087eae45c11ab48bef675202b0658d7a951e2ebb70f14c10a4cbf5716977566e

Sharing

Copy URL Twitter E-mail

General

Target

087eae45c11ab48bef675202b0658d7a951e2ebb70f14c10a4cbf5716977566e
Size

274KB
MD5

04a5a3a096b759e8b6a0f7ec9abbf603
SHA1

d2561847819f93cec57913aa3ba109c97f5aa045
SHA256

087eae45c11ab48bef675202b0658d7a951e2ebb70f14c10a4cbf5716977566e
SHA512

b6d058ffc998ed82c7fa4b43bdfc2ab31ef9482364b7020ca786078e785ac81f7b979e0c11a33d2a3db48d01fd1e7eab1ebb8c3711791086847a03132caf1f4a
SSDEEP

6144:+tCG1f7lLw66cfb/PnQXLRYCbE7bBA3xA09bM/vOANXQZbF7O3FjU0iHhUSWy:+tCU7dbVfTPnQXLKWE7bBAVFM/FQZbs+

Score

N/A

Malware Config

Signatures

Files

087eae45c11ab48bef675202b0658d7a951e2ebb70f14c10a4cbf5716977566e
.exe windows x86

709f677cf1da2d69141c81150e58a00a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetProcessImageFileNameW

kernel32

GetModuleHandleW
SetErrorMode
GetProcAddress
InitializeCriticalSection
WriteProcessMemory
SetUnhandledExceptionFilter
GetCurrentProcess
HeapFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
EnterCriticalSection
CreateEventW
DuplicateHandle
SearchPathW
CreateProcessW
WaitForMultipleObjects
TerminateProcess
ReadProcessMemory
VirtualAllocEx
GetTickCount
GetPrivateProfileStringW
lstrlenW
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
OpenEventW
SetEvent
FreeLibrary
MoveFileExW
FindFirstFileW
FindNextFileW
GetCurrentThreadId
WaitForSingleObject
ConnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
TerminateThread
ReadFile
DisconnectNamedPipe
GetLastError
GetLocalTime
LocalFree
CreateThread
GetFileAttributesW
WritePrivateProfileStringW
GetSystemInfo
ExpandEnvironmentStringsW
FindFirstFileA
GetPrivateProfileStringA
GetModuleFileNameA
FindNextFileA
SetHandleInformation
CreateProcessA
CreatePipe
LoadLibraryW
GetTempPathW
GetFileSize
CreateDirectoryW
RemoveDirectoryW
InterlockedIncrement
InterlockedDecrement
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetModuleFileNameW
GetProcessHeap
HeapAlloc
CloseHandle
Sleep
WriteFile
CreateFileW
SetFileAttributesW
DeleteFileW
EncodePointer
DeleteCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
LeaveCriticalSection
FindClose

user32

IsWindow
SendMessageTimeoutW
KillTimer
PostQuitMessage
FindWindowW
GetMessageW
SetTimer
PostThreadMessageW
TranslateMessage

advapi32

RegQueryInfoKeyW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
FreeSid
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueA
RegOpenKeyExA

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathW
SHGetFolderPathA

ole32

CoInitialize
CoUninitialize

shlwapi

wnsprintfA
PathFileExistsA
SHGetValueA
wnsprintfW
PathFindFileNameW
PathFileExistsW

wininet

InternetReadFile
InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetGetConnectedState

msvcr100

wcsncmp
_controlfp_s
_invoke_watson
_except_handler4_common
__CxxFrameHandler3
memcpy
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_stricmp
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
??3@YAXPAX@Z
malloc
free
memcpy_s
wcscpy_s
wcscat_s
_snwprintf
memmove_s
_wcslwr_s
wcsnlen
wmemcpy_s
_vscwprintf
vswprintf_s
??_U@YAPAXI@Z
wcsncpy_s
_wtol
??_V@YAXPAX@Z
_wcsicmp
wcsstr
fwprintf
calloc
_wfopen
_purecall
fclose
??2@YAPAXI@Z
rand
srand
_wtoi
sscanf_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove
atoi
vsprintf_s
strrchr
_CxxThrowException
strcat_s
_wcslwr
wcsrchr
isspace
tolower
_vsnprintf_s
fprintf
strncmp
strchr
isalnum
isalpha
atol
memset
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__wgetmainargs
_cexit
_exit

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

ws2_32

ntohl
htonl

urlmon

URLDownloadToFileW

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

709f677cf1da2d69141c81150e58a00a

Headers

DLL Characteristics

File Characteristics

Imports

version

psapi

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

msvcr100

msvcp100

ws2_32

urlmon

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 47KB - Virtual size: 46KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 47KB - Virtual size: 46KB

.reloc
Size: 9KB - Virtual size: 9KB