3fa6d2bb2fe8cc8991ad22afc199d2944070cef936248f7f6355325de7b079c4

Sharing

Copy URL Twitter E-mail

General

Target

3fa6d2bb2fe8cc8991ad22afc199d2944070cef936248f7f6355325de7b079c4
Size

294KB
MD5

6cde521bde97e96702253587bb331765
SHA1

8aa06b4e8d841540a5c5eac5578ae303fe9f5301
SHA256

3fa6d2bb2fe8cc8991ad22afc199d2944070cef936248f7f6355325de7b079c4
SHA512

2a00fa98994f6f1817315f315bd102a9f47a3418f0d3e02a363288292dcfdb7edf92554bf4ece699f1aabbdfb4efb9d4630190a1bf64e26fece39c14736e4898
SSDEEP

6144:eO1hrcNdv5rnHrm10YH+8U7OKx2DSnkAIE+Q3oyvePN:eArcTpHi1/HVUT2mn/H3pePN

Score

N/A

Malware Config

Signatures

Files

3fa6d2bb2fe8cc8991ad22afc199d2944070cef936248f7f6355325de7b079c4
.exe windows x86

aa47b93f996a3008f38567392db05340

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

SetServiceStatus
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
AddAce
InitializeAcl
GetAclInformation
GetSecurityDescriptorControl
MakeAbsoluteSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
InitializeSecurityDescriptor
OpenProcessToken
CreateServiceW
DeleteService
ControlService
GetLengthSid
IsValidSid
CopySid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegQueryInfoKeyW
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
GetTokenInformation
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
MakeSelfRelativeSD
GetSecurityDescriptorLength
RegEnumKeyExW
LookupAccountNameW
OpenThreadToken
LookupAccountSidW
CreateProcessAsUserW
DuplicateTokenEx
DuplicateToken
RevertToSelf
ImpersonateLoggedOnUser
ConvertSidToStringSidW
SetThreadToken
TraceMessage

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
WaitForSingleObject
GetCurrentProcess
GetModuleFileNameW
Sleep
CreateThread
CreateEventW
GetModuleHandleW
GetCurrentThreadId
SetEvent
InterlockedIncrement
InterlockedDecrement
GetCommandLineW
GetCurrentProcessId
HeapSetInformation
GetProcessHeap
InterlockedExchange
lstrcmpiW
CompareStringW
QueueUserWorkItem
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
CreateDirectoryW
DuplicateHandle
GetCurrentThread
SetLastError
GetTickCount
DeleteFileW
CreateSemaphoreW
LockResource
FindResourceExW
ReleaseSemaphore
GetLocalTime
GetTempFileNameW
ResetEvent
CopyFileW
MoveFileExW
GetFileAttributesW
CopyFileExW
GetLastError
CreateFileW
FindClose
WideCharToMultiByte
FlushFileBuffers
FindFirstFileW
FindNextFileW
CompareFileTime
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
OpenProcess
CreateProcessW
GetSystemDirectoryW
LocalFree
SetThreadPriorityBoost
SleepEx
QueueUserAPC
lstrlenW
GetSystemDefaultLCID
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RaiseException
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InterlockedCompareExchange
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
WriteFile

user32

PostThreadMessageW
CharUpperW
GetMessageW
UnregisterClassA
MsgWaitForMultipleObjectsEx
TranslateMessage
PeekMessageW
LoadStringW
DispatchMessageW
MessageBoxW
CharNextW

msvcr80

__CxxFrameHandler3
memset
??2@YAPAXI@Z
realloc
_recalloc
_wcsicmp
_vsnwprintf
wcschr
wcsstr
_vsnprintf
_vscwprintf
vswprintf_s
iswspace
towlower
towupper
memcpy
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_resetstkoflw
_purecall
_vsnwprintf_s
_putws
wcscat_s
wcsncpy_s
wcscpy_s
memmove_s
memcpy_s
_CxxThrowException
free
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z
memmove
calloc

shell32

ord171
SHGetFolderPathW

ole32

StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoInitializeEx
CoUninitialize
CoResumeClassObjects
CoInitializeSecurity
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoAddRefServerProcess
CoReleaseServerProcess
CoWaitForMultipleHandles
CoLockObjectExternal
CoQueryClientBlanket
CoImpersonateClient
CoRevertToSelf
CoSetProxyBlanket
CoCopyProxy
CoQueryProxyBlanket
CoCreateInstance

oleaut32

VarBstrCmp
VariantChangeType
SysAllocStringLen
DispCallFunc
VariantCopy
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
VariantInit

shlwapi

PathAddExtensionW
SHCreateStreamOnFileW
SHCreateStreamOnFileEx
PathIsDirectoryW
PathFileExistsW
PathAppendW
PathAddBackslashW
PathFindFileNameW

msi

ord268
ord266
ord116
ord281
ord160
ord118
ord158
ord157
ord115
ord96
ord34
ord159
ord169
ord6
ord177
ord141
ord32
ord92
ord70
ord8
ord173
ord94
ord113
ord88

psapi

GetModuleFileNameExW

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrustEx
WTHelperProvDataFromStateData

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile
LoadUserProfileW

crypt32

CertVerifyCertificateChainPolicy

Sections

.text
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

aa47b93f996a3008f38567392db05340

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcr80

shell32

ole32

oleaut32

shlwapi

msi

psapi

wintrust

userenv

crypt32

Sections

.text Size: 195KB - Virtual size: 194KB

.data Size: 2KB - Virtual size: 4KB

.rsrc Size: 15KB - Virtual size: 14KB

.cdata Size: 72KB - Virtual size: 72KB

.text
Size: 195KB - Virtual size: 194KB

.data
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 15KB - Virtual size: 14KB

.cdata
Size: 72KB - Virtual size: 72KB