByteToWideChar
GetHandleInformation
lstrcmpiA
CreateRemoteThread
Process32FirstW
Process32NextW
FileTimeToDosDateTime
GetTempFileNameW
lstrcpynA
FileTimeToLocalFileTime
GetThreadContext
SetThreadContext
TlsSetValue
TlsGetValue
ResetEvent
InterlockedDecrement
InterlockedIncrement
lstrlenW
SetFileAttributesW
GetFileInformationByHandle
DeleteFileW
GetFileTime
GetFileSizeEx
GetTempPathW
FlushFileBuffers
CreateFileW
ReadFile
GetFileAttributesW
IsBadReadPtr
WriteFile
SetFileTime
CreateDirectoryW
SetFilePointerEx
SetEndOfFile
CreateThread
GetCurrentProcessId
GlobalUnlock
GlobalLock
GetLastError
CloseHandle
DeleteCriticalSection
WaitForMultipleObjects
CreateEventW
EnterCriticalSection
LeaveCriticalSection
Sleep
InitializeCriticalSection
SetEvent
TryEnterCriticalSection
GetProcAddress
GetPrivateProfileIntW
GetPrivateProfileStringW
GetModuleHandleW
GetVolumeInformationW
lstrcpyW
GetDiskFreeSpaceExW
GetUserDefaultUILanguage
GlobalMemoryStatusEx
lstrcmpW
GetModuleFileNameW
GetProcessTimes
GetLogicalDrives
GetSystemDefaultUILanguage
GetDriveTypeW
GetNativeSystemInfo
GetCommandLineW
SetLastError
WaitForSingleObject
GetTickCount
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetFilePointer
OutputDebugStringA

user32

PostQuitMessage
GetClipboardData
CharToOemW
LoadCursorW
DrawIcon
GetIconInfo
ExitWindowsEx
CharLowerA
GetLastInputInfo
GetSystemMetrics
MsgWaitForMultipleObjects
GetCursorPos
TranslateMessage
CharUpperW
ToUnicode
GetKeyboardState
CharLowerW
DispatchMessageW
PeekMessageW

advapi32

GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertSidToStringSidW
GetLengthSid
IsWellKnownSid
InitiateSystemShutdownExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegFlushKey
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
EqualSid
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateProcessAsUserW
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
GetSidSubAuthority
OpenProcessToken
CryptDestroyKey
CryptImportKey
CryptGetKeyParam
CryptVerifySignatureW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam

shlwapi

StrCmpNIA
StrCmpNW
wvnsprintfW
wvnsprintfA
ord14
StrRChrA
UrlUnescapeA
PathQuoteSpacesW
StrCmpW
StrCmpNA
StrChrA
PathSkipRootW
PathMatchSpecW
StrCmpIW
PathIsURLW
StrCmpNIW
PathFindExtensionW
PathRemoveFileSpecW
PathIsDirectoryW
PathUnquoteSpacesW
PathRenameExtensionW
PathRemoveBackslashW
PathAddBackslashW
StrStrIW
PathRemoveExtensionW
PathFindFileNameW
StrChrW
PathGetDriveNumberW

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW

secur32

DecryptMessage
DeleteSecurityContext
GetUserNameExW
EncryptMessage

ole32

CLSIDFromString
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CreateStreamOnHGlobal
CoUninitialize
CoInitializeSecurity
CoInitializeEx
StringFromGUID2

gdi32

BitBlt
DeleteDC
GetDeviceCaps
CreateDCW
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

ws2_32

FreeAddrInfoW
getaddrinfo
accept
WSASend
recv
listen
bind
WSACleanup
WSACloseEvent
WSAIoctl
shutdown
WSAAddressToStringW
WSAEnumNetworkEvents
WSAEventSelect
setsockopt
WSACreateEvent
getsockopt
WSAAddressToStringA
WSAStringToAddressW
getpeername
recvfrom
getsockname
sendto
getservbyname
connect
WSAStartup
select
WSARecv
WSAGetOverlappedResult
freeaddrinfo
closesocket
GetAddrInfoW
gethostbyname
send
WSASetLastError
WSAGetLastError
socket

crypt32

CertDeleteCertificateFromStore
CryptUnprotectData
PFXImportCertStore
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW

wininet

InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
HttpEndRequestA
HttpOpenRequestA
InternetWriteFile
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA
HttpSendRequestExA

oleaut32

VariantClear
SysFreeString
VariantInit
SysAllocString

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

iphlpapi

GetAdaptersAddresses

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

msvcrt

_except_handler3
_errno
memcpy
memset
_purecall
memcmp
memchr
_vsnwprintf
_vsnprintf
strcmp
memmove
_ultow
strtoul

Sections

.text
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1770df87b344115ff4ae1a52c2b2b14

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

shlwapi

shell32

secur32

ole32

gdi32

ws2_32

crypt32

wininet

oleaut32

netapi32

iphlpapi

version

msvcrt

Sections

.text Size: 256KB - Virtual size: 256KB

.data Size: 1024B - Virtual size: 8KB

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 256KB - Virtual size: 256KB

.data
Size: 1024B - Virtual size: 8KB

.reloc
Size: 14KB - Virtual size: 13KB