2493dbc96b18cdb2c02a6a0fe3a4864d44fec9f3b1f1074058c0e9b2ef728613

Sharing

Copy URL Twitter E-mail

General

Target

2493dbc96b18cdb2c02a6a0fe3a4864d44fec9f3b1f1074058c0e9b2ef728613
Size

2.5MB
MD5

8fc6d570916f108d61ff63ae00ca8d20
SHA1

0feadef742711987d6993202964d9d036ef8f4b3
SHA256

2493dbc96b18cdb2c02a6a0fe3a4864d44fec9f3b1f1074058c0e9b2ef728613
SHA512

2d0430f590729b5b9d7318d0b99e7f03c2012698fcf244b2c1ba445c8e061fa5323e68baee628cc4687e0394554295fb22052b8b46d395d799476c3b26919dbf
SSDEEP

49152:6YlIToCNS4wChI2pg+ePCaJ1y+0tozlX8Yew5/iFgrgrs6J8ypUr5:vlqN5sl6w70tozlsYriF6N6uypU

Score

1^/10

Malware Config

Signatures

Files

2493dbc96b18cdb2c02a6a0fe3a4864d44fec9f3b1f1074058c0e9b2ef728613
.exe windows x86

02cddde55074c9513b2472a1c34988be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathIsRelativeW
PathAppendW
PathFileExistsW
PathAddBackslashW

comctl32

_TrackMouseEvent
ord17

gdiplus

GdipCreateFontFromLogfontA
GdipDrawRectangleI
GdipGetPathFillMode
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdiplusStartup
GdipCreateTexture
GdipAddPathRectangleI
GdipAddPathEllipseI
GdipSetPathFillMode
GdipGetPathWorldBoundsI
GdipStartPathFigure
GdipClonePath
GdipIsOutlineVisiblePathPointI
GdipAddPathPolygonI
GdipIsVisiblePathPointI
GdipAddPathLine2I
GdipResetPath
GdipAddPathBezierI
GdipAddPathArcI
GdipDrawEllipseI
GdipDeletePath
GdipCreatePath
GdipSetStringFormatLineAlign
GdipCreateSolidFill
GdipSetStringFormatTrimming
GdipFillPath
GdipAddPathLineI
GdipDrawBezierI
GdipFillRectangle
GdipClosePathFigure
GdipCreateFontFromDC
GdipDrawPath
GdipDrawString
GdipFillEllipseI
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDeleteStringFormat
GdipDeleteFont
GdipSetStringFormatAlign
GdipDrawLineI
GdipSetStringFormatFlags
GdipAddPathCurveI
GdipScaleMatrix
GdipGetPenDashStyle
GdipSetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenColor
GdipSetPenStartCap
GdipGetPenLineJoin
GdipClonePen
GdipGetPenWidth
GdipSetPenDashStyle
GdipSetPenWidth
GdipGetPenDashCap197819
GdipSetPenLineJoin
GdipSetPenEndCap
GdipLoadImageFromFile
GdipImageRotateFlip
GdipDrawImageRect
GdipDeleteBrush
GdipRotateMatrix
GdipCreateLineBrushFromRect
GdipSetSmoothingMode
GdipSetWorldTransform
GdipSetLineBlend
GdipTranslateMatrix
GdipCreateFromHDC
GdipCloneBrush
GdipCreatePen2
GdipDeleteGraphics
GdipDrawArc
GdipDeletePen
GdipCreatePen1
GdipTransformPath
GdipCreateMatrix
GdipDeleteMatrix
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipGetImagePaletteSize
GdipCloneImage
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipAlloc
GdipDisposeImage
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipFree
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetImagePalette
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipGetPropertyItemSize
GdipAddPathPieI

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

winmm

timeSetEvent
timeKillEvent
timeGetTime

msimg32

AlphaBlend

wldap32

ord200
ord30
ord301
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord79

crypt32

CertFreeCertificateContext

iphlpapi

GetAdaptersInfo

ws2_32

getpeername
getsockname
getsockopt
ntohl
WSASetLastError
select
recv
htons
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
connect
bind
ntohs
setsockopt
socket
closesocket
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
htonl
send

kernel32

CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
CreateThread
SignalObjectAndWait
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
SwitchToThread
RtlUnwind
ExitThread
GetModuleHandleExW
SetFilePointerEx
GetDriveTypeW
ExitProcess
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FlushFileBuffers
SetStdHandle
GetFullPathNameW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
FindNextFileW
SetEndOfFile
HeapSize
SetThreadAffinityMask
InitializeCriticalSection
SystemTimeToTzSpecificLocalTime
ExpandEnvironmentStringsA
PeekNamedPipe
GetFileType
FormatMessageA
VerifyVersionInfoA
GetSystemDirectoryA
LoadLibraryA
SleepEx
SetLastError
FindClose
GetSystemTimeAsFileTime
FileTimeToSystemTime
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
InterlockedExchange
GetModuleFileNameA
GetCurrentProcess
GetProcAddress
GetModuleHandleW
SizeofResource
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
FreeResource
GetLastError
DeleteFileW
CloseHandle
LoadResource
FindResourceW
CreateProcessW
VerSetConditionMask
VerifyVersionInfoW
GetTickCount
GlobalAlloc
GlobalFree
GetCurrentDirectoryW
GlobalLock
GlobalUnlock
GetFileAttributesW
GlobalSize
LoadLibraryW
MulDiv
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceFrequency
QueryPerformanceCounter
ReadFile
CreateFileW
MultiByteToWideChar
GetFileSize
WideCharToMultiByte
WriteFile
SetFilePointer
LocalFileTimeToFileTime
SystemTimeToFileTime
GetEnvironmentVariableW
InterlockedCompareExchange
GetModuleFileNameW
FreeLibrary
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
SetThreadPriority
GetCurrentThreadId
Sleep
TerminateThread
RaiseException
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
GetStdHandle
GetVersionExW
VirtualQuery

user32

OpenClipboard
UnregisterClassW
WaitMessage
DispatchMessageW
SetTimer
PeekMessageW
MsgWaitForMultipleObjectsEx
CallMsgFilterW
GetQueueStatus
TranslateMessage
PostQuitMessage
KillTimer
ShowWindow
SendMessageW
MessageBoxW
PostMessageW
EnableWindow
EndPaint
BeginPaint
GetCursorPos
ReleaseDC
IsIconic
InvalidateRect
LoadImageW
ReleaseCapture
PtInRect
GetClassInfoExW
UpdateLayeredWindow
GetClientRect
SetWindowLongW
SetCapture
LoadCursorW
GetUpdateRect
SetPropW
SetFocus
IntersectRect
IsRectEmpty
MoveWindow
RegisterClassW
GetMonitorInfoW
IsWindow
RegisterClassExW
SetWindowTextW
GetSystemMetrics
ScreenToClient
CreateWindowExW
MonitorFromWindow
GetPropW
SetWindowPos
GetDC
DestroyWindow
GetFocus
GetWindowRect
GetWindow
CallWindowProcW
GetKeyState
DefWindowProcW
MapWindowPoints
IsClipboardFormatAvailable
SetCursor
SetClipboardData
GetClipboardData
CharNextW
GetSysColor
EmptyClipboard
CloseClipboard
ClientToScreen
OffsetRect
GetWindowLongW
GetAsyncKeyState
UnionRect
SetForegroundWindow
IsZoomed
SetWindowRgn
IsWindowVisible
MonitorFromPoint
GetDesktopWindow
FindWindowW
GetParent

gdi32

SelectObject
SetStretchBltMode
DeleteDC
GetWindowOrgEx
SetWindowOrgEx
StretchBlt
GetStockObject
GetObjectA
SaveDC
ExtSelectClipRgn
CreateRectRgnIndirect
GetObjectW
CreateDIBSection
DeleteObject
CreateFontIndirectW
CreateRoundRectRgn
GetDeviceCaps
CreateCompatibleDC
BitBlt
RestoreDC

advapi32

CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegOpenKeyExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
RegQueryValueExW
CryptHashData
CryptDestroyHash

shell32

SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
SHCreateDirectoryExW

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemFree

Sections

.text
Size: 1.1MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02cddde55074c9513b2472a1c34988be

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

comctl32

gdiplus

imm32

winmm

msimg32

wldap32

crypt32

iphlpapi

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 1.1MB - Virtual size: 1.0MB

.rdata Size: 212KB - Virtual size: 211KB

.data Size: 23KB - Virtual size: 28KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 54KB - Virtual size: 53KB

.text
Size: 1.1MB - Virtual size: 1.0MB

.rdata
Size: 212KB - Virtual size: 211KB

.data
Size: 23KB - Virtual size: 28KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 54KB - Virtual size: 53KB