2c5861c2a2a22c2162b6e5cfc54cfb5c337d90690442a02ef78d49ea16e7dfd4

Sharing

Copy URL Twitter E-mail

General

Target

2c5861c2a2a22c2162b6e5cfc54cfb5c337d90690442a02ef78d49ea16e7dfd4
Size

3.4MB
MD5

3e6fc3ceda7a124eacae9e2faace1690
SHA1

588295e46d303756fa743136a49726a43cca1229
SHA256

2c5861c2a2a22c2162b6e5cfc54cfb5c337d90690442a02ef78d49ea16e7dfd4
SHA512

8f1192b248fa07b35b8825cd26b6e6324821432b85aa0cd329bd0d966492463bf740240c19c78cd51b1ea9fc2c8c79aa85943d52572a55d4173a4192c1d56b97
SSDEEP

49152:uELFrMdl6k8jOP27NrAFTPbsSZtqwTLh4RrYw5HUiwZJ:/MvWr7Nr0FqMVi+

Score

1^/10

Malware Config

Signatures

Files

2c5861c2a2a22c2162b6e5cfc54cfb5c337d90690442a02ef78d49ea16e7dfd4
.exe windows x86

50b8d2e35e74af217b15e2ea7176d5e1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateThread
DecodePointer
IsBadReadPtr
LoadLibraryA
lstrlenW
GetNativeSystemInfo
SetLastError
GetProcessHeap
HeapFree
Sleep
HeapSize
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
GetProcAddress
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
GetSystemDirectoryW
LocalAlloc
LocalFree
OpenProcess
GetCurrentProcessId
GetLogicalDriveStringsW
GetModuleHandleW
QueryDosDeviceW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
CreateEventW
GetFileSize
ReadFile
GetModuleFileNameW
HeapReAlloc
CreateFileW
lstrcpyW
LoadLibraryW
DeleteFileW
GetPrivateProfileIntW
WideCharToMultiByte
GetVersionExW
GetDiskFreeSpaceExW
lstrcmpW
WinExec
GetTempPathW
LockResource
MultiByteToWideChar
FindResourceW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
InterlockedDecrement
CloseHandle
InterlockedIncrement
WriteConsoleW
SetEndOfFile
FlushFileBuffers
GetTimeZoneInformation
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
GetStringTypeW
GetConsoleCP
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
GetDriveTypeW
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetACP
GetTickCount
GetCurrentDirectoryW
FreeResource
ExitProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryW
GetLocalTime
GetLongPathNameW
GetFileAttributesW
GetTempFileNameW
CopyFileW
GetExitCodeProcess
FindClose
SetFileAttributesW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
MoveFileExW
RemoveDirectoryW
ReadProcessMemory
CreateProcessW
FileTimeToSystemTime
ReleaseMutex
CreateMutexW
GetVolumeInformationW
GetWindowsDirectoryW
DeviceIoControl
OutputDebugStringA
SetPriorityClass
VerSetConditionMask
SetErrorMode
SystemTimeToTzSpecificLocalTime
GetVersion
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
lstrcpynW
GetFileAttributesExA
SleepEx
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
VerifyVersionInfoA
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetStdHandle
PeekNamedPipe
FormatMessageA
GetSystemTime
FlushConsoleInputBuffer
GlobalMemoryStatus
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetFullPathNameW
FindFirstFileExW
AreFileApisANSI

user32

InflateRect
OffsetRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
UpdateLayeredWindow
SetFocus
GetFocus
GetKeyState
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
GetClientRect
GetCursorPos
ScreenToClient
MapWindowPoints
IsRectEmpty
PtInRect
GetParent
GetWindow
wsprintfW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
MonitorFromWindow
GetMonitorInfoW
IsIconic
IsZoomed
SetWindowRgn
IntersectRect
CharPrevW
DrawTextW
SetCursor
SetRect
CreateCaret
HideCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
GetDoubleClickTime
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
InvalidateRgn
GetDesktopWindow
GetClassNameW
GetWindowThreadProcessId
FindWindowExW
GetShellWindow
SystemParametersInfoW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
ShowWindow
SetWindowPos
PostQuitMessage
PostMessageW
SendMessageW
GetWindowLongW
SetWindowLongW
LoadIconW
LoadStringW
IsWindow
SetForegroundWindow
FindWindowW
CharNextW
MoveWindow
GetForegroundWindow
GetWindowRect
InvalidateRect
FillRect
SetTimer
ShowCaret

advapi32

CryptGetProvParam
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
RegCloseKey
RegCreateKeyExW
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountSidW
DuplicateTokenEx
RegEnumKeyW
RegOpenKeyW
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegEnumValueA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
CryptEnumProvidersA

shell32

ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetFileInfoW
ord155
SHGetFolderLocation
SHGetDesktopFolder
SHGetDataFromIDListW
SHAppBarMessage

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysAllocString
SysFreeString
VariantClear
VarUI4FromStr
VariantInit

gdiplus

GdipCreateFromHDC
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectRectI
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectI

shlwapi

StrCpyW
PathFileExistsW
PathAppendW
PathFindFileNameW

psapi

GetProcessImageFileNameW
EnumProcessModules
GetModuleFileNameExW

crypt32

CertGetCertificateContextProperty
CertFindCertificateInStore
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertGetNameStringW
CertFreeCertificateContext
CryptMsgClose
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

msimg32

AlphaBlend

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

wininet

InternetOpenW
InternetOpenUrlW
InternetCloseHandle
InternetSetOptionW
InternetReadFile
HttpQueryInfoW

urlmon

URLDownloadToFileW

comctl32

_TrackMouseEvent
ord17

ws2_32

bind
getservbyname
gethostbyname
htonl
shutdown
getaddrinfo
WSACleanup
freeaddrinfo
gethostname
ioctlsocket
WSAStartup
accept
WSAGetLastError
socket
__WSAFDIsSet
select
WSASetLastError
recv
send
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSAIoctl
sendto
recvfrom
listen

wldap32

ord60
ord41
ord211
ord46
ord217
ord143
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord50

gdi32

BitBlt
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
CreateDIBSection
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
MoveToEx
TextOutW
GetDeviceCaps
GetObjectA
GetDIBits
CreateBitmap
CreateDCW
CreateCompatibleBitmap

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 509KB - Virtual size: 509KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 40.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50b8d2e35e74af217b15e2ea7176d5e1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

psapi

crypt32

msimg32

version

wininet

urlmon

comctl32

ws2_32

wldap32

gdi32

imm32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 509KB - Virtual size: 509KB

.data Size: 50KB - Virtual size: 83KB

.gfids Size: 512B - Virtual size: 436B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.5MB - Virtual size: 40.6MB

.reloc Size: 99KB - Virtual size: 98KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 509KB - Virtual size: 509KB

.data
Size: 50KB - Virtual size: 83KB

.gfids
Size: 512B - Virtual size: 436B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.5MB - Virtual size: 40.6MB

.reloc
Size: 99KB - Virtual size: 98KB