3fe4879d446ee76b147945b1e76ed9b4c043d16a11e1f2e4fdb7496a8988be01

Sharing

Copy URL Twitter E-mail

General

Target

3fe4879d446ee76b147945b1e76ed9b4c043d16a11e1f2e4fdb7496a8988be01
Size

590KB
MD5

0545da84c813372e5df22d9f8b194600
SHA1

4fd71cab848fb9b6e00d7c8882e77a04d2c9f1d7
SHA256

3fe4879d446ee76b147945b1e76ed9b4c043d16a11e1f2e4fdb7496a8988be01
SHA512

8b55c6bdd251efb84c8da18be0245b3ddacb8de63e5f28bbf003bd694a7ab7f848d509d3a43460ef79750b5cb8fcf90ceac0f127729d5ec1541ea7f1dfe17587
SSDEEP

12288:37Tg15H8XS3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7zj:LcXHWS3/kRc4l6g6gtPbcHn7qk

Score

N/A

Malware Config

Signatures

Files

3fe4879d446ee76b147945b1e76ed9b4c043d16a11e1f2e4fdb7496a8988be01
.exe windows x86

04d8ee76d0a182663f0fc26de23d4858

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
CloseTrace
RegCreateKeyExW
OpenProcessToken
TraceMessage
ControlTraceW
EnableTrace
StartTraceW
CheckTokenMembership
GetTokenInformation
CreateWellKnownSid
RegOpenKeyExW
RegQueryValueExW
DuplicateToken

kernel32

GetLocaleInfoW
FormatMessageW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateThread
Sleep
GetLocalTime
GetCalendarInfoW
GetModuleHandleW
LoadLibraryExW
GetVolumePathNameW
ExpandEnvironmentStringsW
MoveFileExW
CreateFileW
DeviceIoControl
FindFirstFileW
FindNextFileW
FindClose
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetVolumeInformationW
GetDriveTypeW
CreateEventW
DeleteCriticalSection
SetEvent
InitializeCriticalSection
GetVolumeNameForVolumeMountPointW
GetDateFormatW
GetTimeFormatW
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
WaitForSingleObject
InterlockedPopEntrySList
InitializeSListHead
RtlCaptureStackBackTrace
InterlockedPushEntrySList
InterlockedDecrement
InterlockedIncrement
CloseHandle
SetLastError
GetProcessHeap
HeapSetInformation
SetErrorMode
GetCommandLineW
RegisterApplicationRestart
GetFileAttributesW
DeleteFileW
CreateDirectoryW
GetLastError
LocalFree

gdi32

CreateCompatibleDC
SetLayout
SelectObject
DeleteDC
DeleteObject
GdiFlush
CreateDIBSection
SetTextColor
SetBkColor
ExtTextOutW
CreateFontIndirectW
GetDeviceCaps

user32

SetWindowTextW
EnumWindows
GetWindowTextW
GetDlgItemTextW
SetDlgItemTextW
SendMessageTimeoutW
RegisterWindowMessageW
DestroyWindow
SystemParametersInfoW
ReleaseDC
GetDC
SendMessageW
DialogBoxParamW
SetForegroundWindow
MessageBoxW
MoveWindow
GetWindowRect
GetClientRect
ClientToScreen
GetSystemMetrics
DestroyIcon
EndPaint
GetSysColor
MapWindowPoints
GetDlgItem
BeginPaint
SetFocus
SetWindowLongW
GetWindowLongW
ShowWindow
EndDialog
EnableWindow
PostMessageW
SetWindowPos
LoadImageW
LoadStringW
CheckDlgButton
IsDlgButtonChecked
InflateRect
DrawFrameControl
OffsetRect
SetTimer
GetSysColorBrush
KillTimer
GetDesktopWindow
ChangeWindowMessageFilter

msvcrt

memset
memmove
wcstok
_wtol
??2@YAPAXI@Z
_purecall
_vscwprintf
memcpy
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_wcsicmp
??3@YAXPAX@Z
iswspace
_vsnwprintf
wcschr

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetFileInfoW
SHGetStockIconInfo

ole32

CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoDisconnectObject

oleaut32

VariantInit
VariantTimeToSystemTime
SysFreeString
SysStringLen
SystemTimeToVariantTime
SysAllocString
VariantClear

comctl32

ImageList_Add
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_Create
ord345
InitCommonControlsEx
ord344
ImageList_Destroy

ntdll

RtlAllocateHeap
RtlFreeHeap
WinSqmAddToStream
EtwTraceMessage
RtlGetLastNtStatus

virtdisk

GetStorageDependencyInformation

sxshared

SxTracerDebuggerBreak
SxTracerGetThreadContextRetail
SxTracerShouldTrackFailure

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 463KB - Virtual size: 462KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

04d8ee76d0a182663f0fc26de23d4858

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

shell32

ole32

oleaut32

comctl32

ntdll

virtdisk

sxshared

Sections

.text Size: 97KB - Virtual size: 97KB

.data Size: 5KB - Virtual size: 5KB

.rsrc Size: 463KB - Virtual size: 462KB

.reloc Size: 24KB - Virtual size: 27KB

.text
Size: 97KB - Virtual size: 97KB

.data
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 463KB - Virtual size: 462KB

.reloc
Size: 24KB - Virtual size: 27KB