685562f12b076bd8d827d6c039e7ad877724735ce1719e475bca9b25ee688dcf

Sharing

Copy URL Twitter E-mail

General

Target

685562f12b076bd8d827d6c039e7ad877724735ce1719e475bca9b25ee688dcf
Size

658KB
MD5

652814f551a0517954eed334f679d9b0
SHA1

9a8bd87c66dd9877b51f8746029bd0e69c2d51ea
SHA256

685562f12b076bd8d827d6c039e7ad877724735ce1719e475bca9b25ee688dcf
SHA512

5a2ff016dbcd32e0f6dd3f894a5b202e7ebce75e26a10e3c8413119afcd92294e01db993d88732cd9687ef3c58aba10a7ae33dae0a6b7e8befd3f6310a9395a4
SSDEEP

12288:SB65MKsUSLCkI2XzBaWIs1Lk3wLvaf8wZDpxm7wJiW:SgzSLKmBaWIst6wLv2Fp3mQ

Score

N/A

Malware Config

Signatures

Files

685562f12b076bd8d827d6c039e7ad877724735ce1719e475bca9b25ee688dcf
.exe windows x86

27de2481a002903bf758833d84e47f38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
CreateWellKnownSid
CloseServiceHandle

kernel32

InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
CloseHandle
WaitForSingleObject
Sleep
CreateThread
CreateEventW
GetCurrentThreadId
SetEvent
GetCommandLineW
LocalAlloc
LocalFree
InterlockedCompareExchange
lstrcmpiW
GetVersionExA
WideCharToMultiByte
GetStartupInfoW
HeapAlloc
HeapFree
HeapReAlloc
VirtualProtect
GetLastError
GetProcAddress
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
OutputDebugStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
VirtualAlloc

user32

CharUpperW
PostThreadMessageW
GetMessageW
UnregisterClassA
DispatchMessageW
TranslateMessage
CharNextW

ntdll

RtlUnwind

oleaut32

RegisterTypeLi
SysFreeString
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi

ole32

CoTaskMemFree
CoInitializeEx
CoUninitialize
CoSuspendClassObjects
CoRevokeClassObject
CoRegisterClassObject
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoResumeClassObjects

rpcrt4

RpcStringFreeW
RpcBindingFree
RpcBindingFromStringBindingW
NdrClientCall2
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 584KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

27de2481a002903bf758833d84e47f38

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

ntdll

oleaut32

ole32

rpcrt4

Sections

.text Size: 66KB - Virtual size: 65KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 584KB - Virtual size: 2.3MB

.text
Size: 66KB - Virtual size: 65KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 584KB - Virtual size: 2.3MB