4c19b5c66a42fb2e65e2c7f2c1e516e852657c50631992edb479f660ed82ec8d

Sharing

Copy URL

Twitter E-mail

General

Target

4c19b5c66a42fb2e65e2c7f2c1e516e852657c50631992edb479f660ed82ec8d
Size

139KB
MD5

010ec99f6faa17b09e770574849022d0
SHA1

bc9a8a0c59982ec7230879a04ad6e4166c17a034
SHA256

4c19b5c66a42fb2e65e2c7f2c1e516e852657c50631992edb479f660ed82ec8d
SHA512

6321422b335f6ebb4ae867d4037d23c69aa4236526fa02e5016a45914ae8d4c4421c1e12264a3fa32269f1a7e316b876f212050f178eb0175d80522b27ff959a
SSDEEP

3072:YkB1vUZfhcaqExFltG+NLJ+R7Y5IMTE9jPQJqk:Y618Zfs+N1cUfTk

Score

N/A

Malware Config

Signatures

Files

4c19b5c66a42fb2e65e2c7f2c1e516e852657c50631992edb479f660ed82ec8d
.exe windows x86

6390cce81012bdffd3ad199754551426

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
FreeSid
LookupAccountSidW
AllocateAndInitializeSid
LsaFreeMemory
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
ConvertStringSidToSidW
InitializeAcl
BuildSecurityDescriptorW
BuildTrusteeWithNameW
AddAccessAllowedAce
GetLengthSid
AddAce
GetSecurityDescriptorDacl
IsWellKnownSid
ConvertSidToStringSidW
GetSidSubAuthority
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
LsaLookupNames
SetThreadToken
OpenThreadToken
GetTokenInformation
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LogonUserW
LsaRetrievePrivateData
LsaStorePrivateData
LsaRemoveAccountRights
LsaEnumerateAccountRights
LsaAddAccountRights
IsValidSecurityDescriptor
GetSecurityDescriptorLength
OpenProcessToken
CreatePrivateObjectSecurityEx
DestroyPrivateObjectSecurity
BuildTrusteeWithSidW
RegConnectRegistryW

kernel32

LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
HeapSetInformation
GetModuleFileNameW
MoveFileExW
OpenEventW
SetEvent
GetWindowsDirectoryA
GetLastError
CreateFileA
CreateFileW
GetFileSize
CloseHandle
SetFilePointer
GetLocalTime
WriteFile
lstrlenW
lstrlenA
GetVersionExA
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
IsDebuggerPresent
GetCurrentThread
GetThreadContext
DebugBreak
CreateDirectoryW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
SetFileAttributesW
DeleteFileW
GetModuleHandleW
FindResourceW
LoadResource
InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
RegOpenKeyExW
RegFlushKey
RegDeleteValueW
RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
LoadLibraryW
FindClose
FindNextFileW
FindFirstFileW
LocalFree
LocalAlloc
LocalSize
LocalReAlloc
GetComputerNameW
CompareStringW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
FormatMessageW
LockResource

msvcrt

__CxxFrameHandler3
wcsrchr
_wcsnicmp
free
_vsnwprintf
malloc
_waccess
_local_unwind4
_wstrtime
_wcsicmp
realloc
_wstrdate
memcpy
_onexit
_lock
__dllonexit
_unlock
_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
_strtime
_stricmp
clock
wcsstr
memset
wcstombs
wcschr

user32

CharPrevA
CharNextA
IsCharAlphaW
CharPrevW
CharNextW
LoadStringW
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetDesktopWindow
SetThreadDesktop
OpenDesktopW
SetProcessWindowStation
OpenWindowStationW
GetThreadDesktop
GetProcessWindowStation
DialogBoxParamW
EndDialog
SetDlgItemTextW
CloseWindowStation
CloseDesktop
IsCharAlphaNumericW

ole32

CoTaskMemRealloc
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateInstance
CoGetObjectContext
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

version

VerQueryValueW

Exports

Exports

?GetRegNodeDispenser@@YGJPAPAUIRegNodeDispenser@@@Z

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6390cce81012bdffd3ad199754551426

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 112KB

.data Size: 512B - Virtual size: 31KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 27KB

.text
Size: 112KB - Virtual size: 112KB

.data
Size: 512B - Virtual size: 31KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 27KB