94e1f765c360cdef4b2e876a23d29bf9b4a472473d3b43c52cb902528fc4f5fe

Sharing

Copy URL

Twitter E-mail

General

Target

94e1f765c360cdef4b2e876a23d29bf9b4a472473d3b43c52cb902528fc4f5fe
Size

263KB
MD5

0be729e2d485d3e0194654207c6b4c13
SHA1

9b02a5b27d227d8e7f038cc8970d30dbbd27d4a9
SHA256

94e1f765c360cdef4b2e876a23d29bf9b4a472473d3b43c52cb902528fc4f5fe
SHA512

6ac4d212da254defc620709d417e415f89a0c39466f6a894428d5a113b0e07c7e9a99ae63f7b3b3e7b03d1a80e1eeea477facda2c278b7e1a6e41593eed71ff1
SSDEEP

6144:D1+VEthq9QD8fPcz3aB5POKZIHGzeT7WR0stVckEXm:pmhQAggamz86+stV42

Score

N/A

Malware Config

Signatures

Files

94e1f765c360cdef4b2e876a23d29bf9b4a472473d3b43c52cb902528fc4f5fe
.exe windows x86

fa68f687d3c439be22e1b834a7c1e164

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetCurrentHwProfileW
SetServiceObjectSecurity
CryptGetDefaultProviderA
RegSetValueExW
SetPrivateObjectSecurity
GetCurrentHwProfileA
EqualSid
GetSidSubAuthority
LookupSecurityDescriptorPartsW
ImpersonateLoggedOnUser
CryptDuplicateKey
GetMultipleTrusteeOperationA
GetSidSubAuthorityCount
GetMultipleTrusteeOperationW
SetTokenInformation
GetSecurityDescriptorDacl
QueryServiceConfigW
IsValidSid
RegisterEventSourceA
GetSecurityInfoExW
LookupAccountSidA
RegSetValueExA
SetEntriesInAccessListW
InitializeSid
MakeSelfRelativeSD
CreateServiceA
LogonUserA
StartServiceCtrlDispatcherA
GetFileSecurityW
CryptEnumProvidersW
LookupPrivilegeNameA
GetTokenInformation
RegQueryInfoKeyA
SetAclInformation
EnumServicesStatusW
CreateServiceW
NotifyChangeEventLog
RegEnumKeyExA
CryptGenKey
GetServiceKeyNameA
CryptEnumProvidersA

shlwapi

StrCatBuffW
wnsprintfW
PathAppendA
PathIsSystemFolderW
StrFormatByteSizeW
SHStrDupA
PathMatchSpecA
SHSetThreadRef
SHGetInverseCMAP
SHRegCreateUSKeyA
ColorHLSToRGB
SHRegSetUSValueW
PathIsDirectoryEmptyW
PathMakeSystemFolderW
ColorAdjustLuma
StrToIntA
UrlGetPartA
SHRegEnumUSKeyA
SHRegCreateUSKeyW
PathRemoveArgsA
PathRemoveArgsW
StrCmpNW
PathIsNetworkPathA
SHGetValueA
PathUndecorateW
StrTrimW
StrCSpnIW
UrlIsOpaqueA
PathFindNextComponentA
SHOpenRegStreamA
StrTrimA
ChrCmpIA
SHDeleteKeyW
StrPBrkA
StrRetToStrW
PathIsFileSpecA
SHEnumValueW
PathRemoveFileSpecW
PathIsURLA
AssocQueryKeyA
StrCSpnA
StrRChrW

kernel32

EnumResourceLanguagesW
ExpandEnvironmentStringsA
IsBadHugeWritePtr
IsDebuggerPresent
GetUserDefaultLCID
LocalShrink
CreateMailslotW
SetConsoleMode
TlsGetValue
GetThreadPriorityBoost
GetLocaleInfoA
WritePrivateProfileSectionA
WriteConsoleOutputCharacterA
WaitNamedPipeA
VirtualAlloc
FileTimeToDosDateTime
GetOverlappedResult
QueryPerformanceCounter
LocalLock
CreateDirectoryW
SuspendThread
CreateMutexA
GetStringTypeA
Thread32Next
VirtualUnlock
InitializeCriticalSectionAndSpinCount
VirtualQuery
OpenWaitableTimerA
GetAtomNameA
SwitchToFiber
OpenProcess
QueueUserAPC
CreateRemoteThread
LoadLibraryA
GetConsoleMode
GetPrivateProfileSectionW
CreateToolhelp32Snapshot
CommConfigDialogW
DebugActiveProcess
CloseHandle
SetFileApisToOEM
SetProcessShutdownParameters
IsBadReadPtr
DeleteFiber
VirtualProtect
CreateFileA

ole32

CoCreateInstance
CoTaskMemRealloc
CoSetProxyBlanket
StgCreateStorageEx
CreateAntiMoniker
CoGetMarshalSizeMax
CreateBindCtx
WriteStringStream
CoRegisterMallocSpy
StgCreateDocfileOnILockBytes
CoIsOle1Class
OleLoad
StringFromGUID2
StgOpenStorageOnILockBytes
OleCreateEx
GetConvertStg
CoFileTimeToDosDateTime
StgGetIFillLockBytesOnILockBytes
ReadStringStream
CreateFileMoniker
StringFromIID
CoImpersonateClient
OleInitialize
CoCreateFreeThreadedMarshaler
OleCreateMenuDescriptor
GetRunningObjectTable
CreateClassMoniker
CreateItemMoniker
CoTreatAsClass
OleInitializeWOW
OleCreateStaticFromData
BindMoniker
CoReleaseServerProcess
CoGetCurrentProcess
DllDebugObjectRPCHook
OleNoteObjectVisible
OleCreateLinkToFile
CoSuspendClassObjects
OleSaveToStream
CoInitializeEx

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa68f687d3c439be22e1b834a7c1e164

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shlwapi

kernel32

ole32

Sections

.text Size: 59KB - Virtual size: 58KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 16KB

.text
Size: 59KB - Virtual size: 58KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 16KB