19e12a86b8e3d5621c8409d593b508143f6709245e6f363742544e18b909f785

Sharing

Copy URL Twitter E-mail

General

Target

19e12a86b8e3d5621c8409d593b508143f6709245e6f363742544e18b909f785
Size

164KB
MD5

56f8e2e4ca1b199a1cc041a0e51bd81c
SHA1

0a1d1c49be26553990371ed73932f9523a78182f
SHA256

19e12a86b8e3d5621c8409d593b508143f6709245e6f363742544e18b909f785
SHA512

b3d13404ef05a19b069ee2c2b99f286cb42dfe287a9e18c123f8d62eb8e253980f2631e0509c7d47c08e4f03b36fb7d0c2717a950e2d9169288404aee5bd512d
SSDEEP

1536:FWlgNIZgYMPZHDhXp/SUPWD64vCiIFPp2kks2YBnpIUfKhTPs6Svzn9elDdQ/AQh:FWWGdMPh869p2kkQlp4zMvznwJQz

Score

N/A

Malware Config

Signatures

Files

19e12a86b8e3d5621c8409d593b508143f6709245e6f363742544e18b909f785
.exe windows x86

fe3fe21fc9f4a7be145889599d780f06

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipDrawImageRectRectI
GdipCreateFromHDC
GdipDrawImageRectI
GdipDeleteGraphics
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipAlloc
GdipCloneImage
GdipFree
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFile
GdipGetImageWidth

mfc42

ord6880
ord802
ord668
ord542
ord356
ord540
ord1980
ord3319
ord922
ord3178
ord2781
ord2770
ord858
ord4129
ord5601
ord535
ord5622
ord5710
ord6569
ord3181
ord6662
ord940
ord665
ord603
ord1979
ord1969
ord6404
ord273
ord5186
ord354
ord3663
ord6282
ord5461
ord860
ord537
ord939
ord926
ord5683
ord6877
ord4202
ord6648
ord5440
ord6383
ord823
ord5450
ord6394
ord3698
ord5265
ord4998
ord2514
ord6052
ord1775
ord4407
ord5280
ord4425
ord3597
ord765
ord641
ord324
ord2302
ord4234
ord2818
ord6197
ord4710
ord1200
ord4160
ord2817
ord755
ord3089
ord470
ord4376
ord2370
ord6199
ord3092
ord5572
ord2915
ord6334
ord3874
ord1158
ord2645
ord4853
ord2642
ord6283
ord6385
ord4058
ord4278
ord3398
ord3733
ord686
ord810
ord384
ord2862
ord2097
ord6008
ord4000
ord2763
ord6927
ord3303
ord6676
ord3914
ord6889
ord3287
ord941
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord1576
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2621
ord1134
ord1146
ord1168
ord2086
ord6215
ord4224
ord2764
ord692
ord656
ord2358
ord3610
ord5442
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord2340
ord3803
ord1199
ord1768
ord2864
ord2379
ord323
ord1640
ord2450
ord640
ord4275
ord825
ord567
ord924
ord800
ord609
ord3574
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4396
ord1776
ord4078
ord6055
ord2575
ord2971
ord5300

msvcrt

_setmbcp
_controlfp
__CxxFrameHandler
_mbsicmp
_mbscmp
_ftol
sprintf
atoi
_mbslen
_except_handler3
_purecall
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

kernel32

GetDiskFreeSpaceExA
GetSystemDirectoryA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateDirectoryA
GetFileAttributesA
SetFileAttributesA
CopyFileA
GetStartupInfoA
MultiByteToWideChar
MoveFileA
GetModuleFileNameA
Sleep
WinExec
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateProcessA
lstrlenA
CloseHandle
GetExitCodeProcess
GetWindowsDirectoryA
GetVersionExA
GetLocaleInfoA
lstrcpynA
lstrcpyA
GetLastError
DeleteFileA

user32

IsWindow
PostQuitMessage
IsIconic
GetSystemMetrics
DrawIcon
LoadIconA
IsRectEmpty
GetCursorPos
ScreenToClient
SendMessageA
PeekMessageA
TranslateMessage
DispatchMessageA
SetTimer
GetWindowRect
InvalidateRect
GetParent
PostMessageA
GetCapture
SetCapture
ReleaseCapture
EnableWindow
CopyRect
PtInRect
GetClientRect
KillTimer
ExitWindowsEx

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

msvcp60

??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe3fe21fc9f4a7be145889599d780f06

Headers

File Characteristics

Imports

gdiplus

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ole32

msvcp60

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 52KB - Virtual size: 52KB

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 52KB - Virtual size: 52KB