bb10e81e2d186170e149ff6912a9a3274b119f30dd21b8f2dca02776e0fabc2b

Sharing

Copy URL Twitter E-mail

General

Target

bb10e81e2d186170e149ff6912a9a3274b119f30dd21b8f2dca02776e0fabc2b
Size

1.0MB
MD5

573cdbe66be5330aebd2be100b58f0fc
SHA1

005678cca02d11a6d8fc366033040bbeb306202d
SHA256

bb10e81e2d186170e149ff6912a9a3274b119f30dd21b8f2dca02776e0fabc2b
SHA512

5d79465757ccfcba355781787513eb8df4e2e8361d549544656bd92c2438ac4af04682e5978fcab3e802544e855ca4e00fdf5cd42b4bc254af543424900cf381
SSDEEP

12288:xRTFL1vB1jgdHlQltKXR2R2xjm9hZuyVRzINkjogkT8Bny3OI0xdXbgVhAE:xRTFL1ZoQl0mvdzzykNkTkn20xdEnAE

Score

1^/10

Malware Config

Signatures

Files

bb10e81e2d186170e149ff6912a9a3274b119f30dd21b8f2dca02776e0fabc2b
.exe windows x86

a06439717d1d6526548ed5b7a640cc9d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

GetModuleFileNameExW
EnumProcessModules
GetProcessImageFileNameW

iphlpapi

GetAdaptersInfo

kernel32

LocalFree
SetErrorMode
ReadProcessMemory
GetTempPathW
CreateDirectoryW
CreateFileW
InterlockedCompareExchange
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
GetThreadContext
SetThreadContext
HeapSetInformation
VirtualAllocEx
VirtualQueryEx
GetModuleHandleA
GetFileAttributesW
GetLongPathNameW
QueryDosDeviceW
VirtualProtectEx
WriteProcessMemory
DuplicateHandle
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
InitializeCriticalSection
ResetEvent
CreateThread
GetProcessId
UnregisterWaitEx
TerminateJobObject
SetInformationJobObject
RegisterWaitForSingleObject
GetUserDefaultLangID
GetUserDefaultLCID
AssignProcessToJobObject
GetFileType
ProcessIdToSessionId
SetHandleInformation
GetProcessHandleCount
SignalObjectAndWait
CreateMutexW
VirtualFreeEx
GetModuleHandleExW
CreateJobObjectW
CreateNamedPipeW
DebugBreak
GetCurrentDirectoryW
SearchPathW
GetNativeSystemInfo
IsDebuggerPresent
WriteFile
ReadFile
GetCommandLineW
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetSystemInfo
SetFilePointerEx
FlushFileBuffers
FindFirstFileExW
FindNextFileW
FindClose
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
GetProcessTimes
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
ReleaseMutex
UnregisterWait
RtlCaptureContext
SetUnhandledExceptionFilter
SetCurrentDirectoryW
CreateSemaphoreW
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
WriteConsoleW
EnumSystemLocalesW
IsValidLocale
GetACP
GetStdHandle
SetStdHandle
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
ExitProcess
FreeLibraryAndExitThread
ExitThread
RtlUnwind
GetCPInfo
GetLocaleInfoW
LCMapStringW
GetStringTypeW
GetStartupInfoW
UnhandledExceptionFilter
WaitForSingleObjectEx
OutputDebugStringW
LoadLibraryExA
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
GlobalMemoryStatusEx
SwitchToThread
LoadLibraryW
InterlockedExchange
GetExitCodeProcess
WaitForMultipleObjects
ResumeThread
SuspendThread
lstrlenW
CompareStringW
GetVersionExW
GetLocalTime
GlobalAddAtomW
GetCurrentProcess
SetEvent
CreateEventW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetCurrentThread
DecodePointer
GetCommandLineA
LoadLibraryExW
lstrcmpiW
GetModuleHandleW
GetProcAddress
FreeLibrary
CreateProcessW
TerminateProcess
CloseHandle
OpenProcess
GetCurrentProcessId
GetVolumeInformationA
GetTickCount
WaitForSingleObject
WideCharToMultiByte
GetModuleFileNameW
GlobalUnlock
GlobalFree
MultiByteToWideChar
GlobalLock
GlobalAlloc
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
SetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
GetLastError
InterlockedDecrement
InterlockedIncrement
Sleep
MulDiv
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
GetUserDefaultUILanguage
QueryPerformanceCounter

user32

UpdateWindow
MonitorFromPoint
LoadMenuW
TrackPopupMenu
PtInRect
ReleaseCapture
GetCapture
SetCapture
SetFocus
DefWindowProcW
DestroyWindow
SetWindowLongW
GetWindowLongW
CallWindowProcW
UnregisterClassW
DestroyAcceleratorTable
ReleaseDC
GetDC
SetCursor
GetClientRect
RedrawWindow
GetSubMenu
SetMenuItemInfoW
SetRectEmpty
GetClassNameW
DrawTextW
OffsetRect
DialogBoxParamW
DestroyMenu
GetCursorPos
RegisterHotKey
UnregisterHotKey
PostQuitMessage
GetDlgCtrlID
EnableWindow
GetActiveWindow
LoadImageW
MessageBoxW
IsDialogMessageW
RegisterWindowMessageW
ExitWindowsEx
DrawFocusRect
EmptyClipboard
GetFocus
GetSysColor
IsWindowEnabled
FillRect
EndPaint
BeginPaint
SetDlgItemInt
GetDlgItemInt
OpenClipboard
CloseClipboard
SetClipboardData
InvalidateRect
KillTimer
SetTimer
IsWindowVisible
CreateDialogParamW
SetForegroundWindow
CreateAcceleratorTableW
SystemParametersInfoW
GetParent
ClientToScreen
ScreenToClient
MoveWindow
GetDlgItem
IsWindow
SendMessageW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
CreateDesktopW
CloseDesktop
EnumDesktopWindows
GetWindowThreadProcessId
SendMessageTimeoutW
ShowWindow
GetWindow
SetWindowPos
MapWindowPoints
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindowTextW
GetWindowTextLengthW
SetDlgItemTextW
PostMessageW
PeekMessageW
GetMessageW
CloseWindowStation
GetThreadDesktop
CreateWindowStationW
SetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
GetSystemMetrics
SetWindowTextW
EndDialog
CharNextW
DispatchMessageW
TranslateMessage

gdi32

SelectObject
SetBkMode
SetTextColor
GetStockObject
CreateFontIndirectW
GetObjectW
StretchBlt
GetTextMetricsW
SetViewportOrgEx
CreateCompatibleDC
BitBlt
GetTextExtentPoint32W
SetBkColor
ExtTextOutW
RestoreDC
SaveDC
CreatePen
LineTo
MoveToEx
DeleteDC
DeleteObject
CreateCompatibleBitmap
GetTextMetricsA
CreateFontW
GetTextExtentPointA
GetDeviceCaps

advapi32

RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
CreateProcessAsUserW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownW
RegQueryValueExW
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetAce
GetKernelObjectSecurity
GetLengthSid
SetKernelObjectSecurity
SetTokenInformation
SetSecurityInfo
ConvertStringSidToSidW
SystemFunction036
RevertToSelf
RegDisablePredefinedCache
CopySid
CreateWellKnownSid
CreateRestrictedToken
DuplicateToken
DuplicateTokenEx
EqualSid
GetTokenInformation
SetThreadToken
ConvertSidToStringSidW
SetEntriesInAclW
GetSecurityInfo

shell32

ShellExecuteW
Shell_NotifyIconW

ole32

CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
OleLockRunning
CoGetClassObject
CoInitializeEx

oleaut32

VariantClear
SysAllocString
VariantInit
VariantCopy
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
VariantChangeType
VarUI4FromStr
SafeArrayCreateVector
SafeArrayDestroy
VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
SysFreeString

shlwapi

PathFileExistsW
PathAppendW
StrCpyW
SHDeleteValueW
PathRemoveFileSpecW
SHGetValueW
StrCpyNW
StrStrIW
StrStrIA
PathAddExtensionW
PathFileExistsA
PathRemoveExtensionW
SHSetValueW
PathFindFileNameW

comctl32

_TrackMouseEvent
InitCommonControlsEx
ImageList_Create

ws2_32

WSACloseEvent
WSACleanup
closesocket
WSAStartup
WSASocketW
getaddrinfo
WSASetLastError
WSAGetLastError
WSASend
WSAEventSelect
WSASetEvent
WSACreateEvent
WSARecv
WSAGetOverlappedResult
freeaddrinfo
WSAResetEvent
WSAEnumNetworkEvents
WSAConnect

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winmm

timeGetTime

rpcrt4

RpcMgmtStopServerListening
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcServerRegisterIfEx
RpcServerListen
NdrServerCall2

gdiplus

GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream

Exports

Exports

GetHandleVerifier
IsSandboxedProcess

Sections

.text
Size: 685KB - Virtual size: 684KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a06439717d1d6526548ed5b7a640cc9d

Headers

DLL Characteristics

File Characteristics

Imports

psapi

iphlpapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

ws2_32

version

winmm

rpcrt4

gdiplus

Exports

Exports

Sections

.text Size: 685KB - Virtual size: 684KB

.rdata Size: 243KB - Virtual size: 242KB

.data Size: 11KB - Virtual size: 23KB

.gfids Size: 1024B - Virtual size: 688B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 76KB - Virtual size: 76KB

.reloc Size: 39KB - Virtual size: 39KB

.text
Size: 685KB - Virtual size: 684KB

.rdata
Size: 243KB - Virtual size: 242KB

.data
Size: 11KB - Virtual size: 23KB

.gfids
Size: 1024B - Virtual size: 688B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 76KB - Virtual size: 76KB

.reloc
Size: 39KB - Virtual size: 39KB