1a7b0f981a7ddb5fd4399d1c2b7c754b028ce9d8e7207b6a33191ae595776b3b

Sharing

Copy URL Twitter E-mail

General

Target

1a7b0f981a7ddb5fd4399d1c2b7c754b028ce9d8e7207b6a33191ae595776b3b
Size

817KB
MD5

4af02951140d228fe3c4c4d60f3bf950
SHA1

79b8b0963aae40d2f5c32e3136a55e9c51662214
SHA256

1a7b0f981a7ddb5fd4399d1c2b7c754b028ce9d8e7207b6a33191ae595776b3b
SHA512

e1a968413f8d81b5357b65af6fbc2b6454b321432b15689f58f9d7af689164b9d7e55f9279ad32ce96ccc4263e2b73c8560fd9bf383b4430b382ebdcd5fb2245
SSDEEP

24576:wcw7/65AAO8HKnyecu0s9ZytRDM84cf+YWk:wcw7/dAgnSaZgDM8lWk

Score

N/A

Malware Config

Signatures

Files

1a7b0f981a7ddb5fd4399d1c2b7c754b028ce9d8e7207b6a33191ae595776b3b
.exe windows x64

10a3eb5d4eb2b454de32c5b3d99e2903

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExpandEnvironmentStringsW
GetFullPathNameW
RegisterWaitForSingleObject
CreateEventW
UnregisterWaitEx
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetComputerNameExW
CompareStringW
GetLocaleInfoW
EnumUILanguagesW
CreateFileW
HeapSetInformation
FreeLibrary
GetProcAddress
LoadLibraryW
LocalFree
EnterCriticalSection
LocalAlloc
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetLastError
WideCharToMultiByte
GetLastError
MultiByteToWideChar
CloseHandle
GetCurrentThread
GetVersionExW
GetSystemDirectoryW
LoadLibraryExW

msvcrt

_itow
_ultow
iswalnum
_CxxThrowException
__CxxFrameHandler3
??1type_info@@UEAA@XZ
memcpy
memset
fwprintf
_iob
_wcsicmp
__wgetmainargs
__C_specific_handler
_XcptFilter
wcsstr
wcstoul
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
_exit
_cexit
exit
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_wcsnicmp
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
wcschr
_wtoi
_scwprintf
_wtoi64
iswspace
wcsncmp
_vsnwprintf
_purecall
memcmp

ntdll

EtwLogTraceEvent
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwEventRegister
EtwEventUnregister
EtwEventWrite
EtwEventEnabled

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysAllocString
SysStringLen
VariantInit
VarCmp
VariantClear
SysFreeString

httpapi

HttpSetServiceConfiguration
HttpTerminate
HttpDeleteServiceConfiguration
HttpQueryServiceConfiguration
HttpInitialize

wsmsvc

?AllocBstr@WSManMemory@@SAPEAGPEBGHAEBVCallSite@TestSystem@@@Z
?Free@WSManMemory@@SAXPEAXAEBVCallSite@TestSystem@@@Z
?Alloc@WSManMemory@@SAPEAX_KAEBVCallSite@TestSystem@@W4Mode@3@@Z

advapi32

FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
SetThreadToken
RevertToSelf
CopySid
GetLengthSid
IsWellKnownSid
CredDeleteW
CredFree
CredWriteW
CredReadW
RegConnectRegistryW
LogonUserW
RegCreateKeyExW
RegEnumKeyExW
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
MapGenericMask
GetAce
GetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTokenInformation
OpenThreadToken
OpenProcessToken

crypt32

CertFreeCertificateContext
CryptBinaryToStringW
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptAcquireCertificatePrivateKey
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CertCloseStore
CertGetNameStringW
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW

netutils

NetApiBufferFree

wkscli

NetGetJoinInformation

rpcrt4

UuidCreate

ws2_32

WSAStartup
getnameinfo
freeaddrinfo
WSACleanup
getaddrinfo

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 560KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

10a3eb5d4eb2b454de32c5b3d99e2903

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

ole32

oleaut32

httpapi

wsmsvc

advapi32

crypt32

netutils

wkscli

rpcrt4

ws2_32

Sections

.text Size: 235KB - Virtual size: 234KB

.data Size: 8KB - Virtual size: 10KB

.pdata Size: 11KB - Virtual size: 10KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 560KB - Virtual size: 2.4MB

.text
Size: 235KB - Virtual size: 234KB

.data
Size: 8KB - Virtual size: 10KB

.pdata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 560KB - Virtual size: 2.4MB