dc612993a4618b0c7b602de8b591895e14bea23eec0b7fc516d3c7d2b7646427

Sharing

Copy URL Twitter E-mail

General

Target

dc612993a4618b0c7b602de8b591895e14bea23eec0b7fc516d3c7d2b7646427
Size

260KB
MD5

034a9682239301c2a796ed10113e234e
SHA1

269dd365c39f1fdea5b67fbfc019ad2d33f59656
SHA256

dc612993a4618b0c7b602de8b591895e14bea23eec0b7fc516d3c7d2b7646427
SHA512

110e4c24c2f20d661f82a939596f0399d823336d932ebfd14ebed4d71b8d559f5351ab50d97bfbc56931e54a045e0cc65ffc9adc88f8515c03e4f0b0a2609c66
SSDEEP

6144:bjV1c1Br34XzY+MA7etLwnDnPkL7vu103:F1c1BkXc+n7fq7G

Score

N/A

Malware Config

Signatures

Files

dc612993a4618b0c7b602de8b591895e14bea23eec0b7fc516d3c7d2b7646427
.dll windows x86

1546f99fec9d9abb887acf56e8835a4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
CreateThread
GetTickCount
SystemTimeToFileTime
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetModuleFileNameW
LocalFree
CreateEventW
SetEvent
Sleep
LeaveCriticalSection
EnterCriticalSection
ResetEvent
OpenEventW
UnmapViewOfFile
RaiseException
MapViewOfFile
CreateFileMappingW
lstrcpynA
lstrlenA
MultiByteToWideChar
IsBadReadPtr
SetWaitableTimer
CancelWaitableTimer
GetLastError
CreateWaitableTimerW
OpenWaitableTimerW
InitializeCriticalSection
DeleteCriticalSection
OpenMutexW
GetModuleHandleA
ExitProcess
DisableThreadLibraryCalls
FreeLibraryAndExitThread
TerminateThread
GetVersionExW
GetCurrentThread
lstrcatA
GetSystemTimeAsFileTime
lstrcmpiW
lstrcmpW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetFilePointer
OutputDebugStringA
SetEndOfFile
WriteFile
VirtualProtect
SetLastError
lstrcmpiA
lstrcpyA
GetVolumeInformationW
GetSystemWindowsDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetSystemTime
GetCurrentProcessId
WaitForMultipleObjects
FlushFileBuffers
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
VirtualQuery
Thread32Next
Thread32First
SuspendThread
ResumeThread
OpenThread
GetLongPathNameA
GetSystemInfo
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetFileSize
ReadFile
WideCharToMultiByte
MoveFileW
lstrcatW
GetLocalTime
ReleaseMutex
CreateMutexW
WaitForSingleObject
GetCurrentProcess
lstrcpyW
FreeLibrary
lstrlenW
lstrcpynW
CreateProcessW
CloseHandle
SetErrorMode
GetFileAttributesW
LoadLibraryA
GetProcAddress
OutputDebugStringW
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
GetOEMCP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetProcessHeap
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
HeapAlloc
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange

user32

DispatchMessageW
PeekMessageW
BroadcastSystemMessageW
MsgWaitForMultipleObjectsEx
IsCharAlphaW
IsCharAlphaNumericW
UpdateWindow
SendMessageW
FindWindowExW
wsprintfW
SetWindowTextW
UnregisterClassA
SetForegroundWindow
TranslateMessage
AllowSetForegroundWindow
wsprintfA
LockSetForegroundWindow
SetWindowsHookExW
PostMessageW
MsgWaitForMultipleObjects
CallNextHookEx
UnhookWindowsHookEx
EnumChildWindows

advapi32

DuplicateTokenEx
SetNamedSecurityInfoW
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
RegFlushKey
RegNotifyChangeKeyValue
ImpersonateSelf
OpenProcessToken
GetLengthSid
SetTokenInformation
SetThreadToken
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey

shell32

ord680
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

OleRun
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoTaskMemFree
StringFromCLSID
CoCreateGuid
CoFreeUnusedLibraries

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear
SysStringLen
DispCallFunc
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
VariantCopy
GetErrorInfo
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringLen

shlwapi

UrlEscapeW
StrStrIA
StrRStrIW
StrCmpNW
UrlUnescapeW
StrStrIW

ntdll

RtlZeroMemory
RtlUnwind

Exports

Exports

Startup
e
l
r

Sections

.text
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1546f99fec9d9abb887acf56e8835a4d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 179KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 12KB - Virtual size: 37KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 180KB - Virtual size: 179KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 12KB - Virtual size: 37KB

.reloc
Size: 16KB - Virtual size: 15KB