83b3d11c79990aee6caef5e0a67acf87e8278ffb83add4f9fc0ee81e037864db

Sharing

Copy URL Twitter E-mail

General

Target

83b3d11c79990aee6caef5e0a67acf87e8278ffb83add4f9fc0ee81e037864db
Size

4.4MB
MD5

c6339c0efc5fd1526ac0a01ac5422a1a
SHA1

8a9c8181c8d3942e793900cd27670f82c944677d
SHA256

83b3d11c79990aee6caef5e0a67acf87e8278ffb83add4f9fc0ee81e037864db
SHA512

a6147ae4c7f5637e3e1cd4cc8b1ff43d23aff3503d72d80b9d17d17f2d4f13f9d828baa8ca2ea6333e95c63aefc199c0e789ff7545b855541ea8b4f15a7ff5b0
SSDEEP

98304:VkL09zXq1Wv4IloJNHtviT9o7Rq74k74rbh5i:lzXq1WvRiJNNahodq7t4r

Score

1^/10

Malware Config

Signatures

Files

83b3d11c79990aee6caef5e0a67acf87e8278ffb83add4f9fc0ee81e037864db
.exe windows x86

eaff22d4d22f0f100db21b9a4e348231

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToTzSpecificLocalTime
GetDriveTypeW
lstrlenA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
GetFileInformationByHandle
InterlockedCompareExchange
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
FreeLibraryAndExitThread
GetCurrentDirectoryW
MulDiv
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalUnlock
LocalAlloc
LocalFree
GetCurrentProcess
OutputDebugStringW
GetVersionExW
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetPrivateProfileIntW
WritePrivateProfileStringW
GetLongPathNameW
GetEnvironmentVariableW
GetModuleFileNameW
SetFileAttributesW
GlobalFree
VirtualAlloc
VirtualFree
HeapAlloc
HeapFree
GetProcessHeap
GetExitCodeProcess
WaitForSingleObject
lstrcpyW
GetLogicalDriveStringsW
CreateProcessW
QueryDosDeviceW
HeapDestroy
HeapReAlloc
HeapSize
GetFileSize
ReadFile
GetSystemInfo
GetTickCount
WriteFile
GetModuleHandleW
GetVolumeInformationW
FileTimeToSystemTime
SetPriorityClass
FlushInstructionCache
HeapCreate
InitializeCriticalSection
FreeResource
LockResource
SetLastError
LoadResource
SizeofResource
FindResourceW
GetFullPathNameW
GetLocalTime
GetVersionExA
LoadLibraryA
GetModuleHandleA
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetStringTypeW
WriteConsoleW
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetConsoleCtrlHandler
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
SetEndOfFile
DeleteFiber
SwitchToFiber
VerifyVersionInfoA
GetSystemDirectoryA
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
FormatMessageA
SwitchToThread
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
DecodePointer
WideCharToMultiByte
OutputDebugStringA
InterlockedDecrement
ExitThread
InterlockedIncrement
GetCurrentProcessId
CopyFileW
GetPrivateProfileStringW
TerminateProcess
lstrlenW
GetTempPathW
CreateThread
MoveFileExW
FindNextFileW
FindFirstFileW
RemoveDirectoryW
FindClose
SetCurrentDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
DeleteFileW
CreateFileW
GetSystemDirectoryW
LoadLibraryW
CloseHandle
DeviceIoControl
Sleep
OpenProcess
GetProcAddress
CreateDirectoryW
FreeLibrary

user32

IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MsgWaitForMultipleObjects
SetCapture
GetCapture
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
TrackMouseEvent
GetMonitorInfoW
MonitorFromWindow
GetWindow
GetParent
MapWindowPoints
GetWindowRect
GetClientRect
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
CallWindowProcW
UpdateLayeredWindow
GetFocus
SetFocus
DestroyIcon
CharNextW
PtInRect
EqualRect
IsRectEmpty
UnionRect
IntersectRect
CopyRect
SetCursor
KillTimer
SetTimer
DestroyWindow
IsWindow
DestroyCursor
LoadCursorW
GetKeyState
SetWindowLongW
MapVirtualKeyA
CharLowerBuffW
SystemParametersInfoA
DrawTextW
IsWindowVisible
PostMessageW
FindWindowW
ShowWindow
SetWindowTextW
SendMessageW
UnregisterClassW
MessageBoxW
GetWindowLongW
SetForegroundWindow
GetForegroundWindow
SetWindowPos
GetClassNameW
GetSystemMetrics
GetSysColor
EnableMenuItem
ClientToScreen
GetMessageW
LoadImageW
CreateIconFromResource
LoadBitmapW
ScreenToClient
SetCaretPos
HideCaret
GetCaretBlinkTime
SetRect
CreateCaret
GetCursorPos
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
DefWindowProcW
ReleaseCapture
SystemParametersInfoW
GetUserObjectInformationW
GetProcessWindowStation
GetDC
ReleaseDC
InflateRect
OffsetRect
DrawIconEx
GetIconInfo
wsprintfW
LoadStringW
TranslateMessage
DispatchMessageW
PeekMessageW

advapi32

CryptAcquireContextW
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCreateKeyExA
RegCreateKeyExW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
GetTokenInformation
LookupAccountSidW
CloseServiceHandle
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DuplicateTokenEx
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
CreateProcessAsUserW
OpenProcessToken
CryptReleaseContext

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetFolderPathW
SHGetPathFromIDListW
ShellExecuteW
SHChangeNotify

ole32

CreateBindCtx
CoInitialize
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CoUninitialize
CoCreateGuid
CoTaskMemFree
OleInitialize
CoCreateInstance
CreateStreamOnHGlobal
OleUninitialize

shlwapi

SHSetValueW
SHGetValueW
PathFileExistsW
SHDeleteKeyW
SHDeleteValueW
StrToIntExW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

gdiplus

GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageGraphicsContext
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdipGetImageWidth
GdipFree
GdipAlloc
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdiplusStartup
GdipImageGetFrameCount
GdipGetImageEncoders
GdipDeleteGraphics
GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageEncodersSize

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext

gdi32

CreateBitmap
CreateDIBSection
SelectObject
SelectClipRgn
IntersectClipRect
GetRegionData
ExtCreateRegion
DeleteObject
DeleteDC
SetViewportOrgEx
BitBlt
EnumFontsW
CreateRoundRectRgn
GetViewportOrgEx
GetCurrentObject
StretchBlt
SetBkMode
Rectangle
GetStockObject
GetCharABCWidthsW
GetObjectW
CreateSolidBrush
CreateFontIndirectW
SetGraphicsMode
GetDeviceCaps
EnumFontFamiliesExW
CreateCompatibleDC
GdiFlush
GetTextFaceW
ExtTextOutW
SetWorldTransform
GetTextMetricsW
SetTextAlign
SetTextColor
RemoveFontMemResourceEx
AddFontMemResourceEx
GetTextExtentPointI
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsW
GetGlyphOutlineW
GetFontData

oleaut32

SysFreeString
SysAllocString

crypt32

CryptMsgClose
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject

psapi

GetModuleFileNameExW
EnumProcessModules
GetProcessImageFileNameW

wldap32

ord143
ord211
ord60
ord50
ord41
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord22
ord46

ws2_32

WSACleanup
gethostname
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
recv
bind
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
send
WSAStartup

usp10

ScriptFreeCache
ScriptItemize
ScriptShape

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 892KB - Virtual size: 892KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eaff22d4d22f0f100db21b9a4e348231

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

userenv

gdiplus

imm32

gdi32

oleaut32

crypt32

psapi

wldap32

ws2_32

usp10

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rdata Size: 892KB - Virtual size: 892KB

.data Size: 72KB - Virtual size: 181KB

.rsrc Size: 195KB - Virtual size: 194KB

.reloc Size: 175KB - Virtual size: 174KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.rdata
Size: 892KB - Virtual size: 892KB

.data
Size: 72KB - Virtual size: 181KB

.rsrc
Size: 195KB - Virtual size: 194KB

.reloc
Size: 175KB - Virtual size: 174KB