1ada2f0e07c50412a0add8465bdee6ce7c16c04358bce27bbcc6f95f78e8752e

Sharing

Copy URL Twitter E-mail

General

Target

1ada2f0e07c50412a0add8465bdee6ce7c16c04358bce27bbcc6f95f78e8752e
Size

324KB
MD5

6596a62c678d7eb665f1ef04c2d32a80
SHA1

6a162c0f15be179fba7ffe3e4fd7d7a66d24f2db
SHA256

1ada2f0e07c50412a0add8465bdee6ce7c16c04358bce27bbcc6f95f78e8752e
SHA512

6f086910fb7491b080a9defc7ba44e5f70e36c8de029ab0678711946808edd3642936787f960ada47a449c1db0eeafb28a3aff7d1912e9c6e4501476883f750c
SSDEEP

6144:ZOedSoJUSS419UUbp0GSfPHWLkOuaB9kcLyJmIFF59A6uHIAjnHL+/:DdjjSwnNJAP2oXJvFF59kHr+

Score

N/A

Malware Config

Signatures

Files

1ada2f0e07c50412a0add8465bdee6ce7c16c04358bce27bbcc6f95f78e8752e
.exe windows x86

017962b1be2c625abb0f1195d008bd45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SendMessageW
LoadStringW
GetWindowRect
GetDlgItem
LoadImageW
EndDialog
CloseDesktop
GetDlgItemTextW
DialogBoxParamW
ShowWindow
EnumWindows
LockWindowStation
UnlockWindowStation
SetWindowStationUser
UpdatePerUserSystemParameters
FindWindowW
SwitchDesktopWithFade
LoadLocalFonts
RegisterLogonProcess
CreateWindowStationW
SetProcessWindowStation
CloseWindowStation
SetUserObjectSecurity
SwitchDesktop
RealGetWindowClassW
GetWindowLongW
GetParent
GetDesktopWindow
SetWindowPos
SetForegroundWindow
GetLastInputInfo
GetKeyState
SystemParametersInfoW
CreateDesktopW
CancelShutdown
GetAsyncKeyState
ExitWindowsEx
GetSystemMetrics
MessageBoxW
OpenInputDesktop
GetUserObjectInformationW
SetThreadDesktop

msvcrt

??2@YAPAXI@Z
memcpy
memset
_vsnwprintf
memmove
_wcsicmp
wcschr
wcsrchr
iswspace
wcstok
??3@YAXPAX@Z
_ultow
_wtoi
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
wcsstr
__isascii
isupper
_tolower
__p__fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_controlfp
_wcsnicmp

ntdll

RtlLeaveCriticalSection
RtlAdjustPrivilege
NtCreateToken
NtSetInformationToken
RtlCreateEnvironment
RtlInitUnicodeString
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable
RtlInitUnicodeStringEx
RtlCompareUnicodeString
NtOpenThreadToken
EtwEventActivityIdControl
EtwEventWriteStartScenario
EtwEventWriteEndScenario
RtlpVerifyAndCommitUILanguageSettings
WinSqmSetDWORD
RtlDeleteCriticalSection
EtwEventUnregister
EtwEventRegister
RtlRemovePrivileges
EtwUnregisterTraceGuids
RtlEnterCriticalSection
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
NtSystemDebugControl
NtQuerySystemInformation
RtlCopyLuid
RtlGetNtProductType
EtwEventEnabled
EtwEventWrite
WinSqmEndSession
WinSqmStartSession
NtOpenProcessToken
NtQueryInformationToken
NtClose
RtlNtStatusToDosError
NtShutdownSystem
EtwTraceMessage
RtlInitializeCriticalSection
RtlLengthSid
RtlInitString
NtAllocateLocallyUniqueId
WinSqmAddToStream
RtlDestroyEnvironment
TpSimpleTryPost
TpReleaseWork
TpWaitForWork
TpReleaseWait
TpWaitForWait
TpSetWait
TpPostWork
TpAllocWork
TpWaitForTimer
RtlGetDaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAddAce
NtAdjustPrivilegesToken
NtDuplicateToken
RtlUnhandledExceptionFilter
NtQueryInformationProcess
TpReleaseTimer
NtReplyPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtAcceptConnectPort
NtCreatePort
NtCreateEvent
TpAllocWait
RtlExpandEnvironmentStrings_U
RtlNtStatusToDosErrorNoTeb
RtlCopySid
RtlOpenCurrentUser
RtlFreeSid
NtSetSecurityObject
RtlSetSaclSecurityDescriptor
RtlAddMandatoryAce
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlAllocateAndInitializeSid
RtlTimeToSecondsSince1980
TpSetTimer
TpAllocTimer
NtOpenDirectoryObject
NtInitiatePowerAction
RtlFreeUnicodeString
RtlDuplicateUnicodeString
NtFilterToken
RtlEqualSid
EtwRegisterTraceGuidsW

api-ms-win-core-localregistry-l1-1-0

RegEnumValueW
RegDeleteKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegSetKeySecurity

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
EqualSid
GetTokenInformation
GetLengthSid
RevertToSelf
ImpersonateLoggedOnUser
CheckTokenMembership
DuplicateTokenEx
AllocateLocallyUniqueId

winsta

WinStationNegotiateSession
WinStationReportUIResult
WinStationFreeMemory
WinStationQueryInformationW
WinStationIsSessionPermitted
_WinStationWaitForConnect
WinStationGetUserCredentials
WinStationFreeUserCredentials
WinStationIsSessionRemoteable
WinStationDisconnect

rpcrt4

I_RpcMapWin32Status
NdrAsyncClientCall
RpcAsyncInitializeHandle
RpcAsyncCancelCall
RpcMgmtIsServerListening
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcServerUnsubscribeForNotification
RpcServerSubscribeForNotification
I_RpcBindingIsClientLocal
RpcServerUnregisterIf
RpcBindingVectorFree
RpcEpUnregister
RpcServerListen
RpcEpRegisterW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUseProtseqW
NdrServerCall2
NdrAsyncServerCall
RpcRaiseException
RpcServerInqCallAttributesW
RpcServerTestCancel
RpcServerUseProtseqEpW
RpcBindingSetAuthInfoExW
UuidFromStringW
RpcBindingUnbind
RpcBindingCreateW
RpcBindingBind
RpcBindingFree
NdrClientCall2
RpcAsyncAbortCall
RpcAsyncCompleteCall
I_RpcExceptionFilter
I_RpcBindingInqLocalClientPID
RpcImpersonateClient
RpcRevertToSelf

kernel32

CreateEventW
FreeLibrary
GetProcAddress
LoadLibraryW
SetEvent
LocalReAlloc
CloseHandle
WaitForSingleObject
GetComputerNameExW
GetModuleFileNameW
LocalAlloc
GetLastError
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapSize
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
LockResource
LoadResource
FindResourceExW
FormatMessageW
InterlockedCompareExchange
LocalSize
MoveFileExW
GetSystemTimeAsFileTime
SetLastError
GetSystemDirectoryW
SetProcessWorkingSetSize
Sleep
UnregisterWaitEx
InterlockedExchange
WaitForSingleObjectEx
HeapSetInformation
GetCurrentProcessId
RegGetValueA
RegDeleteTreeW
RegEnumKeyExW
CreateProcessInternalW
BaseInitAppcompatCacheSupport
SleepEx
GetFileAttributesW
SetTimerQueueTimer
CreateRemoteThread
GetThreadUILanguage
GetVersionExW
GetTickCount64
WideCharToMultiByte
DebugBreak
UnhandledExceptionFilter
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
LoadLibraryExA
DelayLoadFailureHook
SetInformationJobObject
WaitForMultipleObjects
CreateThread
SetErrorMode
CreateFileW
ReadFile
GetModuleHandleW
GetProcessId
OpenEventW
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateProcessW
SearchPathW
AssignProcessToJobObject
TerminateProcess
GetTickCount
CompareFileTime
ResumeThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
GetDateFormatW
VirtualLock
GetProcessWorkingSetSize
LocalFree
VirtualUnlock
VirtualFree
CreateJobObjectW
GetCommandLineW
TerminateJobObject
ResetEvent
GetComputerNameW
InterlockedIncrement
InterlockedDecrement
DuplicateHandle
QueryInformationJobObject
RegisterWaitForSingleObject
OpenProcess
UnregisterWait
QueryFullProcessImageNameW
GetExitCodeProcess
GetProcessHeap
SetEnvironmentVariableW
CompareStringW
GetShortPathNameW
lstrlenW
ExpandEnvironmentStringsW
VirtualAlloc

Sections

.text
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kvyouty
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

017962b1be2c625abb0f1195d008bd45

Headers

DLL Characteristics

File Characteristics

Imports

user32

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

api-ms-win-security-base-l1-1-0

winsta

rpcrt4

kernel32

Sections

.text Size: 249KB - Virtual size: 249KB

.data Size: 11KB - Virtual size: 11KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 42KB - Virtual size: 43KB

kvyouty Size: - Virtual size: 4KB

.text
Size: 249KB - Virtual size: 249KB

.data
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 42KB - Virtual size: 43KB

kvyouty
Size: - Virtual size: 4KB