0d1fd4b65e801d43320aae7d490d2d610683d66282b0d285e54cc8f59a019978

Sharing

Copy URL Twitter E-mail

General

Target

0d1fd4b65e801d43320aae7d490d2d610683d66282b0d285e54cc8f59a019978
Size

951KB
MD5

03a3bfce846444ca058c735049203638
SHA1

f8d238d3ec425319eb7cce115abfafbea18a35cf
SHA256

0d1fd4b65e801d43320aae7d490d2d610683d66282b0d285e54cc8f59a019978
SHA512

9e176667444ab170d5bfc761ca3933726aba76cc739497dc81be1153a52752a21fe244d3e2231fda7e12768fde561322b34b87e33a7db2190e88429fd4349351
SSDEEP

24576:A505et2EHQ9BiBq4iG/bva9tAyfC5Yuers1m/:A50ItG9BiBCfhfC4ss/

Score

1^/10

Malware Config

Signatures

Files

0d1fd4b65e801d43320aae7d490d2d610683d66282b0d285e54cc8f59a019978
.exe windows x86

da503bda507632ba6afc4fd7443fe184

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libcurl

curl_easy_init
curl_easy_setopt
curl_easy_perform
curl_easy_cleanup
curl_global_init
curl_easy_getinfo
curl_slist_append
curl_global_cleanup

kernel32

LocalFileTimeToFileTime
GetTickCount
FileTimeToSystemTime
FindFirstFileW
VirtualQuery
OutputDebugStringW
LockResource
FindNextFileW
lstrcpyW
FindResourceExW
MulDiv
CreateThread
Sleep
ExitProcess
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
WaitForSingleObject
SetEvent
ResetEvent
CreateEventW
GetPrivateProfileStringA
WritePrivateProfileStringA
GetTempPathA
DeleteFileA
GetFullPathNameW
GetComputerNameA
FindFirstFileExW
FindClose
LocalAlloc
GetModuleFileNameA
LocalFree
LoadLibraryW
CreateMutexA
ReleaseMutex
DuplicateHandle
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
SwitchToThread
GetCurrentDirectoryW
SetThreadAffinityMask
DeleteTimerQueueTimer
CreateTimerQueueTimer
CreateFileW
ReadFile
GetFileAttributesW
WideCharToMultiByte
WriteFile
SetFileTime
CreateDirectoryW
SystemTimeToFileTime
SetFilePointer
LoadLibraryA
GetCurrentThreadId
DeleteCriticalSection
CreateHardLinkW
RemoveDirectoryW
GetShortPathNameW
GetLongPathNameW
MoveFileW
DeviceIoControl
SetFileAttributesW
DeleteFileW
GetProcessAffinityMask
ReleaseSemaphore
InitializeCriticalSection
GetVersionExW
SetThreadExecutionState
GetSystemDirectoryW
SetThreadPriority
FoldStringW
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
FileTimeToLocalFileTime
IsDBCSLeadByte
HeapDestroy
VirtualFree
VirtualAlloc
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
InterlockedCompareExchange
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
LCMapStringW
CompareStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
lstrcmpiW
EnterCriticalSection
GetProcAddress
SetLastError
GetLastError
RaiseException
FlushInstructionCache
InitializeCriticalSectionEx
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
SizeofResource
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
UnmapViewOfFile
CloseHandle
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
CreateTimerQueue
GetThreadPriority
UnregisterWait
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
HeapFree
QueryPerformanceCounter
SetFilePointerEx
GetConsoleCP
GetFileType
GetStringTypeW
GetCurrentThread
HeapAlloc
GetSystemTimeAsFileTime
GetModuleHandleExW
AreFileApisANSI
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetProcessHeap
ReadConsoleW
GetConsoleMode
RtlUnwind
GetStdHandle
HeapSize
CreateSemaphoreW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineW
HeapReAlloc
SignalObjectAndWait

user32

CharNextW
GetMessageW
CharToOemBuffA
wsprintfW
MoveWindow
EnableWindow
MapWindowPoints
CharToOemBuffW
LoadCursorW
CharUpperW
OemToCharBuffA
OemToCharA
CharToOemA
UnregisterClassW
SetWindowTextA
GetSystemMetrics
IsWindow
FrameRect
SetWindowPos
GetSysColor
DestroyCursor
ReleaseDC
SystemParametersInfoW
GetWindowTextW
GetClassInfoExW
TranslateMessage
RegisterClassExW
CharLowerW
GetWindowDC
DispatchMessageW
DefWindowProcW
CallWindowProcW
SendMessageW
CreateWindowExW
ShowWindow
SetWindowLongW
GetDlgItem
PeekMessageW
FindWindowExA
MessageBoxA
GetActiveWindow
MessageBoxW
LoadIconW
GetCursorPos
EndPaint
ClientToScreen
SetCursor
GetWindowTextLengthW
ScreenToClient
GetWindowRect
InvalidateRect
RegisterWindowMessageW
IsIconic
FillRect
PostMessageW
DrawTextW
SetForegroundWindow
GetParent
TrackMouseEvent
GetClientRect
BeginPaint
PtInRect
GetDC
InflateRect
OffsetRect
GetWindowLongW

gdi32

DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
ExtTextOutW
SaveDC
OffsetWindowOrgEx
SetBkMode
SetStretchBltMode
RestoreDC
CreateSolidBrush
GetTextExtentPoint32W
BitBlt
SetWindowOrgEx
SetViewportOrgEx
SetBkColor
DeleteDC
CreateFontW
SetTextColor
GetDeviceCaps

advapi32

SetFileSecurityW
LookupPrivilegeValueW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken

shell32

SHGetPathFromIDListA
ShellExecuteA
SHBrowseForFolderA
Shell_NotifyIconW

ole32

CoCreateGuid
CoUninitialize
CreateStreamOnHGlobal
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecA
PathFileExistsA

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipSetStringFormatAlign
GdipSetSmoothingMode
GdipDeleteFontFamily
GdipCreateSolidFill
GdipAlloc
GdipCreateFont
GdipDrawString
GdipDrawImagePointsI
GdipCreateFromHDC
GdipSetInterpolationMode
GdipCreateStringFormat
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipLoadImageFromStream
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipSetStringFormatLineAlign
GdipCloneBrush
GdipFree
GdipDeleteBrush
GdipSetStringFormatFlags
GdiplusShutdown
GdipCreateFontFamilyFromName

comctl32

_TrackMouseEvent
InitCommonControlsEx

iphlpapi

SendARP
GetAdaptersInfo

ws2_32

WSAStartup
gethostbyname
inet_addr
inet_ntoa
gethostname

Sections

.text
Size: 465KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sign
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da503bda507632ba6afc4fd7443fe184

Headers

DLL Characteristics

File Characteristics

Imports

libcurl

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

comctl32

iphlpapi

ws2_32

Sections

.text Size: 465KB - Virtual size: 465KB

.rdata Size: 93KB - Virtual size: 93KB

.data Size: 20KB - Virtual size: 1.1MB

.sign Size: 512B - Virtual size: 64B

.rsrc Size: 306KB - Virtual size: 306KB

.reloc Size: 64KB - Virtual size: 64KB

.text
Size: 465KB - Virtual size: 465KB

.rdata
Size: 93KB - Virtual size: 93KB

.data
Size: 20KB - Virtual size: 1.1MB

.sign
Size: 512B - Virtual size: 64B

.rsrc
Size: 306KB - Virtual size: 306KB

.reloc
Size: 64KB - Virtual size: 64KB