7f2c4cdb903b3671984a0b30c7b8fb5ab240af35a83c3659bff7238dbcef29cd

Sharing

Copy URL Twitter E-mail

General

Target

7f2c4cdb903b3671984a0b30c7b8fb5ab240af35a83c3659bff7238dbcef29cd
Size

5.1MB
MD5

7d185630f7fbe54c1c243c44dc691f7e
SHA1

ba842790c8256be4715849f54a5e8a859e3d9c6f
SHA256

7f2c4cdb903b3671984a0b30c7b8fb5ab240af35a83c3659bff7238dbcef29cd
SHA512

74532d3ea788334dde6d0508cb054ae523ab0e6d6a8b1cac03cfa52bf3617643de59b7cf724d7cbf37db040ef411f02e174b4610820f9cf7c7ca76435ad55bb9
SSDEEP

98304:5Y8YZ8UY9poVSCv6GYUXKcCE6Z5A4bj0QzACFSVVx3Te:WVrIpu6GHajEc5A4EQzwLx3Te

Score

1^/10

Malware Config

Signatures

Files

7f2c4cdb903b3671984a0b30c7b8fb5ab240af35a83c3659bff7238dbcef29cd
.exe windows x86

90f8566e3d4d787435aad10d86eee987

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
CreateProcessAsUserW
RegCloseKey
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
LookupAccountSidW
RegCreateKeyExW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DuplicateTokenEx
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
GetTokenInformation

ole32

CoCreateGuid
CoInitialize
OleInitialize
OleUninitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CreateStreamOnHGlobal
CoTaskMemFree
CreateBindCtx

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetSpecialFolderLocation
ShellExecuteExW
SHChangeNotify
SHGetPathFromIDListW
ShellExecuteW

shlwapi

PathFileExistsW
StrToIntExW
SHDeleteKeyW
SHDeleteValueW
SHGetValueW
SHSetValueW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

user32

IsRectEmpty
EqualRect
PtInRect
CharNextW
DestroyIcon
SetFocus
GetFocus
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
GetDlgItem
GetActiveWindow
GetClientRect
GetWindowRect
MapWindowPoints
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
TrackMouseEvent
AnimateWindow
SetLayeredWindowAttributes
IsIconic
IsZoomed
GetCapture
SetCapture
ReleaseCapture
UpdateWindow
BeginPaint
EndPaint
InvalidateRect
GetCursorPos
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
EnableWindow
IsWindowEnabled
SetActiveWindow
LoadBitmapW
CreateIconFromResource
LoadImageW
GetMessageW
ClientToScreen
EnableMenuItem
GetSysColor
GetSystemMetrics
MessageBoxW
IsWindowVisible
DrawTextW
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
IntersectRect
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuContextHelpId
MsgWaitForMultipleObjects
GetProcessWindowStation
GetUserObjectInformationW
GetDC
ReleaseDC
InflateRect
OffsetRect
DrawIconEx
IsMenu
GetIconInfo
wsprintfW
GetDesktopWindow
LoadStringW
TranslateMessage
DispatchMessageW
PeekMessageW
GetClassNameW
UnregisterClassW
SetWindowPos
GetForegroundWindow
CopyRect
SetRect
SetCursor
SetForegroundWindow
GetWindowLongW
SetWindowLongW
SendMessageW
SystemParametersInfoW
KillTimer
SetTimer
DestroyWindow
IsWindow
DestroyCursor
LoadCursorW
GetKeyState
UnionRect
SetWindowTextW
ShowWindow
PostMessageW
FindWindowW
PostQuitMessage

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

gdiplus

GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipSaveImageToFile
GdipGraphicsClear
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromStream
GdipImageGetFrameDimensionsCount
GdipGetImageHeight

kernel32

GetFileAttributesW
VirtualAlloc
VirtualFree
VirtualProtect
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
lstrlenW
LoadLibraryA
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleW
SetCurrentDirectoryW
GetTempPathW
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetCurrentThreadId
TryEnterCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetLastError
GetVersionExW
MulDiv
MultiByteToWideChar
LocalAlloc
LocalFree
OutputDebugStringW
ResetEvent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
GlobalLock
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetLongPathNameW
GetExitCodeProcess
CopyFileW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
FindClose
GetEnvironmentVariableW
OutputDebugStringA
RemoveDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
GlobalFree
lstrcpyW
CreateProcessW
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
GetSystemInfo
GetVolumeInformationW
ReleaseMutex
CreateMutexW
FileTimeToSystemTime
SetPriorityClass
FlushInstructionCache
HeapCreate
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetFullPathNameW
GetLocalTime
GetVersionExA
GetModuleHandleA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
GetOEMCP
IsValidCodePage
GetTickCount
ReadFile
WriteFile
GetFileSize
CreateDirectoryW
GlobalUnlock
GlobalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
DeleteFileW
CreateFileW
GetSystemDirectoryW
LoadLibraryW
CloseHandle
DeviceIoControl
Sleep
OpenProcess
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
SetEndOfFile
FormatMessageA
SleepEx
WaitForMultipleObjects
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
SetConsoleMode
ReadConsoleA
GetSystemTime
SystemTimeToFileTime
InterlockedCompareExchange
GetFileInformationByHandle
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
lstrlenA
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW
SetUnhandledExceptionFilter
FindFirstFileExW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
GetFileType
WriteConsoleW
GetACP
ExitProcess
GetStdHandle
GetModuleHandleExW
ExitThread
RtlUnwind

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext

gdi32

SetGraphicsMode
GetDeviceCaps
CreateBitmap
GetCharABCWidthsW
EnumFontsW
BitBlt
SetViewportOrgEx
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
IntersectClipRect
GetRegionData
ExtCreateRegion
DeleteObject
DeleteDC
CreateCompatibleDC
CreateSolidBrush
EnumFontFamiliesExW
GetStockObject
Rectangle
SetBkMode
StretchBlt
GetFontData
GetGlyphOutlineW
GetOutlineTextMetricsW
GetFontUnicodeRanges
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
SetTextAlign
GetTextMetricsW
SetWorldTransform
ExtTextOutW
GetTextFaceW
GdiFlush
GetCurrentObject
GetViewportOrgEx
CreateFontIndirectW
CreateRoundRectRgn

wininet

InternetCloseHandle
InternetQueryOptionW
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetReadFile
InternetOpenUrlW

wldap32

ord60
ord211
ord46
ord143
ord50
ord41
ord22
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord26

ws2_32

select
WSAStartup
WSACleanup
recv
send
WSAGetLastError
WSASetLastError
bind
__WSAFDIsSet
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
gethostname

oleaut32

SysAllocString
SysFreeString
SysStringLen

usp10

ScriptShape
ScriptFreeCache
ScriptItemize

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 917KB - Virtual size: 917KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 946KB - Virtual size: 946KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90f8566e3d4d787435aad10d86eee987

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ole32

shell32

shlwapi

userenv

user32

version

gdiplus

kernel32

imm32

gdi32

wininet

wldap32

ws2_32

oleaut32

usp10

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 917KB - Virtual size: 917KB

.data Size: 77KB - Virtual size: 187KB

.rsrc Size: 946KB - Virtual size: 946KB

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 917KB - Virtual size: 917KB

.data
Size: 77KB - Virtual size: 187KB

.rsrc
Size: 946KB - Virtual size: 946KB