a1fc96a3d3cfe715baa15400b4f482628b91479914f58225c09ed4e4501c19d4

Sharing

Copy URL Twitter E-mail

General

Target

a1fc96a3d3cfe715baa15400b4f482628b91479914f58225c09ed4e4501c19d4
Size

530KB
MD5

ef610670c9b727486ff0cbcaa0c6b4fe
SHA1

3bcc0d172bbb56f9dfdc2ff0d2c8224ae6d301a6
SHA256

a1fc96a3d3cfe715baa15400b4f482628b91479914f58225c09ed4e4501c19d4
SHA512

c5587b01999a32b949d7a7efec767208b2a1136a83caec09b1eb0cde1113612cacdb6bbe322c2f16901577eff185af24ab344f3d0a14b17ded93f2f9c6c0b743
SSDEEP

12288:PCSFewHXZVFkt0lPkUxULXtoCzQNxSJ13LkbSfL/tNYRvbHZI:PCSFewHXPFEZomQNxSJ13uSj/vo

Score

N/A

Malware Config

Signatures

Files

a1fc96a3d3cfe715baa15400b4f482628b91479914f58225c09ed4e4501c19d4
.exe windows x64

37d652b75bb5ebf0196bfea6cc0159c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleExW
FreeLibrary
TerminateProcess
ExitProcess
HeapFree
GetProcessHeap
HeapAlloc
Sleep
IsProcessorFeaturePresent
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SwitchToThread
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
LeaveCriticalSection
AddVectoredExceptionHandler
WaitForSingleObject
EnumSystemGeoID
EnterCriticalSection
SleepConditionVariableSRW
WakeConditionVariable
GetSystemInfo
VirtualProtect
MoveFileExW
WriteFile
GetModuleHandleA
GetProcAddress
TryEnterCriticalSection
GetStdHandle
GetConsoleMode
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
SetLastError
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetCommandLineW
GetModuleFileNameW
GetFullPathNameW
InitializeCriticalSection
CloseHandle
GetLastError
GetLogicalDrives
SetHandleInformation
CreateFileW
HeapReAlloc
GetCurrentProcessId
GlobalMemoryStatusEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
GetCurrentThread
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
WakeAllConditionVariable
CreateThread
OpenProcess
ReleaseSRWLockExclusive
ReadProcessMemory
GetProcessTimes
GetProcessIoCounters
GetTickCount64
LocalFree
GetDiskFreeSpaceExW
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetSystemTimeAsFileTime
AcquireSRWLockExclusive

pdh

PdhGetFormattedCounterValue
PdhLookupPerfNameByIndexW
PdhRemoveCounter
PdhOpenQueryA
PdhAddCounterW
PdhCloseQuery
PdhCollectQueryData

shell32

CommandLineToArgvW
ShellExecuteW

snmpapi

SnmpUtilMemAlloc

crypt32

CertFreeCertificateChain
CertDuplicateStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetCertificateChain
CertOpenStore
CertVerifyCertificateChainPolicy

secur32

FreeContextBuffer
FreeCredentialsHandle
QueryContextAttributesW
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleA
DeleteSecurityContext
DecryptMessage
EncryptMessage

ws2_32

WSAGetLastError
connect
setsockopt
WSAStartup
freeaddrinfo
getaddrinfo
WSASocketW
getpeername
send
recv
select
closesocket
ioctlsocket
WSACleanup
getsockopt
getsockname

advapi32

SystemFunction036
RegQueryValueExA

bcrypt

BCryptGenRandom

ntdll

NtQuerySystemInformation
NtQueryInformationProcess
RtlGetVersion

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

powrprof

CallNtPowerInformation

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2

netapi32

NetQueryDisplayInformation
NetUserGetLocalGroups
NetApiBufferFree

oleaut32

SysFreeString
VariantClear
SysAllocString

psapi

GetModuleFileNameExW
EnumProcessModulesEx

msvcrt

?_set_new_mode@@YAHH@Z
_commode
_msize
?terminate@@YAXXZ
__argv
__argc
_environ
__getmainargs
__set_app_type
_XcptFilter
_errno
free
_set_fmode
_initterm_e
_initterm
wcslen
ceil
_amsg_exit
__C_specific_handler
realloc
__CxxFrameHandler3
memcpy
memcmp
memset
memmove

Sections

.text
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

37d652b75bb5ebf0196bfea6cc0159c3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pdh

shell32

snmpapi

crypt32

secur32

ws2_32

advapi32

bcrypt

ntdll

ole32

powrprof

iphlpapi

netapi32

oleaut32

psapi

msvcrt

Sections

.text Size: 331KB - Virtual size: 331KB

.rdata Size: 114KB - Virtual size: 114KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 331KB - Virtual size: 331KB

.rdata
Size: 114KB - Virtual size: 114KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 3KB - Virtual size: 2KB