ed930b02d0b63eabc83df383e822262acd73b6a1a20194eb83470548b0535ef4

Sharing

Copy URL Twitter E-mail

General

Target

ed930b02d0b63eabc83df383e822262acd73b6a1a20194eb83470548b0535ef4
Size

54KB
MD5

392fca59a01fb9b286dbec67459eb7f0
SHA1

3b9669e3f657592b6658777274f169c215f617ef
SHA256

ed930b02d0b63eabc83df383e822262acd73b6a1a20194eb83470548b0535ef4
SHA512

246cbbbb974769452c7f9927b02c1d87006f7ab0ebae3961184c33e81778359beb6e1e1ddf896bb94c90413ec0f0f66dc3f77630f929cdfcd326f7bc68594922
SSDEEP

768:4pnkR6TpGRFxkGtqQK2SZ+sVbrAjImbywUblyAyaCwMTwua+I/3k2ekQd92:AnaEGyGpsOUmb5iTMT9M3k2ekS92

Score

N/A

Malware Config

Signatures

Files

ed930b02d0b63eabc83df383e822262acd73b6a1a20194eb83470548b0535ef4
.exe windows x86

6be84b25ed346af1ddd1450a9c5267a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
GetTokenInformation
CredpEncodeSecret
CredRestoreCredentials
CredBackupCredentials

kernel32

LocalFree
LocalAlloc
GetFileSizeEx
CreateThread
DuplicateHandle
CreateFileW
SetEvent
GlobalFree
GetCommandLineW
HeapSetInformation
CreateEventW
WriteFile
OpenProcess
DeleteFileW
GetTempFileNameW
WaitForMultipleObjects
SleepEx
GetOverlappedResult
CloseHandle
GetLastError
GetTempPathW
FormatMessageW
HeapFree
GetProcessHeap
HeapAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
CancelIo
ReadFile
SetLastError

gdi32

GetObjectW
CreateFontIndirectW

user32

EnableWindow
SetFocus
SendMessageW
GetDlgItem
PostMessageW
GetDlgItemTextW
ShowWindow
SetWindowTextW
LoadStringW
CheckRadioButton
SetWindowLongW
GetWindowLongW
GetParent
SendDlgItemMessageW

msvcrt

__set_app_type
__p__fmode
__p__commode
?terminate@@YAXXZ
_amsg_exit
_controlfp
_vsnwprintf
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
swscanf
wcsncmp
memset
__setusermatherr
_except_handler4_common

comctl32

CreatePropertySheetPageW
PropertySheetW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

ntdll

TpWaitForWait
TpAllocWait
NtOpenProcessToken
NtPrivilegeCheck
NtAdjustPrivilegesToken
NtClose
RtlNtStatusToDosError
TpReleaseWait
TpSetWait

crypt32

CryptProtectData
CryptUnprotectData

rpcrt4

RpcAsyncInitializeHandle
RpcStringBindingComposeW
NdrAsyncClientCall
I_RpcExceptionFilter
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcBindingFree

shell32

CommandLineToArgvW

netutils

NetApiBufferFree

samcli

NetValidatePasswordPolicy

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6be84b25ed346af1ddd1450a9c5267a1

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

comdlg32

ntdll

crypt32

rpcrt4

shell32

netutils

samcli

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 28KB - Virtual size: 29KB

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 28KB - Virtual size: 29KB