eaf40b18bd69b96e8fc8ae87a8c94045ca7291c88fa8acbe49c24474290d775d

Sharing

Copy URL

Twitter E-mail

General

Target

eaf40b18bd69b96e8fc8ae87a8c94045ca7291c88fa8acbe49c24474290d775d
Size

467KB
MD5

e64264ed93c931d27c22f71fa2814968
SHA1

1a8bb915b4001048dd0d5e244dcb4c449c63160d
SHA256

eaf40b18bd69b96e8fc8ae87a8c94045ca7291c88fa8acbe49c24474290d775d
SHA512

083ab1a37c8bc6f8d5a1063f9b5688e9ce50eb2c818dbed520753120b5d6df0613b01e04956dae13d524b970993af99be5d3ff1407b24c99a548a229f2ebdc41
SSDEEP

12288:WdqbluL1brDnS/ZSM8Htk1QJlVH7M1v3ggebYI+qA6decdzQB7F:Vbl0pPY8HtkCHY13KA6dNAR

Score

N/A

Malware Config

Signatures

Files

eaf40b18bd69b96e8fc8ae87a8c94045ca7291c88fa8acbe49c24474290d775d
.exe windows x86

a99ed52a30acc233024319c495ab6331

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
wcscpy
qsort
_strcmpi
_adjust_fdiv
wcscmp
wcscat
_stricmp
swprintf
sscanf
_wcsicmp
wcsspn
_ultoa
_strnicmp
_except_handler3
wcstoul
strrchr
malloc
_wcsnicmp
strchr
sprintf
_vsnprintf
wcsrchr
wcslen
_initterm

advapi32

OpenThreadToken
DeregisterEventSource
AllocateAndInitializeSid
CredUnmarshalCredentialW
RegEnumKeyExW
RegCloseKey
CryptGetProvParam
QueryServiceStatus
CryptAcquireContextW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
OpenSCManagerW
CryptGetHashParam
SetThreadToken
QueryServiceConfigW
CryptDestroyHash
RegisterTraceGuidsW
RegConnectRegistryW
GetTraceLoggerHandle
GetTokenInformation
OpenServiceW
RegCreateKeyExW
OpenProcessToken
RegOpenKeyW
RegQueryInfoKeyW
RevertToSelf
CryptCreateHash
LookupAccountSidW
RegisterEventSourceW
CryptSetProvParam
SystemFunction006
TraceEvent
ReportEventW
CredFree
FreeSid
RegNotifyChangeKeyValue
CryptReleaseContext
CloseServiceHandle
CryptHashData
RegOpenKeyExW
SystemFunction007

msasn1

ASN1BERDecBitString
ASN1CEREncGeneralizedTime
ASN1BEREncOctetString
ASN1BEREncEndOfContents
ASN1BERDecGeneralizedTime
ASN1BERDecNotEndOfContents
ASN1intx_free
ASN1BEREncS32
ASN1BERDecEndOfContents
ASN1BEREncU32
ASN1_Encode
ASN1_CreateEncoder
ASN1Free
ASN1intxisuint32
ASN1BERDecS32Val
ASN1_CreateDecoder
ASN1BERDecSkip
ASN1BERDecSXVal
ASN1BERDecZeroCharString
ASN1intx2uint32
ASN1_Decode
ASN1BEREncObjectIdentifier
ASN1ztcharstring_free
ASN1_CloseDecoder
ASN1BERDecOctetString
ASN1_CloseEncoder
ASN1BEREncSX
ASN1objectidentifier_free
ASN1BERDecOpenType2
ASN1BERDecBool
ASN1charstring_free
ASN1BEREncExplicitTag
ASN1BERDecPeekTag
ASN1BEREncBitString
ASN1bitstring_free
ASN1DecSetError
ASN1_FreeDecoded
ASN1BERDecObjectIdentifier
ASN1BERDecU32Val
ASN1DecAlloc
ASN1_FreeEncoded
ASN1BEREncBool
ASN1_CreateModule
ASN1intx_setuint32
ASN1octetstring_free
ASN1BEREncCharString
ASN1BERDecExplicitTag
ASN1BEREncOpenType
ASN1EncSetError
ASN1BERDecCharString
ASN1intx2int32

cryptdll

CDBuildIntegrityVect
CDLocateCSystem
CDGenerateRandomBits
CDLocateCheckSum
CDFindCommonCSystemWithKey
MD5Update
MD5Init
MD5Final

kernel32

QueryPerformanceCounter
InterlockedExchangeAdd
lstrcpyW
RegisterWaitForSingleObjectEx
OpenFileMappingW
DeleteCriticalSection
OutputDebugStringA
RaiseException
GetACP
GetLastError
MapViewOfFileEx
GetModuleFileNameW
GetComputerNameW
ExpandEnvironmentStringsW
InterlockedExchange
FreeLibrary
Sleep
EnterCriticalSection
lstrlenA
CreateFileMappingW
GetModuleHandleW
GetCurrentThreadId
LoadLibraryW
GetTickCount
DisableThreadLibraryCalls
lstrcmpiA
CreateFileA
CreateEventW
lstrcmpW
lstrlenW
SetEvent
WideCharToMultiByte
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetProfileStringA
FormatMessageW
GetLocalTime
GetComputerNameExW
GetProcAddress
TerminateProcess
LocalAlloc
DebugBreak
InterlockedIncrement
VirtualAlloc
InterlockedDecrement
CreateFileW
LoadLibraryA
LocalFree
OpenEventW
WriteFile
InterlockedCompareExchange
GetCurrentProcessId
GetSystemInfo
CloseHandle
FileTimeToSystemTime
UnregisterWait
GetCurrentProcess
MultiByteToWideChar
GetEnvironmentVariableW
GetModuleFileNameA
GetCurrentThread
InitializeCriticalSection
UnmapViewOfFile
SetUnhandledExceptionFilter
LeaveCriticalSection

ntdll

RtlAllocateAndInitializeSid
RtlCopyLuid
RtlCompareMemory
NtAllocateLocallyUniqueId
RtlIntegerToUnicodeString
RtlTimeToTimeFields
RtlSetDaclSecurityDescriptor
RtlNtStatusToDosError
RtlInitAnsiString
RtlInsertElementGenericTableAvl
RtlUnicodeStringToAnsiString
NtQueryInformationToken
RtlFreeUnicodeString
RtlCompareUnicodeString
VerSetConditionMask
RtlInitializeSid
RtlCreateTimer
NtSetSecurityObject
RtlInitializeResource
RtlCopyUnicodeString
RtlLookupElementGenericTableAvl
RtlAppendUnicodeStringToString
RtlValidSid
RtlInitializeCriticalSection
DbgPrint
RtlVerifyVersionInfo
RtlOemStringToUnicodeString
RtlCopySid
NtQuerySystemTime
NtOpenProcessToken
RtlInitUnicodeString
RtlCreateAcl
RtlEnterCriticalSection
NtOpenEvent
RtlSubAuthoritySid
RtlUpcaseUnicodeString
NtWaitForSingleObject
RtlSystemTimeToLocalTime
RtlLengthSid
RtlRunDecodeUnicodeString
RtlCreateTimerQueue
RtlPrefixUnicodeString
RtlEqualUnicodeString
RtlGetElementGenericTable
RtlTimeFieldsToTime
RtlDeleteCriticalSection
NtOpenThreadToken
RtlLeaveCriticalSection
RtlAcquireResourceExclusive
RtlUniform
RtlInitializeGenericTable
RtlReleaseResource
RtlConvertSharedToExclusive
RtlAcquireResourceShared
RtlDowncaseUnicodeString
RtlLookupElementGenericTable
RtlEraseUnicodeString
RtlCreateSecurityDescriptor
NtQuerySystemInformation
RtlSubAuthorityCountSid
NtClose
RtlDeleteResource
NtCreateEvent
RtlDeleteElementGenericTable
RtlEqualSid
NtDuplicateObject
RtlInsertElementGenericTable
RtlAnsiStringToUnicodeString
RtlFreeAnsiString
RtlAddAccessAllowedAce
RtlRegisterWait
RtlDeregisterWait
RtlLengthRequiredSid
RtlInitializeGenericTableAvl
RtlConvertSidToUnicodeString
NtAllocateVirtualMemory
RtlDeleteTimerQueue
RtlFreeSid

secur32

FreeContextBuffer
LsaFreeReturnBuffer
CredMarshalTargetInfo
CredUnmarshalTargetInfo
LsaGetLogonSessionData

user32

wsprintfW
CharLowerBuffW

Sections

.text
Size: 270KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a99ed52a30acc233024319c495ab6331

Headers

File Characteristics

Imports

msvcrt

advapi32

msasn1

cryptdll

kernel32

ntdll

secur32

user32

Sections

.text Size: 270KB - Virtual size: 269KB

.reloc Size: 512B - Virtual size: 24B

.data Size: 59KB - Virtual size: 984KB

.rsrc Size: 28KB - Virtual size: 27KB

.rdata Size: 108KB - Virtual size: 108KB

.text
Size: 270KB - Virtual size: 269KB

.reloc
Size: 512B - Virtual size: 24B

.data
Size: 59KB - Virtual size: 984KB

.rsrc
Size: 28KB - Virtual size: 27KB

.rdata
Size: 108KB - Virtual size: 108KB