39813d2e591de9469b932fc498dcda5d4c789f5218fb7d9498a228dff20c085e

Sharing

Copy URL Twitter E-mail

General

Target

39813d2e591de9469b932fc498dcda5d4c789f5218fb7d9498a228dff20c085e
Size

46KB
MD5

166287b6737c253765284a06c278f7b5
SHA1

d4abb602ab10a28c79cfa513ee1ac632cbddf20d
SHA256

39813d2e591de9469b932fc498dcda5d4c789f5218fb7d9498a228dff20c085e
SHA512

536da67f6839ef9e870fe5e409b7f7df8555008ef213b306935ed1de8da02366591118991cd28276544d698d8fdeb7b79f27cce1fc1c2cca8e925727d68ac58c
SSDEEP

768:XWqdJUw2RJ83SKemzX6SRm8crnk1n+dh0a//WeukKi0cPV:VdJUa3SKemzHYk1gW1kZPV

Score

N/A

Malware Config

Signatures

Files

39813d2e591de9469b932fc498dcda5d4c789f5218fb7d9498a228dff20c085e
.exe windows x86

6c5fefe7b03973b29bb998910bec263b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

schannel

QuerySecurityPackageInfoW
FreeContextBuffer
DeleteSecurityContext
InitSecurityInterfaceA
EnumerateSecurityPackagesA
QuerySecurityPackageInfoA
InitializeSecurityContextW
RevertSecurityContext
SslGenerateRandomBits
SpUserModeInitialize
SslGetMaximumKeySize
VerifySignature
AcquireCredentialsHandleA
SpLsaModeInitialize
CompleteAuthToken
QueryContextAttributesA
SslEmptyCacheA
InitializeSecurityContextA
UnsealMessage
EnumerateSecurityPackagesW
SslCrackCertificate
ApplyControlToken
FreeCredentialsHandle
AcceptSecurityContext

msvcrt

_CIcosh
__getmainargs
_spawnvp
_heapchk
__set_app_type
strtok
_Gettnames
bsearch
_strncoll
_mbstrlen
fwprintf
_timezone
__toascii
_ctype
iswctype
_ismbblead
strerror
_vsnwprintf
strcspn
_wtmpnam
srand
__p__commode
_wexeclpe
_wsetlocale
_putwch
strstr
sscanf
_mbscmp
_putw

setupapi

CM_Get_Device_ID_List_SizeA
SetupSetDirectoryIdExW
InstallHinfSectionA
SetupInitializeFileLogW
SetupDiClassNameFromGuidExW
SetupDiGetDeviceInterfaceAlias
VerifyCatalogFile
SetupDiGetClassImageIndex
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Class_NameW
pSetupStringTableLookUpStringEx
CM_Get_Hardware_Profile_Info_ExW
CM_Set_HW_Prof_Ex
SetupPrepareQueueForRestoreA
SetupDiDeleteDeviceInterfaceData
CM_Reenumerate_DevNode
SetupQueryFileLogA
SetupQueryInfFileInformationA
CM_Delete_DevNode_Key_Ex
SetupInstallFromInfSectionW
SetupFindNextMatchLineA
CM_Get_Hardware_Profile_Info_ExA
SetupGetSourceFileLocationW

expsrv

__vbaLateIdNamedStAd
rtcNPer
__vbaNew2
__vbaR4Str
TipUnloadInstance
__vbaLineInputVar
__vbaVarTextLike
rtcStrConvVar
rtcMIRR
rtcPPMT
__vbaRedimPreserve
rtcBstrFromChar
__vbaExceptHandler
__vbaVargVarCopy
rtcCurrentDirBstr
IID_IVbaHost
__vbaLenBstrB
rtcInStrChar
rtcDateAdd
__vbaPut4
__vbaFreeVarList
__vbaVarTextCmpGt
rtcVarFromError
_adj_fdiv_m32i
rtcGetFileAttr
rtcFixVar
__vbaInStrVar
__vbaNameFile
__vbaVarLateMemCallLdRf
rtcRandomize

query

?SetLPSTR@CStorageVariant@@QAEXPBDI@Z
??1CPropertyList@@UAE@XZ
?StopFiltering@CFilterDaemon@@QAEXXZ
?LocaleToCodepage@@YGKK@Z
?Cleanup@CDbProp@@QAEXXZ
?LongInit@CPropStoreManager@@QAEXAAHAAKP6GXKHPBX@Z2@Z
??0CRangeKeyRepository@@QAE@XZ
?Map@CMmStreamConsecBuf@@QAEXK@Z
?Release@CQueryUnknown@@UAGKXZ
?GetNumber@CQueryScanner@@QAEHAAJAAH@Z
?Empty@CRcovStrmWriteTrans@@QAEXXZ
??0CColumns@@QAE@ABV0@@Z
?DecodeURLEscapes@@YGXPAEAAKPAGK@Z
??1CDbCmdTreeNode@@QAE@XZ
?PutWString@CDbCmdTreeNode@@SGXAAVPSerStream@@PBG@Z
?Grow@CDynStream@@QAEXAAVPStorage@@K@Z
?SetUI1@CStorageVariant@@QAEXEI@Z
_StopFWCiSvcWork@16
?VerifyThreadHasAdminPrivilege@@YGXXZ
DllRegisterServer
??1CDFA@@QAE@XZ
??1CVirtualString@@QAE@XZ
?Start@CCatalogAdmin@@QAEHXZ
?Pause@CCatalogAdmin@@QAEHXZ
?SetDATE@CStorageVariant@@QAEXNI@Z

kernel32

GetModuleHandleExW
SetPriorityClass
EnumTimeFormatsA
EnumerateLocalComputerNamesA
DeleteCriticalSection
WriteTapemark
AreFileApisANSI
SwitchToThread
OpenFileMappingA
OpenJobObjectA
CommConfigDialogW
GetProcessPriorityBoost
UpdateResourceW
HeapCreate
OutputDebugStringA
EnumCalendarInfoA
ClearCommBreak
LoadLibraryA
VirtualAlloc
GetProcessIoCounters
GetConsoleWindow
LZSeek
SetConsoleLocalEUDC
WritePrivateProfileSectionA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c5fefe7b03973b29bb998910bec263b

Headers

DLL Characteristics

File Characteristics

Imports

schannel

msvcrt

setupapi

expsrv

query

kernel32

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 17KB - Virtual size: 73KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 512B - Virtual size: 232B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 17KB - Virtual size: 73KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 512B - Virtual size: 232B