4c3fade69e6df6c7659e878d6813fdf7a9a8324ac61876aa0e9fb01f245d8502

Sharing

Copy URL Twitter E-mail

General

Target

4c3fade69e6df6c7659e878d6813fdf7a9a8324ac61876aa0e9fb01f245d8502
Size

152KB
MD5

3d6cd9e4741d2383ef703f1bcd1e7df0
SHA1

667f0a499387cabd27aa5e2c48b6bfaba67ab448
SHA256

4c3fade69e6df6c7659e878d6813fdf7a9a8324ac61876aa0e9fb01f245d8502
SHA512

2580aab92006571d280bc1372832b8daa03246270b075e41f45080631dd56a5e5c85400d9b134c2ce5fd0c775e051310badc33d52f6b7d0cd0b996993d80c595
SSDEEP

3072:2HRKlhTXiI6CY9PZRAeYGlt1Pz5VPU0lhC1d:gKTOvx9PAeYA1rPp0

Score

N/A

Malware Config

Signatures

Files

4c3fade69e6df6c7659e878d6813fdf7a9a8324ac61876aa0e9fb01f245d8502
.dll windows x86

479f073f7cca3e54b873478c9176571f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

nbcmp

nb_cmp

kernel32

Sleep
DeleteFileA
FindClose
FindNextFileA
FindFirstFileA
Process32Next
Process32First
CopyFileA
CreateThread
GetCurrentProcess
DuplicateHandle
GetProcAddress
GetModuleHandleA
CreateProcessA
WinExec
OpenProcess
TerminateProcess
GetSystemDirectoryA
GetCurrentDirectoryA
GetFileAttributesA
CreateFileA
GetLastError
CloseHandle
CompareStringW
CreateToolhelp32Snapshot
GetCommandLineA
CompareStringA
SetEndOfFile
GetLocaleInfoW
ReadFile
SetStdHandle
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
ExitProcess
GetSystemTimeAsFileTime
HeapFree
SetFileAttributesA
ExitThread
ResumeThread
HeapAlloc
GetCurrentThreadId
SetEnvironmentVariableA
GetVersionExA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
WriteFile
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetFilePointer
UnhandledExceptionFilter
HeapSize
GetACP
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
IsBadCodePtr

advapi32

CreateProcessAsUserA
OpenSCManagerA
StartServiceA
CreateServiceA
OpenServiceA
ChangeServiceConfigA
CloseServiceHandle
OpenProcessToken

ole32

CoCreateGuid

psapi

GetModuleFileNameExA

shlwapi

PathFileExistsA
PathCombineA

Exports

Exports

WTSCdcSvr_001
WTSCdcSvr_002
WTSCdcSvr_003
WTSCdcSvr_004
WTSCdcSvr_005
WTSCdcSvr_006
WTSCdcSvr_007
WTSCdcSvr_008
WTSCdcSvr_009
WTSCdcSvr_010
WTSCdcSvr_011

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

479f073f7cca3e54b873478c9176571f

Headers

File Characteristics

Imports

nbcmp

kernel32

advapi32

ole32

psapi

shlwapi

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 880B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 880B

.reloc
Size: 8KB - Virtual size: 7KB