79848c8eb6f7e3530183381217f4b8d9344bcc55698f256f7347ffd015649bfa

Sharing

Copy URL Twitter E-mail

General

Target

79848c8eb6f7e3530183381217f4b8d9344bcc55698f256f7347ffd015649bfa
Size

4.2MB
MD5

dcca1a5e790053e17c40387953819560
SHA1

49baaeb3a365156e34c694d77284f07a22035892
SHA256

79848c8eb6f7e3530183381217f4b8d9344bcc55698f256f7347ffd015649bfa
SHA512

4ebe02f18d7c835cd327b34c678e18cd18dd5e67de40e8b97fd414c337911651c591476f530e512259f18a1151d89b1f419719da9f7eb633296a3c6a7c8e7528
SSDEEP

98304:IL49ELyIUk2n4HATbZ4j2eTcpE1Kt7qeKo9x4y:8DUk2n4HOZ7G6E1yqEw

Score

1^/10

Malware Config

Signatures

Files

79848c8eb6f7e3530183381217f4b8d9344bcc55698f256f7347ffd015649bfa
.exe windows x86

ae72582dc53332cadcc144f8c649c5c5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
GetLastError
FormatMessageW
GetACP
WideCharToMultiByte
FindResourceW
FindResourceExW
LoadResource
LockResource
SizeofResource
SetEvent
CreateEventW
CloseHandle
WaitForSingleObject
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryW
GetTempPathW
GetTempFileNameW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
GetFileAttributesW
RemoveDirectoryW
CopyFileW
SetFileAttributesW
TerminateProcess
GetCurrentProcess
FindFirstFileW
FindNextFileW
FindClose
FreeLibrary
GetComputerNameW
GetCurrentDirectoryW
CreateMutexW
OpenEventW
CreateThread
TerminateThread
GetTickCount
GetStartupInfoW
GetCommandLineW
CreateProcessW
Sleep
GetExitCodeProcess
WaitForMultipleObjects
SetEndOfFile
SetFilePointerEx
GetPrivateProfileIntW
WritePrivateProfileStringW
lstrlenA
OutputDebugStringW
AllocConsole
InterlockedCompareExchange
SetFilePointer
WriteFile
InterlockedExchange
lstrlenW
GetVersionExW
GetModuleHandleW
GetSystemInfo
SetUnhandledExceptionFilter
SetLastError
GetModuleFileNameW
LoadLibraryW
GetDriveTypeA
GetLocaleInfoW
GetConsoleOutputCP
WriteConsoleA
VirtualQuery
GetCurrentDirectoryA
GetProcessHeap
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetEnvironmentVariableA
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetTimeZoneInformation
GetModuleHandleA
GetModuleFileNameA
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
GetStartupInfoA
SetHandleCount
FlushFileBuffers
GetConsoleCP
HeapSize
CompareStringW
CompareStringA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
SetStdHandle
ExitThread
MoveFileW
GetCPInfo
SetConsoleCtrlHandler
HeapAlloc
HeapReAlloc
IsDebuggerPresent
GetProcAddress
CreateFileW
GetCurrentProcessId
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedExchangeAdd
DeleteFiber
GetEnvironmentVariableW
GetVersion
GetFileType
GetStdHandle
GetSystemTimeAsFileTime
ConvertFiberToThread
QueryPerformanceCounter
GlobalMemoryStatus
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetUserDefaultLCID
RaiseException
CreateIoCompletionPort
PostQueuedCompletionStatus
GetExitCodeThread
ResumeThread
CancelIo
SuspendThread
GetCurrentThread
GetFileSize
GetQueuedCompletionStatus
GetStringTypeExW
LCMapStringA
LCMapStringW
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
SwitchToThread
UnlockFile
LockFileEx
SetConsoleTextAttribute
WriteConsoleW
GetConsoleScreenBufferInfo
ExitProcess
FreeResource
SetCurrentDirectoryW
MulDiv
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
SetFileTime
InterlockedIncrement
InterlockedDecrement
IsBadReadPtr
GetLocalTime
GetFileSizeEx
DebugBreak
IsValidCodePage
GetOEMCP
GetFullPathNameW
CreateFileA
GetFileAttributesA
GetFileInformationByHandle
PeekNamedPipe
DeviceIoControl
GetLocaleInfoA
RtlUnwind
HeapFree
UnhandledExceptionFilter
DeleteFileW

user32

EnumWindows
PeekMessageW
RegisterWindowMessageW
IsWindow
SendMessageW
GetPropW
PostMessageW
GetSystemMetrics
GetMessageW
TranslateMessage
DispatchMessageW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
GetWindowLongW
ShowWindow
SetPropW
SetForegroundWindow
SetWindowPos
DrawTextW
SystemParametersInfoW
LoadIconW
PostQuitMessage
SetTimer
IsIconic
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
SetWindowTextW
DestroyWindow
DefWindowProcW
PostThreadMessageW
CreateWindowExW
RegisterClassExW
GetClassInfoExW
LoadStringW
SetFocus
EnableWindow
GetWindow
GetParent
GetWindowRect
CallWindowProcW
GetClientRect
RegisterClassW
LoadCursorW
ScreenToClient
GetMonitorInfoW
MonitorFromWindow
SetWindowRgn
IsZoomed
OffsetRect
InflateRect
SetCursor
wvsprintfW
IntersectRect
IsRectEmpty
PtInRect
EqualRect
CharNextW
GetKeyState
GetDC
InvalidateRect
KillTimer
SetCapture
ReleaseCapture
ReleaseDC
GetFocus
MapWindowPoints
EndPaint
BeginPaint
GetUpdateRect
GetCursorPos
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
SetRect
FillRect
CharPrevW
RemovePropW
GetClassLongW
InvalidateRgn
MoveWindow
CreateAcceleratorTableW
IsWindowVisible
GetWindowTextW
GetWindowTextLengthW
SetWindowLongW

shell32

CommandLineToArgvW
Shell_NotifyIconW
ShellExecuteW

ole32

CoCreateInstance
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoInitializeEx

advapi32

CryptAcquireContextA
CryptEnumProvidersW
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptGenRandom
RegCloseKey
RegSetValueExW
GetTokenInformation
CopySid
RegCreateKeyExW
GetLengthSid

crypt32

CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext

ws2_32

WSAStringToAddressW
WSASocketW
WSACreateEvent
WSAEventSelect
WSAAccept
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
htons
select
WSASetEvent
WSACloseEvent
WSARecv
WSASend
getpeername
send
WSASetLastError
recv
closesocket
bind
listen
setsockopt
connect
socket
ioctlsocket
WSAGetLastError
WSAStartup
inet_addr
htonl
gethostname
WSACleanup
inet_ntoa
gethostbyname

iphlpapi

GetAdaptersInfo

shlwapi

PathCanonicalizeW
PathIsRelativeW
PathSearchAndQualifyW
PathFindFileNameW
StrCmpIW
PathFileExistsW
PathFindExtensionW
PathIsDirectoryW
StrCmpW
PathAppendW
StrCmpNIW

mswsock

TransmitFile

psapi

GetModuleFileNameExW

gdiplus

GdipDeleteFont
GdiplusStartup
GdipCreateLineBrushI
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipCreateStringFormat
GdipAlloc
GdipFree
GdipDeleteBrush
GdipDeleteGraphics
GdipDrawRectangle
GdipDrawString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneBrush
GdipCreatePen1
GdipDeletePen
GdipSetPenColor
GdipSetPenDashArray
GdipDrawLine
GdiplusShutdown

comctl32

_TrackMouseEvent
ord17

gdi32

CreateFontIndirectW
GetStockObject
CreatePen
DeleteDC
SetWindowOrgEx
Rectangle
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectA
GetTextExtentPointW
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetTextMetricsW
CombineRgn
StretchBlt
CreateDIBSection
SetStretchBltMode
ExtTextOutW
SetBkColor
CreateSolidBrush
LineTo
MoveToEx
RoundRect
SetTextColor
SetBkMode
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
CreateRoundRectRgn
DeleteObject
GetObjectW
GetDeviceCaps
SaveDC
SelectObject
RestoreDC
GetClipBox

oleaut32

VariantClear
SafeArrayPutElement
SafeArrayCreate
SysFreeString
VariantInit
SysAllocString

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 482KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae72582dc53332cadcc144f8c649c5c5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

advapi32

crypt32

ws2_32

iphlpapi

shlwapi

mswsock

psapi

gdiplus

comctl32

gdi32

oleaut32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 482KB - Virtual size: 481KB

.data Size: 59KB - Virtual size: 78KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 116KB - Virtual size: 115KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 482KB - Virtual size: 481KB

.data
Size: 59KB - Virtual size: 78KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 116KB - Virtual size: 115KB