272509e743cd33dfd20eb261bdd7b78280cf33bad70dd880be88c8bed1a2fe0c

Sharing

Copy URL Twitter E-mail

General

Target

272509e743cd33dfd20eb261bdd7b78280cf33bad70dd880be88c8bed1a2fe0c
Size

3.0MB
MD5

5d9ecca163356a0ec0e2ee99970a71e5
SHA1

7912f8b8f57b1dbb58cd0daf47241f36406e7173
SHA256

272509e743cd33dfd20eb261bdd7b78280cf33bad70dd880be88c8bed1a2fe0c
SHA512

993398bc050cd573e83976c8cc0576680c7970f7c88825698500aaee1bc3d75e1c91bd9ac7e56f5bd584bb76cfc76cef2078e6344a30a3ed92d3a0b43822b128
SSDEEP

49152:oCVFTERXveDeuLxL95orB3zxhz8GuR7qdsXF+ARefJlyT04sJQ3Uvg5hEDZ4lem:oP2yulL3orB3zxhz8GuxrX3+0sJQ3Uv

Score

1^/10

Malware Config

Signatures

Files

272509e743cd33dfd20eb261bdd7b78280cf33bad70dd880be88c8bed1a2fe0c
.dll windows x86

fba943e64ff202c8f6e68e1491e6f744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGenerateMessage
ImmReSizeIMCC
ImmUnlockIMCC
ImmLockIMCC
ImmCreateIMCC
ImmUnlockIMC
ImmLockIMC

shlwapi

PathFileExistsA
PathFileExistsW

kernel32

DosDateTimeToFileTime
TlsGetValue
TlsSetValue
FindResourceW
GetFileAttributesW
MulDiv
lstrcpyW
LCMapStringW
GetCurrentThread
GetThreadContext
SuspendThread
ResumeThread
GetModuleFileNameA
lstrlenW
DecodePointer
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WriteFile
VirtualAlloc
VirtualFree
TerminateProcess
ReadProcessMemory
GetSystemDirectoryW
GetPrivateProfileStringA
SetEndOfFile
SetFilePointerEx
CreateFileA
DeleteFileA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetProcAddress
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetCurrentDirectoryW
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
PeekNamedPipe
LocalFileTimeToFileTime
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetFileType
GetModuleHandleExW
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
ExitProcess
GetSystemTime
FormatMessageA
LoadLibraryA
GetFullPathNameW
GetFullPathNameA
GetTempPathA
GetFileAttributesA
UnlockFile
LockFileEx
LockFile
FlushFileBuffers
SetFilePointer
AreFileApisANSI
InterlockedIncrement
OutputDebugStringW
WinExec
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsAlloc
CreateEventW
SetLastError
EncodePointer
TryEnterCriticalSection
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
GetModuleHandleW
LoadLibraryW
GetModuleFileNameW
GetDriveTypeW
SetFileTime
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateThread
TerminateThread
Sleep
CloseHandle
GetLocalTime
GetCurrentProcessId
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LocalAlloc
LocalFree
OpenProcess
GetCurrentProcess
GetExitCodeProcess
GetCurrentThreadId
SizeofResource
LoadResource
LockResource
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
SetUnhandledExceptionFilter
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
GetVersionExW
MoveFileExW
CopyFileW
FindNextFileW
FindFirstFileW
DeleteFileW
SetFileAttributesW
CreateFileW
RemoveDirectoryW
GetWindowsDirectoryW
GetTempPathW
CreateProcessW
lstrcmpiW
GetTickCount
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemInfo
FindClose
ReadFile
GetFileSize
WaitForSingleObject
ResetEvent

user32

SetMenuInfo
GetKeyState
TrackPopupMenu
DeleteMenu
RemoveMenu
ModifyMenuW
InsertMenuW
EnableMenuItem
CharNextW
DrawTextW
GetCapture
GetCaretPos
FindWindowW
PostMessageW
GetWindowThreadProcessId
SetWindowPos
IsWindow
IsWindowVisible
BringWindowToTop
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
CharLowerW
GetGUIThreadInfo
keybd_event
GetSystemMetrics
GetForegroundWindow
GetWindowTextW
GetWindowRect
GetWindowLongW
SetWindowLongW
GetDesktopWindow
GetParent
FindWindowExW
GetClassNameW
SetTimer
KillTimer
SetRect
SendMessageW
DestroyWindow
RegisterWindowMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExW
LoadCursorW
GetDC
ReleaseDC
PtInRect
SystemParametersInfoW
MonitorFromPoint
GetMonitorInfoW
EnumDisplayMonitors
ClientToScreen
WindowFromPoint
LoadStringW
ScreenToClient
SendMessageTimeoutW
ShowWindow
CreateDialogParamW
DialogBoxParamW
EndDialog
GetDlgItem
SetDlgItemTextW
SetWindowTextW
IsIconic
InvalidateRect
CallWindowProcW
MoveWindow
GetDlgItemTextW
SetFocus
MessageBoxW
SetDlgItemInt
GetDlgItemInt
GetAsyncKeyState
ReleaseCapture
ToAscii
SetCapture
SetCursor
OffsetRect
UpdateLayeredWindow
BeginPaint
EndPaint
SetRectEmpty
GetFocus
DestroyMenu
CreatePopupMenu
CreateMenu
GetCursorPos
FillRect
GetClientRect
UnionRect

gdi32

CreateBitmap
DeleteDC
GetDIBits
CreateDCW
BitBlt
CreateDIBSection
SetTextColor
SetBkMode
GetDeviceCaps
GetObjectW
MoveToEx
LineTo
CreatePen
TextOutW
GetTextExtentPoint32W
GetTextExtentPointW
ExcludeClipRect
CreateSolidBrush
CreateFontW
EnumFontsW
CreateICW
GetPixel
SelectObject
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject

advapi32

GetSecurityDescriptorSacl
GetLengthSid
InitializeAcl
GetAclInformation
AddAce
GetAce
AddAccessAllowedAce
InitializeSecurityDescriptor
GetFileSecurityW
SetFileSecurityW
RegSetValueW
RegCreateKeyW
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
LookupAccountNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
SetTokenInformation
LookupAccountSidW
CreateProcessAsUserW
RegDeleteValueW
RegDeleteKeyW
ImpersonateLoggedOnUser
RevertToSelf
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
RegCreateKeyExW
DuplicateTokenEx
EqualSid

shell32

ShellExecuteExW
ShellExecuteW
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderPathW
SHAppBarMessage

ole32

CreateStreamOnHGlobal

psapi

GetModuleFileNameExW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

gdiplus

GdipCloneFont
GdipCloneFontFamily
GdipFillRectangleI
GdipGetGenericFontFamilySansSerif
GdipCloneBitmapAreaI
GdipCreateBitmapFromStream
GdipGetImageRawFormat
GdipDisposeImage
GdipCloneImage
GdipFillPath
GdipDrawPath
GdipDrawLineI
GdipDrawLine
GdipSetImageAttributesColorKeys
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipAddPathArcI
GdipAddPathLineI
GdipDeleteFont
GdipCreateFont
GdipCreateFontFamilyFromName
GdipDrawString
GdipDrawImageRectRectI
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipSetSmoothingMode
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAlloc
GdipDisposeImageAttributes
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipPrivateAddFontFile
GdipGetFontCollectionFamilyCount
GdipDeletePrivateFontCollection
GdipNewPrivateFontCollection
GdipNewInstalledFontCollection
GdipFree
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipGetFontSize
GdipGetFamily
GdipDeleteFontFamily
GdipDeletePath
GdipCreatePath
GdiplusShutdown
GdiplusStartup
GdipFillEllipseI
GdipDrawImageRectI
GdipCreateStringFormat
GdipSetStringFormatAlign
GdipDeleteGraphics
GdipSetStringFormatLineAlign
GdipSetImageAttributesColorMatrix
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetFontCollectionFamilyList

dbghelp

SymGetModuleBase64
SymFunctionTableAccess64
EnumerateLoadedModules64
StackWalk64
SymInitialize

Exports

Exports

CandWndProc
CompWndProc
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 355KB - Virtual size: 354KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 517KB - Virtual size: 517KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fba943e64ff202c8f6e68e1491e6f744

Headers

DLL Characteristics

File Characteristics

Imports

imm32

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

psapi

userenv

gdiplus

dbghelp

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 355KB - Virtual size: 354KB

.data Size: 58KB - Virtual size: 93KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 517KB - Virtual size: 517KB

.reloc Size: 85KB - Virtual size: 85KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 355KB - Virtual size: 354KB

.data
Size: 58KB - Virtual size: 93KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 517KB - Virtual size: 517KB

.reloc
Size: 85KB - Virtual size: 85KB