7999be0f9a519a1ed7cb0cffd479c527be6f671866d0920c26eed8c83726dcb5

Sharing

Copy URL Twitter E-mail

General

Target

7999be0f9a519a1ed7cb0cffd479c527be6f671866d0920c26eed8c83726dcb5
Size

3.6MB
MD5

dcecdc372b45a6c2ff63bf65da2e53b7
SHA1

e0f062b49ff7509e7ba02885fe93e27e0c0541b9
SHA256

7999be0f9a519a1ed7cb0cffd479c527be6f671866d0920c26eed8c83726dcb5
SHA512

d95f4d05a8f477a776247e17f9fa65155f7e13f222b9bb39ea78bab07497a5b243fbb8b55aedab6f43210c0517ab41458452ea565d0f3d6f67f6964c716a5f83
SSDEEP

98304:h20o6pPXIhoftWf+BApW6Nq2UO7NrpHKqQkpe:htrPXO2ENUQTpe

Score

1^/10

Malware Config

Signatures

Files

7999be0f9a519a1ed7cb0cffd479c527be6f671866d0920c26eed8c83726dcb5
.exe windows x86

92a933815a0d3650bbcd0ea0cc45d4ee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
SleepEx
QueryPerformanceFrequency
VerifyVersionInfoA
GetFileAttributesExA
GetModuleHandleA
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
GetSystemTime
FlushConsoleInputBuffer
GlobalMemoryStatus
ExitThread
FreeLibraryAndExitThread
ReadConsoleInputA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetACP
GetTickCount
GetCurrentDirectoryW
GetVersionExW
FreeResource
ExitProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MulDiv
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
SetConsoleMode
DosDateTimeToFileTime
CreateDirectoryW
WideCharToMultiByte
GetLocalTime
GetLongPathNameW
GetFileAttributesW
GetTempFileNameW
CopyFileW
GetExitCodeProcess
lstrlenW
ReleaseMutex
CreateMutexW
GetVolumeInformationW
FindClose
RemoveDirectoryW
FindFirstFileW
FindNextFileW
MoveFileExW
ReadProcessMemory
CreateProcessW
VerSetConditionMask
SetErrorMode
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetWindowsDirectoryW
GetVersion
VirtualAllocEx
VirtualFreeEx
WriteProcessMemory
lstrcpynW
AreFileApisANSI
GetFileAttributesExW
DeviceIoControl
OutputDebugStringA
SetPriorityClass
VirtualProtect
SetLastError
GetNativeSystemInfo
LoadLibraryA
IsBadReadPtr
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetModuleHandleExW
WriteConsoleW
GetFullPathNameW
FindFirstFileExW
SetConsoleCtrlHandler
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetDriveTypeW
ReadConsoleW
SetFilePointerEx
FlushFileBuffers
SetEndOfFile
GetDiskFreeSpaceExW
WinExec
GetTempPathW
LockResource
MultiByteToWideChar
FindResourceW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DeleteFileW
LoadLibraryW
lstrcpyW
WriteFile
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
QueryDosDeviceW
GetModuleHandleW
GetLogicalDriveStringsW
GetCurrentProcessId
OpenProcess
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetProcAddress
GetSystemDirectoryW
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
InitializeCriticalSection
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
CreateFileW
GetModuleFileNameW
ReadFile
GetFileSize
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
CloseHandle
Sleep
WaitForSingleObject
SetEvent
GetExitCodeThread
TerminateThread
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SystemTimeToFileTime

user32

SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetRect
FillRect
DrawTextW
CharPrevW
IntersectRect
SetWindowRgn
IsZoomed
IsIconic
GetMonitorInfoW
MonitorFromWindow
GetPropW
SetPropW
GetSystemMetrics
CreateWindowExW
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
wsprintfW
GetWindow
GetParent
PtInRect
IsRectEmpty
MapWindowPoints
ScreenToClient
GetCursorPos
GetClientRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetCaretPos
KillTimer
ReleaseCapture
SetCapture
GetKeyState
GetFocus
SetFocus
UpdateLayeredWindow
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
OffsetRect
InflateRect
SetCursor
ClientToScreen
GetSysColor
GetDoubleClickTime
GetShellWindow
SendMessageW
PostMessageW
PostQuitMessage
ShowWindow
SetWindowPos
SetTimer
InvalidateRect
GetWindowLongW
SetWindowLongW
LoadIconW
LoadStringW
IsWindow
SetForegroundWindow
FindWindowW
CharNextW
MoveWindow
GetForegroundWindow
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetWindowRect
SystemParametersInfoW
GetWindowThreadProcessId
GetClassNameW
FindWindowExW
EnableWindow
GetDesktopWindow
InvalidateRgn
CreateAcceleratorTableW
GetWindowTextLengthW
GetWindowTextW
GetDC
SetWindowTextW

advapi32

RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegEnumValueA
RegSetValueExW
RegCreateKeyExW
RegCloseKey
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashA
CryptEnumProvidersA
RegOpenKeyW
RegEnumKeyW
DuplicateTokenEx
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
RegQueryValueExW
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken

shell32

ShellExecuteExW
SHGetFolderPathW
ord155
SHBrowseForFolderW
SHGetPathFromIDListW
SHAppBarMessage
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderLocation
SHGetFileInfoW
SHGetDataFromIDListW
SHGetDesktopFolder

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString
VarUI4FromStr

gdiplus

GdipDeleteGraphics
GdipCreateFromHDC
GdipDrawImageRectRectI
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusShutdown
GdiplusStartup
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDrawImageRectI
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipSetTextRenderingHint
GdipCreateLineBrushI
GdipDeleteBrush
GdipCloneBrush
GdipImageSelectActiveFrame

shlwapi

PathFileExistsW
PathAppendW

psapi

GetProcessImageFileNameW
EnumProcessModules
GetModuleFileNameExW

crypt32

CertFreeCertificateContext
CertCloseStore
CryptQueryObject
CryptMsgGetParam
CertGetNameStringW
CertFindCertificateInStore
CertGetCertificateContextProperty
CryptMsgClose
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

comctl32

ord17
_TrackMouseEvent

gdi32

ExtSelectClipRgn
SetBkColor
SetBkMode
SelectClipRgn
RoundRect
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
StretchBlt
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
CreateDIBSection
GetTextMetricsW
BitBlt
SetStretchBltMode
SelectObject
SaveDC
RestoreDC
Rectangle
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
SetTextColor
MoveToEx
TextOutW
GetDeviceCaps
GetObjectA
CreateBitmap
GetDIBits
CreateDCW
CombineRgn
CreateCompatibleBitmap

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

iphlpapi

GetAdaptersInfo

msimg32

AlphaBlend

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetOpenUrlW
InternetReadFile
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
InternetSetOptionW

ws2_32

connect
getpeername
getsockname
closesocket
htons
ntohs
setsockopt
WSAIoctl
WSAStartup
WSACleanup
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
shutdown
htonl
gethostbyname
getservbyname
bind
WSAGetLastError
send
recv
WSASetLastError
select
__WSAFDIsSet
socket
getsockopt

wldap32

ord35
ord79
ord30
ord200
ord301
ord217
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 508KB - Virtual size: 507KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024KB - Virtual size: 39.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

atvvlr
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kbaon
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bjuek
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

92a933815a0d3650bbcd0ea0cc45d4ee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

psapi

crypt32

comctl32

gdi32

imm32

iphlpapi

msimg32

version

wininet

ws2_32

wldap32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 508KB - Virtual size: 507KB

.data Size: 51KB - Virtual size: 98KB

.gfids Size: 512B - Virtual size: 456B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1024KB - Virtual size: 39.4MB

.reloc Size: 99KB - Virtual size: 99KB

atvvlr Size: 4KB - Virtual size: 4KB

kbaon Size: 4KB - Virtual size: 4KB

bjuek Size: 4KB - Virtual size: 4KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 508KB - Virtual size: 507KB

.data
Size: 51KB - Virtual size: 98KB

.gfids
Size: 512B - Virtual size: 456B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1024KB - Virtual size: 39.4MB

.reloc
Size: 99KB - Virtual size: 99KB

atvvlr
Size: 4KB - Virtual size: 4KB

kbaon
Size: 4KB - Virtual size: 4KB

bjuek
Size: 4KB - Virtual size: 4KB