c0946fabdb973b47a0575c2f2e4d2a227e6fc8177f279be874f412b210f875e5

Sharing

Copy URL Twitter E-mail

General

Target

c0946fabdb973b47a0575c2f2e4d2a227e6fc8177f279be874f412b210f875e5
Size

5.3MB
MD5

8efed53ecd2544f6a4a1daa5cff3bfb9
SHA1

7b11c7fadaf35b37477c4a6510b6bbf18721a674
SHA256

c0946fabdb973b47a0575c2f2e4d2a227e6fc8177f279be874f412b210f875e5
SHA512

1b7f43e6967b8d9921818f47d83fb255a31615aa84a353acee9eff1c85617d097259593db2a2b92fe9e5499715e677225f93500055b4a54d6bb6ef60f1462626
SSDEEP

98304:fg+FCU0+5gymK0om0vluJS0ElV1LupLyiWhMoAh:oECU0igU0om0vAA0E1Lw9h

Score

1^/10

Malware Config

Signatures

Files

c0946fabdb973b47a0575c2f2e4d2a227e6fc8177f279be874f412b210f875e5
.exe windows x64

9d291abf4f6e5a5fe78791cfe94f4076

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

VerQueryValueW

kernel32

DeleteCriticalSection
SetNamedPipeHandleState
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
GetLastError
GetProcessHeap
SetThreadPriority
CreateSemaphoreA
GetVolumeInformationW
GetStdHandle
GetVersionExW
UnmapViewOfFile
GetVersion
GetSystemInfo
CreateFileMappingW
MapViewOfFile
VirtualQuery
ReadFile
GetCurrentDirectoryW
HeapAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
GetEnvironmentVariableW
GetStringTypeW
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
GetLocaleInfoW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
RtlCaptureContext
CreateFileA
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetModuleHandleW
IsProcessorFeaturePresent
ResetEvent
GetStartupInfoW
GetFileType
MulDiv
VerSetConditionMask
VerifyVersionInfoW
LoadLibraryA
GetTickCount
ExpandEnvironmentStringsW
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetEnvironmentVariableA
MoveFileExW
PeekNamedPipe
RtlUnwindEx
FreeLibraryAndExitThread
VirtualProtect
GetFileAttributesExW
WriteConsoleW
ExitProcess
CloseHandle
SetConsoleCtrlHandler
GetDriveTypeW
HeapDestroy
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleCP
GetFullPathNameW
FormatMessageW
HeapReAlloc
HeapSize
CreateMutexW
TerminateProcess
GetUserDefaultLCID
GetCommandLineW
LoadLibraryExW
RaiseException
DecodePointer
Sleep
GetModuleFileNameW
TerminateThread
CreateSemaphoreW
WaitForMultipleObjects
GetFileSize
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
SetUnhandledExceptionFilter
GetCurrentProcess
GetSystemDirectoryW
GetTickCount64
LockResource
LoadResource
SizeofResource
FindResourceW
CancelIo
ReadDirectoryChangesW
ExitThread
SetEvent
SleepEx
SetErrorMode
CreateEventW
CreateThread
FreeLibrary
LoadLibraryW
MultiByteToWideChar
GetFileInformationByHandle
LocalFree
GetFileSizeEx
GetTimeFormatW
GetDateFormatW
DeleteFileW
FlushFileBuffers
SetFilePointer
SetEndOfFile
SetFilePointerEx
WriteFile
CreateFileW
FindNextFileW
lstrcmpiW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
FileTimeToSystemTime
LCMapStringW
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
SwitchToFiber
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
GetProcAddress
FindFirstFileW
FindClose
CompareFileTime
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
GlobalFree
IsDebuggerPresent
OutputDebugStringW
SetLastError
ReleaseSemaphore
ReleaseMutex
GetSystemTime
RtlUnwind
CompareStringW
GetCurrentThreadId

user32

DrawTextW
GetProcessWindowStation
GetUserObjectInformationW
GetUpdateRect
GetPropW
SetPropW
LoadImageW
RegisterClassW
SetWindowRgn
IsZoomed
MapVirtualKeyW
IsIconic
CharUpperW
SetActiveWindow
AttachThreadInput
EnumWindows
BringWindowToTop
GetClassNameW
GetDesktopWindow
MonitorFromWindow
MonitorFromPoint
ClipCursor
SetCursor
ReleaseCapture
GetCapture
SetCapture
GetFocus
GetParent
UpdateLayeredWindow
RedrawWindow
BeginPaint
EndPaint
SetWindowTextW
ScreenToClient
GetKeyNameTextW
WindowFromPoint
UnregisterHotKey
RegisterHotKey
RegisterWindowMessageW
UnhookWinEvent
SetWinEventHook
GetSysColor
FindWindowExW
GetDlgItem
UpdateWindow
SetParent
GetForegroundWindow
ChangeClipboardChain
SetClipboardViewer
SystemParametersInfoW
PostQuitMessage
GetWindowRect
InvalidateRect
MoveWindow
GetCursorPos
GetDoubleClickTime
UnionRect
PrivateExtractIconsW
SetMenuItemBitmaps
ShowWindow
SetWindowLongPtrW
SendMessageTimeoutW
IntersectRect
InflateRect
PtInRect
SetRectEmpty
IsRectEmpty
IsWindowVisible
CallWindowProcW
SetForegroundWindow
GetAsyncKeyState
SetWindowLongW
GetWindowLongW
SetFocus
EnableWindow
GetWindow
LoadCursorW
GetClassInfoExW
FindWindowW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
UnregisterClassW
SetTimer
KillTimer
EqualRect
OffsetRect
EnumDisplayMonitors
GetSystemMetrics
CharLowerW
GetMonitorInfoW
PostMessageW
ClientToScreen
GetWindowThreadProcessId
MessageBoxW
wsprintfW
GetWindowTextW
GetWindowTextLengthW
SetWindowPos
MapWindowPoints
GetClientRect
DeleteMenu
GetMenuItemInfoW
EnableMenuItem
SetMenuItemInfoW
InsertMenuItemW
GetMenuItemCount
DestroyIcon
GetIconInfo
GetDC
ReleaseDC
GetKeyState
GetClipboardData
IsClipboardFormatAvailable
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SendMessageW
DestroyMenu
TrackPopupMenu
CreatePopupMenu
RegisterClipboardFormatW
DestroyWindow
GetWindowLongPtrW
DefWindowProcW
RegisterClassExW
CreateWindowExW
IsWindow
AppendMenuW

gdi32

StretchBlt
SaveDC
RestoreDC
GetWindowOrgEx
SetWindowOrgEx
CreateCompatibleBitmap
SetBkMode
SetBkColor
SetTextColor
SetWorldTransform
SetGraphicsMode
CreateRectRgn
CreateRectRgnIndirect
GetClipRgn
SelectClipRgn
PatBlt
BitBlt
GetBitmapBits
GetObjectW
SetViewportOrgEx
GetViewportOrgEx
CreateFontIndirectW
DeleteDC
CreateCompatibleDC
DeleteObject
GetDIBits
CreateDIBSection
SelectObject
CreateRoundRectRgn
GetStockObject
SetStretchBltMode
ExtSelectClipRgn
GetObjectA
GetDeviceCaps

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegCloseKey
CryptAcquireContextW
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RegCreateKeyExW
RegEnumKeyExW
IsValidSid
GetLengthSid
CopySid
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyW
CreateProcessAsUserW
DuplicateTokenEx
DeleteService
ControlService
CloseServiceHandle
StartServiceW
QueryServiceStatus
ChangeServiceConfig2W
OpenServiceW
CreateServiceW
OpenSCManagerW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegNotifyChangeKeyValue

shell32

SHGetDesktopFolder
ShellExecuteExW
ShellExecuteW
SHBindToObject
SHBrowseForFolderW
ord75
ord18
SHCreateShellItemArrayFromIDLists
DragQueryFileW
SHGetSpecialFolderPathW
ord190
SHCreateShellItem
SHOpenFolderAndSelectItems
ord155
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ord165
ord727
ord25
ord88
SHGetFolderLocation
ord19
SHBindToParent
SHParseDisplayName
SHGetFileInfoW
ord68
CommandLineToArgvW
SHCreateItemFromIDList
SHGetFolderPathW

ole32

CoTaskMemFree
RevokeDragDrop
RegisterDragDrop
CoInitializeEx
OleUninitialize
CoTaskMemRealloc
OleInitialize
CoUninitialize
CoInitialize
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemAlloc
OleGetClipboard
OleSetClipboard
CoCreateInstance
ReleaseStgMedium
CoCreateFreeThreadedMarshaler

oleaut32

VarUI4FromStr
SysAllocString
VariantInit
SysFreeString

shlwapi

PathCombineW
PathStripPathW
StrCmpLogicalW
PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
PathFindExtensionW
PathIsDirectoryW
PathAppendW
ord176
PathIsRootW
StrCmpIW
SHDeleteValueW
StrStrIW
SHGetValueW
SHDeleteKeyW
StrRetToBufW
PathIsRelativeW
PathAddBackslashW
wvnsprintfW

comctl32

ord17
_TrackMouseEvent
ord410
ord412
ord413
InitCommonControlsEx

gdiplus

GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipImageRotateFlip
GdipDrawImageRect
GdipSetWorldTransform
GdipRotateMatrix
GdipTranslateMatrix
GdipCreatePen2
GdipSetLineBlend
GdipCreateLineBrushFromRect
GdipDrawArc
GdipResetPath
GdipDeleteMatrix
GdipCreateMatrix
GdipSetPathFillMode
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipImageSelectActiveFrame
GdipDrawPath
GdipDrawImageRectRect
GdipGetPathFillMode
GdipSetEffectParameters
GdipDeleteEffect
GdipCreateEffect
GdipReleaseDC
GdipGetDC
GdipAddPathLine
GdipAddPathArc
GdipAddPathRectangle
GdipClosePathFigure
GdipAddPathLineI
GdipAddPathArcI
GdipAddPathRectangleI
GdipStartPathFigure
GdipAddPathLine2I
GdipAddPathBezierI
GdipAddPathCurveI
GdipResetClip
GdipSetClipPath
GdipFillRectangleI
GdipCreateBitmapFromHBITMAP
GdipBitmapGetPixel
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipSetImageAttributesColorMatrix
GdipGetPenDashCap197819
GdipCreateImageAttributes
GdipGetPenLineJoin
GdipDeletePen
GdipCreatePen1
GdipFillRectangle
GdipFillPath
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipAddPathLine2
GdipDeletePath
GdipCreatePath
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipCreateFromHDC
GdipSaveImageToFile
GdipDrawImageRectRectI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdiplusShutdown
GdipDisposeImage
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipLoadImageFromFile
GdipFree
GdipAlloc
GdiplusStartup
GdipAddPathEllipseI
GdipAddPathPieI
GdipAddPathPolygonI
GdipGetPathWorldBoundsI
GdipIsVisiblePathPointI
GdipIsOutlineVisiblePathPointI
GdipTransformPath
GdipDrawLineI
GdipDrawBezierI
GdipDrawRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipCloneStringFormat
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipGetPenEndCap
GdipDisposeImageAttributes
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDrawString
GdipDrawEllipseI
GdipSetPenLineJoin
GdipSetPenDashStyle
GdipGetPenDashStyle
GdipCreateTexture
GdipDrawRectangle
GdipClonePath
GdipFillEllipseI
GdipMeasureString
GdipBitmapApplyEffect
GdipScaleMatrix

msimg32

AlphaBlend

winmm

timeBeginPeriod
timeSetEvent
timeKillEvent
timeEndPeriod

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

userenv

UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock

crypt32

CertGetIntendedKeyUsage
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenSystemStoreW
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage

ws2_32

htons
getpeername
WSAWaitForMultipleEvents
WSAResetEvent
setsockopt
WSAEnumNetworkEvents
WSACreateEvent
select
WSACloseEvent
getsockname
shutdown
socket
listen
connect
closesocket
bind
accept
WSASetLastError
send
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
getsockopt
ntohs
gethostname
ioctlsocket
WSAIoctl
recvfrom
WSAEventSelect
sendto
htonl
__WSAFDIsSet

wtsapi32

WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken

msi

ord217
ord173

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

wldap32

ord145
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301
ord219

Exports

Exports

getopt_a
getopt_long_a
getopt_long_only_a
getopt_long_only_w
getopt_long_w
getopt_w
optarg_a
optarg_w
opterr
optind
optopt

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d291abf4f6e5a5fe78791cfe94f4076

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

msimg32

winmm

imm32

userenv

crypt32

ws2_32

wtsapi32

msi

iphlpapi

bcrypt

wldap32

Exports

Exports

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 77KB - Virtual size: 99KB

.pdata Size: 144KB - Virtual size: 143KB

.rsrc Size: 537KB - Virtual size: 537KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 77KB - Virtual size: 99KB

.pdata
Size: 144KB - Virtual size: 143KB

.rsrc
Size: 537KB - Virtual size: 537KB

.reloc
Size: 40KB - Virtual size: 40KB