ews1rCAly5DIf0c[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ews1rCAly5DIf0c.exe
Size

544KB
MD5

d1cdf07b0a0587c72b55146081b0464c
SHA1

8358e460c9909087750cc121c057ec65321a0f19
SHA256

4623511d7ad5912be5ed0c89f9227d65ae6309dbcb9f4c40fdcba90012261cf1
SHA512

25c43884a9313d0041e181bf5a0b91550ad5db9c9552bee9b61a25ecf55e9b10ffc321f4fb0308bb08654bae1218470c82e479a6dcd7a10b16501f6526a06382
SSDEEP

12288:gtqYAXhL0Kg3bWC9wFqV/Y1lh/pg81EPC:KqzL0mC+FqUg8

Score

N/A

Malware Config

Signatures

Files

ews1rCAly5DIf0c.exe
.exe windows x86

f0543011c192603650946b2c54d1a48a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVolumeInformationW
GetFullPathNameW
FileTimeToLocalFileTime
GetFileSizeEx
GetFileTime
SetErrorMode
GetTickCount
GetStartupInfoW
HeapFree
HeapAlloc
VirtualProtect
GetSystemInfo
VirtualQuery
DeleteFileA
GetSystemTimeAsFileTime
RtlUnwind
HeapReAlloc
SetStdHandle
GetFileType
ExitProcess
ExitThread
CreateThread
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
FindClose
HeapCreate
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
InterlockedIncrement
GlobalFlags
FileTimeToSystemTime
GetThreadLocale
lstrlenA
FormatMessageW
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalFree
LocalAlloc
CreateEventW
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
GlobalAlloc
InterlockedDecrement
GlobalFree
GetCurrentProcessId
GetModuleFileNameW
GlobalLock
GlobalUnlock
MulDiv
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
FreeLibrary
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
SetFileAttributesW
ReadProcessMemory
WritePrivateProfileStringA
GetPrivateProfileStringA
FindNextFileW
FindFirstFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
SetFilePointer
DeleteFileW
SetLastError
GetLastError
Sleep
CopyFileW
VirtualFree
VirtualProtectEx
WriteProcessMemory
VirtualAlloc
VirtualAllocEx
OpenProcess
OpenFileMappingA
GetModuleHandleA
LoadLibraryW
MultiByteToWideChar
GetProcAddress
GetModuleHandleW
CloseHandle
WideCharToMultiByte
LockResource
SizeofResource
LoadResource
FindResourceW
lstrlenW
RaiseException
InterlockedExchange
LeaveCriticalSection
GetStartupInfoA
EnterCriticalSection

user32

PostThreadMessageW
IsRectEmpty
CopyAcceleratorTableW
CharNextW
ReleaseCapture
SetCapture
CharUpperW
UnregisterClassW
LoadCursorW
GetSysColorBrush
DestroyMenu
SetCursor
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetDesktopWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
IsWindowEnabled
ShowWindow
SetWindowTextW
IsDialogMessageW
CheckRadioButton
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
EnableWindow
GetDC
SendMessageW
ReleaseDC
GetKeyState
SetMenu
SetForegroundWindow
UpdateWindow
PostMessageW
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
RegisterClipboardFormatW
GetClassInfoW
RegisterClassW
GetNextDlgGroupItem
InvalidateRgn
MoveWindow
SetRect
InvalidateRect
RedrawWindow
MessageBoxW
GetFocus
LoadIconW
FindWindowW
GetWindow
GetSystemMenu
AppendMenuW
GetWindowRect
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
IsWindowVisible
MessageBeep
GetSubMenu
GetParent
GetWindowPlacement
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
SetWindowLongW
GetWindowLongW
GetMenu
CallWindowProcW
DefWindowProcW
GetDlgCtrlID
PtInRect
CopyRect
EqualRect
GetSysColor
AdjustWindowRectEx
GetActiveWindow

gdi32

ExtSelectClipRgn
GetDeviceCaps
CreateFontIndirectW
CreateRectRgnIndirect
GetMapMode
DPtoLP
GetBkColor
GetTextColor
GetRgnBox
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteDC
GetWindowExtEx
GetViewportExtEx
SetMapMode
SetStretchBltMode
RestoreDC
SaveDC
CreateBitmap
GetClipBox
GetStockObject
RemoveFontResourceW
CreateFontW
AddFontResourceW
SetBkColor
SetBkMode
SetTextColor
CreateSolidBrush
CreateCompatibleBitmap
GetObjectW
SetDIBColorTable
SelectObject
StretchBlt
DeleteObject
CreateDIBSection
CreateCompatibleDC

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteExW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathIsDirectoryW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoGetClassObject
OleFlushClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard

oleaut32

SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
SysStringLen

gdiplus

GdipGetImageWidth
GdipCreateHBITMAPFromBitmap
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipCloneImage
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipAlloc
GdipFree

winhttp

WinHttpCloseHandle
WinHttpConnect
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpOpen

uxtheme

SetWindowTheme

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

Sections

.text
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0543011c192603650946b2c54d1a48a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

winhttp

uxtheme

psapi

Sections

.text Size: 268KB - Virtual size: 267KB

.rdata Size: 77KB - Virtual size: 77KB

.data Size: 11KB - Virtual size: 27KB

.rsrc Size: 149KB - Virtual size: 149KB

.reloc Size: 37KB - Virtual size: 37KB

.text
Size: 268KB - Virtual size: 267KB

.rdata
Size: 77KB - Virtual size: 77KB

.data
Size: 11KB - Virtual size: 27KB

.rsrc
Size: 149KB - Virtual size: 149KB

.reloc
Size: 37KB - Virtual size: 37KB