d3458ae72592e8039c71bc83d1cc32d3990e9df6b579e21c7c036ab0e4c8d081

Sharing

Copy URL Twitter E-mail

General

Target

d3458ae72592e8039c71bc83d1cc32d3990e9df6b579e21c7c036ab0e4c8d081
Size

700KB
MD5

6cb006ac87335a3c4cd475d18ef11783
SHA1

9c6b569795c2bb05383ff84212b7182c48c1ede4
SHA256

d3458ae72592e8039c71bc83d1cc32d3990e9df6b579e21c7c036ab0e4c8d081
SHA512

2912750103c848649f66f25e3b98db0454126411fbf5908f9080c544002eabac4b3f2f840499e8c4f582b329944b1d92d2ccd71d8d227ff3f7443432602a91bc
SSDEEP

12288:1eJzoyd8lmKelbY7rYcWiL4zbWQuaCCN1B2v8jjge:1e9EmVbYHYcWiL4zbzjW0jj

Score

N/A

Malware Config

Signatures

Files

d3458ae72592e8039c71bc83d1cc32d3990e9df6b579e21c7c036ab0e4c8d081
.exe windows x64

24c431641bc87ac39d557c4019b9c7e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW
RegCloseKey
RegDeleteValueW
EqualSid
RegOpenKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
DestroyPrivateObjectSecurity
RegisterServiceCtrlHandlerW
SetServiceStatus
GetLengthSid
IsValidSid
LogonUserW
DuplicateToken
MapGenericMask
AccessCheckAndAuditAlarmW
RegCreateKeyExW
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorLength
RegSetValueExW
MakeSelfRelativeSD
OpenProcessToken
CreatePrivateObjectSecurity
RegQueryValueExW
OpenThreadToken
GetTokenInformation
SetPrivateObjectSecurity
GetPrivateObjectSecurity
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegisterEventSourceW
DeregisterEventSource
PerfStopProvider
PerfStartProvider
PerfCreateInstance
PerfSetCounterSetInfo
PerfSetCounterRefValue
RegDeleteKeyExW
RevertToSelf
ImpersonateLoggedOnUser
GetSecurityDescriptorDacl
ControlService
RegNotifyChangeKeyValue
FreeSid
SetEntriesInAclW
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
AllocateAndInitializeSid
QueryServiceStatus
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenServiceW
SetSecurityDescriptorGroup
EnumDependentServicesW
OpenSCManagerW
CloseServiceHandle
RegEnumKeyW
AdjustTokenPrivileges
LookupAccountSidW
LookupPrivilegeValueW
LookupAccountNameW
CopySid
ReportEventW

kernel32

lstrlenA
OpenEventW
GetTimeFormatW
GetStringTypeExW
OutputDebugStringW
GetModuleFileNameW
GetSystemDirectoryW
GetFileInformationByHandle
GetFileType
GetTempPathW
CreateFileW
GetTempFileNameW
ExpandEnvironmentStringsW
MultiByteToWideChar
CompareStringW
GetLocaleInfoW
WideCharToMultiByte
GetDateFormatW
GetVersionExW
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
OutputDebugStringA
GetStartupInfoW
GetLastError
LoadLibraryW
GetProcessHeap
HeapCreate
lstrlenW
lstrcmpiW
GetProcAddress
SetLastError
FileTimeToSystemTime
UnmapViewOfFile
CloseHandle
FindFirstFileW
FindClose
LocalFree
GetSystemTimeAsFileTime
DeleteFileW
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
GetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
CopyFileW
Sleep
VirtualFree
GetFileSize
WriteFile
ReadFile
PostQueuedCompletionStatus
LocalAlloc
CreateSemaphoreW
InitializeCriticalSection
HeapSetInformation
GetVersion
DeleteCriticalSection
SetErrorMode
SetUnhandledExceptionFilter
CreateThread
GetComputerNameW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetFileSizeEx
SetFilePointer
GetFileTime
GetSystemTime
MoveFileW
SystemTimeToFileTime
SetFileTime
FormatMessageW
GetLocalTime
SetThreadExecutionState
GetQueuedCompletionStatus
CreateIoCompletionPort
FileTimeToLocalFileTime
lstrcmpW
ResetEvent
GetSystemTimeAdjustment
GetModuleHandleW
CreateWaitableTimerW
GetExitCodeThread
GetCurrentThread
HeapFree
GetCurrentProcess
HeapAlloc
ReleaseSemaphore
GetFullPathNameW
SetWaitableTimer
CancelWaitableTimer
HeapDestroy
FreeLibrary
MulDiv

msvcrt

iswalpha
memmove
memcpy_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
_wcsnicmp
swscanf
wcschr
wcsrchr
_vsnwprintf
?what@exception@@UEBAPEBDXZ
_wcsicmp
_wsplitpath_s
memcmp
realloc
memcpy
_wcsnset
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
__CxxFrameHandler3
malloc
_callnewh
_CxxThrowException
free
??0exception@@QEAA@AEBQEBDH@Z
_purecall
qsort
_ltow
wcsstr
_itow
wcsncmp
wcsspn
??0exception@@QEAA@XZ
memset
memmove_s

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

ord487
SHCopyKeyW

rpcrt4

RpcServerUseProtseqEpW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerUnregisterIf
RpcMgmtWaitServerListen
I_RpcExceptionFilter
NdrClientCall2
NdrServerCallAll
NdrServerCall2
RpcBindingServerFromClient
RpcRevertToSelf
I_RpcBindingIsClientLocal
RpcStringBindingParseW
RpcBindingToStringBindingW
RpcServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIfEx
RpcImpersonateClient

tapi32

lineShutdown
lineClose
lineNegotiateAPIVersion
lineHandoffW
lineDeallocateCall
lineGetLineDevStatus
lineOpenW
lineSetStatusMessages
lineInitializeExW
lineSetAppPriorityW
lineTranslateAddressW
lineGetCountryW
lineGetCallInfoW
lineGetDevCapsW

gdi32

SetWindowOrgEx
EndPage
DeleteEnhMetaFile
LPtoDP
SetWindowExtEx
StartPage
SetTextColor
DeleteDC
CreateFontIndirectW
GetDeviceCaps
GetEnhMetaFileHeader
CreateDCW
SetBkMode
DeleteObject
SelectObject
SelectClipRgn
CreateRectRgnIndirect
PlayEnhMetaFile
SetEnhMetaFileBits
SetMapMode
SaveDC
StartDocW
SetViewportExtEx
RestoreDC
EndDoc
EnableEUDC

winspool.drv

ClosePrinter
OpenPrinterW
FindFirstPrinterChangeNotification
DocumentPropertiesW
FindClosePrinterChangeNotification
EnumPrintersW
GetPrinterW
FindNextPrinterChangeNotification
SetPrinterW

user32

SendMessageW
FindWindowW
LoadStringW
DrawTextW

ole32

OleRun
CoInitialize
CLSIDFromString
IIDFromString
StringFromGUID2
CoUninitialize
CoInitializeEx
CoTaskMemFree
StringFromIID
FreePropVariantArray
StgOpenStorageEx
CoCreateInstance

oleaut32

GetErrorInfo
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysStringLen
SysAllocString

shell32

SHSetLocalizedName
SHGetFolderPathAndSubDirW
SHGetFolderPathW

crypt32

CryptProtectData
CryptUnprotectData
CryptHashMessage

credui

CredUIParseUserNameW

fxstiff

TiffRecoverGoodPages
TiffAddMsTags
MergeTiffFiles
TiffClose
TiffOpen
TiffPostProcessFast
FXSTIFFInitialize
TiffExtractFirstPage
GetMsTagFileTime
GetMsTagDwordLong
GetMsTagString
MemoryMapTiffFile
MmrAddBranding

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlValidRelativeSecurityDescriptor

Sections

.text
Size: 625KB - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cxxjtki
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

24c431641bc87ac39d557c4019b9c7e8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

version

shlwapi

rpcrt4

tapi32

gdi32

winspool.drv

user32

ole32

oleaut32

shell32

crypt32

credui

fxstiff

ntdll

Sections

.text Size: 625KB - Virtual size: 625KB

.data Size: 22KB - Virtual size: 24KB

.pdata Size: 16KB - Virtual size: 15KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 32KB - Virtual size: 33KB

cxxjtki Size: - Virtual size: 4KB

.text
Size: 625KB - Virtual size: 625KB

.data
Size: 22KB - Virtual size: 24KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 32KB - Virtual size: 33KB

cxxjtki
Size: - Virtual size: 4KB