f2c8ac4ee847983ec860780b995ea37491298369cfff95db5208a8667405aab4

Sharing

Copy URL Twitter E-mail

General

Target

f2c8ac4ee847983ec860780b995ea37491298369cfff95db5208a8667405aab4
Size

551KB
MD5

08861e825c4fdfd6ea51605da2e60de0
SHA1

1942905da361cfdfec326e433ebfacfe7cbd3791
SHA256

f2c8ac4ee847983ec860780b995ea37491298369cfff95db5208a8667405aab4
SHA512

7b1c4ae4363bb297e5cc6c212cf6d005e5df8dcb80ee1e900ae09976eee8fb7dcf754c137baeb081bc3b8dc8455967ed428ab92efa4b2490043a830558f59384
SSDEEP

3072:3Sjj2iE9QBT9KJRSBXL2dmtDB17K0ss18tjQ2M4ebvdn9PnDsS1HtQBsOo/Q1ubq:4KmKJQBX6daPkwujfeDICQBsOd1ub3

Score

N/A

Malware Config

Signatures

Files

f2c8ac4ee847983ec860780b995ea37491298369cfff95db5208a8667405aab4
.dll regsvr32 windows x86

169f052ece9324baef09c8ab76866797

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSEnumerateProcessesW

kernel32

VirtualFree
GetCommandLineA
RtlUnwind
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
DeleteFileW
FindFirstFileW
FindClose
CreateDirectoryW
CloseHandle
lstrlenW
CreateFileW
ReadFile
WriteFile
SetFilePointer
IsBadCodePtr
GetLastError
GetFileSize
GetCurrentThreadId
EnterCriticalSection
ResetEvent
ReleaseMutex
lstrcmpiW
MultiByteToWideChar
FreeLibrary
LeaveCriticalSection
VirtualQuery
InitializeCriticalSection
SizeofResource
LoadResource
DisableThreadLibraryCalls
DeleteCriticalSection
CreateThread
FindResourceW
RaiseException
SetThreadPriority
LoadLibraryExW
SetEvent
InterlockedIncrement
WaitForMultipleObjects
WaitForSingleObject
GetModuleFileNameW
InterlockedDecrement
GlobalAlloc
GlobalFree
CreateEventW
ExitThread
Sleep
GetTickCount
WideCharToMultiByte
TerminateThread
GetComputerNameW
CreateMutexW
HeapFree
HeapSize
HeapValidate
GetProcessHeap
HeapAlloc
Process32FirstW
CreateToolhelp32Snapshot
Process32NextW
OpenProcess
GetSystemTimeAsFileTime
LoadLibraryA
GetProcAddress
CreateEventA
OpenEventA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetSystemInfo
GetModuleHandleA
VirtualAlloc
TlsGetValue
VirtualProtect
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetModuleHandleW
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetCPInfo
HeapCreate
HeapDestroy
ExitProcess
GetModuleFileNameA
GetStdHandle
SetLastError
TlsFree
TlsSetValue
TlsAlloc
GetVersionExA

user32

UnregisterClassA
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW

advapi32

RegDeleteKeyW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RevertToSelf
GetUserNameW
ImpersonateLoggedOnUser
OpenProcessToken
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc

oleaut32

VarBstrCmp
SysStringByteLen
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VarBstrCat
VariantInit
VariantClear
SafeArrayDestroy
SafeArrayGetElement
LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr
RegisterTypeLi
SysAllocString
SysFreeString
SysAllocStringLen
SysAllocStringByteLen
SysStringLen

shlwapi

PathAppendW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 437KB - Virtual size: 441KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

169f052ece9324baef09c8ab76866797

Headers

File Characteristics

Imports

wtsapi32

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 437KB - Virtual size: 441KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 10KB - Virtual size: 17KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 437KB - Virtual size: 441KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 10KB - Virtual size: 17KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 23KB - Virtual size: 22KB