6a168c22c43ae96af35e2ef46879911542eaed4836825dcf0cb03ef8512e9132

Sharing

Copy URL Twitter E-mail

General

Target

6a168c22c43ae96af35e2ef46879911542eaed4836825dcf0cb03ef8512e9132
Size

785KB
MD5

3f9fb924769c760ec1cd30d10353ce24
SHA1

48e31f5b72c1cb2b88e8cd422de319b120bf75e6
SHA256

6a168c22c43ae96af35e2ef46879911542eaed4836825dcf0cb03ef8512e9132
SHA512

213b573c9576016580f519eb132ac71e2e98fe9215f9f15e4fd7452b7356e16483dcc7c6496afb3cfa399f0d50726d52563d112370f32c529dd63c82ee4a7838
SSDEEP

12288:UDohuNcjcYKrOtzmYdD28tS/j3TVhXSWE7RWLWTsl/Ho9fhiR:UDohuNcjptzmKDe5qtWyTo/Ho9AR

Score

1^/10

Malware Config

Signatures

Files

6a168c22c43ae96af35e2ef46879911542eaed4836825dcf0cb03ef8512e9132
.exe windows x86

89b0eaccb6b287c20fa049b513a04de2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
InitializeCriticalSectionAndSpinCount
HeapDestroy
LeaveCriticalSection
RaiseException
GetLastError
HeapSize
EnterCriticalSection
RemoveDirectoryW
DecodePointer
DeleteCriticalSection
DeleteFileW
GlobalAddAtomW
lstrlenW
InterlockedIncrement
InterlockedDecrement
GlobalLock
GlobalAlloc
MulDiv
GlobalUnlock
FlushInstructionCache
GetLocalTime
GetCurrentThreadId
WinExec
GetCurrentProcessId
SearchPathW
SetEvent
GetTickCount
TerminateThread
CreateEventW
SetFilePointer
SetEndOfFile
WriteFile
GetDriveTypeW
OutputDebugStringW
GetSystemDirectoryW
lstrcmpiW
DuplicateHandle
ResumeThread
CreateFileW
GlobalDeleteAtom
IsBadStringPtrW
TlsGetValue
QueryPerformanceCounter
GetModuleHandleExW
InitializeCriticalSection
GetProcessTimes
TlsSetValue
TlsAlloc
TlsFree
OutputDebugStringA
FindResourceW
ReadFile
GetFileSizeEx
CreateDirectoryA
GetSystemInfo
GetFileAttributesExW
SetFileAttributesW
SetUnhandledExceptionFilter
FlushFileBuffers
ReleaseMutex
GetExitCodeThread
WaitForMultipleObjects
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
DosDateTimeToFileTime
SetFileTime
LocalFileTimeToFileTime
GetSystemPowerStatus
IsBadWritePtr
LoadLibraryExW
WaitForMultipleObjectsEx
CopyFileW
SetThreadPriority
ReleaseSemaphore
CreateSemaphoreW
MoveFileW
GetUserDefaultUILanguage
EndUpdateResourceW
BeginUpdateResourceW
UpdateResourceW
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
EncodePointer
GetStringTypeW
HeapFree
MoveFileExW
HeapAlloc
CreateMutexW
HeapReAlloc
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetProcAddress
SetLastError
GetPrivateProfileIntW
GetTempPathW
MultiByteToWideChar
TerminateProcess
SizeofResource
LoadLibraryW
WideCharToMultiByte
OpenProcess
GetModuleHandleW
CreateDirectoryW
GetCurrentProcess
CreateProcessW
LoadResource
FreeLibrary
CreateThread
CloseHandle
Sleep
WaitForSingleObject
ExpandEnvironmentStringsW
GetCommandLineW
lstrcpyW
LocalFree
GetWindowsDirectoryW
FindNextFileW
lstrcatW
FindClose
WritePrivateProfileStringW
lstrcmpW
GetModuleFileNameW
GetFileAttributesW
GetVersionExW
GetPrivateProfileStringW
FindFirstFileW
lstrcpynW

user32

FillRect
RegisterWindowMessageW
CharNextW
GetMessageW
ScreenToClient
DestroyAcceleratorTable
GetWindowTextLengthW
ClientToScreen
EndPaint
KillTimer
SetTimer
DestroyIcon
AllowSetForegroundWindow
IsWindowVisible
GetSystemMetrics
DisableProcessWindowsGhosting
SetForegroundWindow
LoadImageW
IsChild
GetWindowRect
CopyIcon
MessageBeep
SetCapture
GetFocus
GetDesktopWindow
GetParent
InvalidateRgn
LoadCursorW
WindowFromPoint
GetClientRect
CreateAcceleratorTableW
SetFocus
BeginPaint
GetClassInfoExW
GetDC
TranslateMessage
RegisterClassExW
InvalidateRect
GetWindowTextW
GetClassNameW
ReleaseDC
SetCursor
UpdateWindow
MapWindowPoints
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
TrackMouseEvent
DialogBoxIndirectParamW
IsZoomed
UpdateLayeredWindow
GetDlgItem
RedrawWindow
BroadcastSystemMessageW
GetSysColor
GetCursorPos
SendMessageTimeoutW
FindWindowExW
ReleaseCapture
SetWindowTextW
CallWindowProcW
GetWindowThreadProcessId
GetWindow
MoveWindow
PtInRect
ScrollWindowEx
ShowScrollBar
EnableScrollBar
SetScrollPos
SetScrollRange
PostQuitMessage
GetLastInputInfo
DrawTextW
PeekMessageW
MessageBoxW
GetForegroundWindow
AttachThreadInput
DispatchMessageW
DestroyWindow
SetWindowRgn
PostMessageW
SystemParametersInfoW
EndDialog
ShowWindow
RemovePropW
SetPropW
GetWindowLongW
SetWindowLongW
SetWindowPos
IsWindow
CreateWindowExW
GetPropW
DefWindowProcW
UnregisterClassW
FindWindowW
SendMessageW
IsIconic
LockWorkStation
SetLayeredWindowAttributes
PostThreadMessageW

gdi32

DeleteDC
SetTextColor
CreateDIBSection
SetBkColor
SetBkMode
GetObjectType
CreateFontW
GdiAlphaBlend
BitBlt
GetDeviceCaps
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetStockObject
CreateSolidBrush
DeleteObject
CreateRoundRectRgn

advapi32

RegQueryValueExW
ControlService
QueryServiceStatus
StartServiceW
RegOpenKeyW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyW
RegCreateKeyExW

shell32

ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW
SHChangeNotify
SHGetFolderPathA
SHFileOperationW
SHGetDesktopFolder
ord190
ord68
SHAppBarMessage
ord680
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW
CommandLineToArgvW
Shell_NotifyIconW

ole32

CoTaskMemRealloc
CoUninitialize
CoInitialize
CoGetClassObject
OleUninitialize
OleInitialize
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VariantClear
SysAllocString
VarUI4FromStr
VariantChangeType
DispCallFunc
LoadRegTypeLi
OleCreateFontIndirect
SysAllocStringLen
VariantInit
LoadTypeLi
SysStringLen
SysFreeString

ws2_32

WSAStartup
htons
bind
closesocket
send
accept
listen
socket

shlwapi

StrCmpNIW
PathIsRootW
StrCpyNW
PathIsRootA
StrStrIW
StrCmpIW
PathFileExistsW
PathAppendW
StrToIntW
StrStrIA
StrNCatW
SHSetValueW
wnsprintfA
SHGetValueW
wnsprintfW
PathStripToRootW
StrToIntA
PathAppendA
StrCmpNIA
StrCmpW
PathUnExpandEnvStringsW
StrToIntExW

dbghelp

MakeSureDirectoryPathExists

iphlpapi

GetAdaptersInfo

tuba

?RemovePlugin@@YGHPAX@Z
?InitPlugin@@YGPAXPAUHINSTANCE__@@PB_WHI11H@Z

gdiplus

GdipCloneImage
GdipImageGetFrameCount
GdipDrawImageRectRectI
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipLoadImageFromFile
GdipSaveImageToFile
GdipImageGetFrameDimensionsCount
GdipGetPropertyItemSize
GdipDisposeImage
GdipAlloc
GdipGetPropertyItem
GdipImageGetFrameDimensionsList
GdipFree
GdipGetImageWidth
GdipCreateFromHDC
GdipImageSelectActiveFrame
GdipGraphicsClear
GdipDrawImageRectI
GdipDeleteGraphics
GdipGetImageHeight
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusStartup
GdiplusShutdown

winmm

timeSetEvent
timeKillEvent
timeGetTime

imm32

ImmReleaseContext
ImmGetContext

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

libcurl

curl_easy_setopt
curl_easy_perform
curl_easy_cleanup
curl_easy_getinfo
curl_easy_init

wininet

DeleteUrlCacheEntryW

urlmon

URLDownloadToFileW

msvcr120

__crtInitializeCriticalSectionEx
abort
memset
__crtLCMapStringW
islower
_calloc_crt
__crtLCMapStringA
_wcsdup
isupper
__pctype_func
_wfsopen
__uncaught_exception
_unlock
_lock
setlocale
_ismbblead
___lc_codepage_func
___lc_locale_name_func
_errno
___mb_cur_max_func
??0exception@std@@QAE@ABQBDH@Z
__CxxFrameHandler3
_CxxThrowException
memcpy
_wfopen
wcschr
atoi
wcsncpy_s
iswspace
exit
atol
sscanf_s
strpbrk
sscanf
_time64
_memicmp
_stricmp
_unlink
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
_except_handler4_common
fseek
ferror
_ftelli64
_waccess
_vsnwprintf
fread
fopen
printf
_beginthreadex
fopen_s
_endthreadex
__iob_func
realloc
strncpy
_vswprintf_c_l
_getdrives
_vscwprintf
isdigit
srand
rand
_except1
fclose
strcspn
fwrite
memcpy_s
_lock_file
setvbuf
_recalloc
fsetpos
localeconv
fgetc
fflush
_fseeki64
fgetpos
ungetc
_unlock_file
sprintf_s
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
fputc
??_V@YAXPAX@Z
wcscpy_s
wcscat_s
wcstok_s
wcsstr
vsprintf_s
vswprintf_s
malloc
free
_wtoi
_wcsicmp
swprintf_s
_snwprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
memmove
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s

Sections

.text
Size: 516KB - Virtual size: 515KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89b0eaccb6b287c20fa049b513a04de2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

dbghelp

iphlpapi

tuba

gdiplus

winmm

imm32

version

libcurl

wininet

urlmon

msvcr120

Sections

.text Size: 516KB - Virtual size: 515KB

.rdata Size: 196KB - Virtual size: 196KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 34KB - Virtual size: 33KB

.text
Size: 516KB - Virtual size: 515KB

.rdata
Size: 196KB - Virtual size: 196KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 34KB - Virtual size: 33KB