617a45906bb0ec42467772bd735e48c96571b2377ca9742cc3e856dcbc088d3c

Sharing

Copy URL Twitter E-mail

General

Target

617a45906bb0ec42467772bd735e48c96571b2377ca9742cc3e856dcbc088d3c
Size

2.1MB
MD5

32fc1c185a47c24c1da6969d5f28523a
SHA1

985610c8030c3d6882b12e0bcf14aa7834a9b48b
SHA256

617a45906bb0ec42467772bd735e48c96571b2377ca9742cc3e856dcbc088d3c
SHA512

04930f539aafb1630c5657a729fa90cc4e644554f67bb35284039debce6c2595ba926e3409fd14fa505d049b364266634529ac9ac43f3808c6f6b2acf114f55d
SSDEEP

49152:wZCMfufRp0WdmUAbhmthBxvq6S1hVTZOuNYT2IU+1C:wEMsRp0WDwhmth/q6Qh3+M

Score

1^/10

Malware Config

Signatures

Files

617a45906bb0ec42467772bd735e48c96571b2377ca9742cc3e856dcbc088d3c
.exe windows x86

8fd3a9a17d5c6c797987dea17b99ab8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

OutputDebugStringW
GetFileSizeEx
ReleaseMutex
GetSystemTime
lstrcmpW
GetLogicalDriveStringsW
CreateDirectoryW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
InterlockedExchange
ExpandEnvironmentStringsW
DeleteAtom
AddAtomW
FindAtomW
RemoveDirectoryW
GlobalLock
GlobalUnlock
LocalFree
LocalAlloc
GetVersion
FreeResource
SetFileAttributesW
CreateFileW
ReadFile
WriteFile
GetFileSize
DeleteFileW
GetLocalTime
GetTickCount
WideCharToMultiByte
WaitForMultipleObjects
GetDiskFreeSpaceExW
SetEndOfFile
WriteConsoleW
ReadConsoleW
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
GetConsoleMode
GetConsoleCP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetLastError
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ExitProcess
CopyFileW
GetACP
GetModuleHandleExW
ExitThread
RtlUnwind
GetDriveTypeW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
FlushFileBuffers
GetFileType
GetModuleHandleA
GetStdHandle
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
DeviceIoControl
UnhandledExceptionFilter
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
InterlockedExchangeAdd
GetCPInfo
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetLocaleInfoW
LCMapStringW
CompareStringW
TryEnterCriticalSection
GetExitCodeThread
GetCurrentThread
SwitchToThread
DuplicateHandle
GetStringTypeW
QueryPerformanceCounter
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
GetFileAttributesExW
lstrcpynW
WaitForSingleObjectEx
SystemTimeToFileTime
IsBadReadPtr
SetUnhandledExceptionFilter
VirtualProtect
MultiByteToWideChar
GetVersionExW
GetSystemDirectoryW
FindResourceExW
FindResourceW
GetCommandLineW
CreateProcessW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
InterlockedCompareExchange
GetPrivateProfileIntW
Sleep
CreateThread
GetUserDefaultLangID
MoveFileA
DeleteFileA
CreateFileA
SetFilePointer
SetEvent
GlobalFree
GlobalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MoveFileExW
GetFileAttributesW
GetTempPathW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetStartupInfoW
WaitForSingleObject
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcess
GetShortPathNameW
LoadLibraryW
CreateEventW
CreateMutexW
lstrlenW
lstrcmpiW
CloseHandle
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetCurrentThreadId
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
LockResource
InterlockedDecrement
InterlockedIncrement
DecodePointer
EnumSystemLocalesW

user32

EnumChildWindows
RegisterWindowMessageW
GetMessageW
TranslateMessage
ClientToScreen
DrawTextW
GetMenuItemID
SendMessageTimeoutW
DefWindowProcW
PostQuitMessage
CallWindowProcW
UnregisterClassW
IsWindow
DestroyWindow
DispatchMessageW
DrawFocusRect
UnionRect
OffsetRect
SetWindowPos
GetDlgItem
CharNextW
SendMessageW
TranslateAcceleratorW
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
RemoveMenu
TrackPopupMenuEx
GetMenuItemInfoW
SetMenuItemInfoW
SetMenuDefaultItem
InvalidateRect
GetClientRect
GetWindowRect
MessageBeep
MapWindowPoints
PtInRect
GetWindowLongW
SetWindowLongW
FindWindowW
EqualRect
CheckMenuRadioItem
LoadStringA
LoadStringW
MonitorFromPoint
GetMonitorInfoW
EnumDisplayDevicesW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
ShowWindow
UpdateLayeredWindow
IsWindowVisible
GetAsyncKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
ScreenToClient
GetParent
LoadCursorW
SystemParametersInfoW
SetWindowTextW
SetRectEmpty
GetSystemMetrics
MessageBoxW
FindWindowExW
EnumDisplaySettingsW
CreateDialogParamW
SetFocus
PeekMessageW
PostMessageW
GetMenuState
MoveWindow
GetMenuStringW
TrackMouseEvent
IsIconic
CloseWindow
GetAncestor
SetDlgItemTextW
GetDlgItemTextW
CheckDlgButton
EnableWindow
SetForegroundWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindowInfo
LoadImageW
DestroyIcon
LoadIconW
GetWindowThreadProcessId
GetClassNameW
EnumWindows
GetShellWindow
GetDesktopWindow
WindowFromPoint
SetCursor
GetForegroundWindow
UpdateWindow
DeleteMenu
GetSubMenu
EnableMenuItem
LoadMenuW
GetActiveWindow
EndDialog
DialogBoxParamW
GetDoubleClickTime
ReplyMessage
UnregisterHotKey
RegisterHotKey
SetActiveWindow
MonitorFromWindow
GetWindow
SetParent
CopyRect
IntersectRect
GetCursorPos
IsDialogMessageW

gdi32

EnumFontFamiliesW
CreateFontW
MoveToEx
LineTo
CreatePen
GetDeviceCaps
GetObjectW
CreateDIBSection
SelectClipRgn
SaveDC
RestoreDC
CreateRectRgnIndirect
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
DeleteDC
CreateDCW
PatBlt
StretchBlt
SetStretchBltMode
GetViewportOrgEx
SetViewportOrgEx
GdiFlush
SelectObject
RectVisible
OffsetViewportOrgEx

advapi32

OpenServiceW
CloseServiceHandle
ChangeServiceConfigW
GetTokenInformation
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
CheckTokenMembership
DuplicateTokenEx
LookupPrivilegeValueW
GetLengthSid
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
AdjustTokenPrivileges
SetTokenInformation
OpenProcessToken
RegQueryValueExW
GetUserNameW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LockServiceDatabase
OpenSCManagerW
QueryServiceConfigW
QueryServiceLockStatusW
QueryServiceStatus
QueryServiceStatusEx
StartServiceW
UnlockServiceDatabase
CreateServiceW
RegEnumValueW
RegEnumKeyExA

shell32

Shell_NotifyIconW
ShellExecuteW
ord165
SHCreateDirectoryExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW
SHChangeNotify
SHFileOperationW
CommandLineToArgvW

ole32

CoCreateGuid
CoInitializeSecurity
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CLSIDFromProgID
CoInitialize
CreateStreamOnHGlobal

oleaut32

SysStringLen
SysStringByteLen
VariantClear
VariantInit
SysAllocString
VarUI4FromStr
SysFreeString
SysAllocStringByteLen
VarBstrCmp

shlwapi

StrTrimA
StrCmpNIW
StrCmpW
PathIsDirectoryW
PathFindFileNameW
SHGetValueA
SHSetValueA
SHDeleteKeyW
PathRemoveFileSpecA
StrStrIA
AssocQueryStringW
PathCombineW
StrCmpIW
SHSetValueW
StrStrIW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
SHDeleteValueW
SHGetValueW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawImageRectRect
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipCloneBrush
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdiplusShutdown
GdiplusStartup
GdipFillRectangleI
GdipSetTextRenderingHint
GdipSetStringFormatTrimming
GdipDrawLine
GdipGetImageHeight
GdipGetImageWidth
GdipCreateSolidFill

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

secur32

AcquireCredentialsHandleA
GetUserNameExW
FreeCredentialsHandle
InitializeSecurityContextA

ws2_32

WSAAsyncSelect
WSAAsyncGetHostByName
WSAGetLastError
gethostbyname
socket
shutdown
send
recv
htons
connect
closesocket
WSACleanup
WSAStartup

wininet

InternetQueryOptionA
DeleteUrlCacheEntryW
InternetSetCookieW
InternetGetCookieW
InternetCrackUrlW
InternetGetConnectedState
InternetQueryOptionW

rasapi32

RasGetConnectStatusW
RasEnumConnectionsW

psapi

GetModuleFileNameExW

crypt32

CryptBinaryToStringA
CertGetNameStringW

winmm

timeSetEvent
timeKillEvent
timeBeginPeriod
timeEndPeriod

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8fd3a9a17d5c6c797987dea17b99ab8d

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

urlmon

secur32

ws2_32

wininet

rasapi32

psapi

crypt32

winmm

wintrust

iphlpapi

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 343KB - Virtual size: 343KB

.data Size: 34KB - Virtual size: 53KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 343KB - Virtual size: 343KB

.data
Size: 34KB - Virtual size: 53KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB