2f19f87d2601f0c55ddf2eaa74080d2e40d724013f7a7792b7d187aa4bdbffa4

Sharing

Copy URL Twitter E-mail

General

Target

2f19f87d2601f0c55ddf2eaa74080d2e40d724013f7a7792b7d187aa4bdbffa4
Size

334KB
MD5

36a7a7224f1c35203f838a1f580e6270
SHA1

645fc991e183218177c0cb9613c1e695d657d402
SHA256

2f19f87d2601f0c55ddf2eaa74080d2e40d724013f7a7792b7d187aa4bdbffa4
SHA512

00d8d67d0857372369253400be776333bc71d27988915ed0f8b41a4a385c3e44d3c8edc2d1102affb4c1213a4a59916df75c3dc9c5b6882a3bedce0624dc809d
SSDEEP

6144:IDfTAnNX5jvz04tkrtRW+7NpxyN90vEps12:+fTAnLjvLtkRRTVy907

Score

N/A

Malware Config

Signatures

Files

2f19f87d2601f0c55ddf2eaa74080d2e40d724013f7a7792b7d187aa4bdbffa4
.exe windows x86

ddc91ecd17d943e2ee26d62fc9a4fb0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
InitiateSystemShutdownExW
RegSetValueExW
RegCreateKeyExW
CreateProcessAsUserW
RegDeleteKeyW
RegQueryValueExW
RegEnumKeyW
RegDeleteValueW
ConvertSidToStringSidW
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
CopySid
GetTokenInformation
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteKeyValueW
ControlTraceW
EnableTrace
CloseTrace
StartTraceW
GetLengthSid
IsValidSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
CryptReleaseContext
DecryptFileA
CryptGenRandom
CryptAcquireContextW
EventRegister
EventUnregister
EventWrite
EventEnabled

kernel32

ProcessIdToSessionId
GetCurrentProcessId
FormatMessageW
CreateFileW
GetFullPathNameW
GetCurrentProcess
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
InterlockedIncrement
LocalFree
MultiByteToWideChar
GetFileAttributesA
CreateDirectoryA
GetSystemDirectoryA
RemoveDirectoryW
MoveFileExW
DeleteFileW
lstrcmpW
CreateDirectoryW
OutputDebugStringW
lstrlenW
GetFileAttributesW
GetSystemDirectoryW
WaitForSingleObject
GetExitCodeProcess
GetExitCodeThread
FindFirstFileW
lstrcmpiW
FindNextFileW
GetSystemWindowsDirectoryW
InterlockedDecrement
GetLastError
CloseHandle
GetCommandLineW
CreateThread
FreeLibrary
GetProcAddress
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
FindClose

gdi32

GetStockObject
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreateCompatibleDC
SelectObject
GetTextExtentPoint32W
DeleteDC

user32

GetClientRect
FillRect
EndPaint
SetRect
SendDlgItemMessageW
GetDC
ReleaseDC
SetWindowLongW
ShowWindow
SystemParametersInfoW
MessageBoxW
PostMessageW
BeginPaint
DestroyAcceleratorTable
TranslateAcceleratorW
RegisterClassExW
CreateWindowExW
ShutdownBlockReasonCreate
ShutdownBlockReasonDestroy
DestroyWindow
DefWindowProcW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
PeekMessageW
SetFocus
EnableWindow
GetDlgItem
SetDlgItemTextW
UpdateWindow
LoadCursorW
LoadIconW
EndDialog
DialogBoxParamW
CreateAcceleratorTableW
SendMessageW

msvcrt

memmove
??3@YAXPAX@Z
_vsnwprintf
memset
wcsrchr
_controlfp
?terminate@@YAXXZ
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memcpy
_vsnprintf
_ftol2
_wcsnicmp
iswdigit
wcschr
_wcsicmp
??2@YAPAXI@Z

ole32

CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize

oleaut32

SysFreeString
VariantInit
SysAllocString

shell32

CommandLineToArgvW
SHGetPathFromIDListW
ShellExecuteExW
SHBrowseForFolderW
ord730

shlwapi

StrToIntExW

ntdll

WinSqmEndSession
WinSqmSetString
WinSqmStartSession
WinSqmSetDWORD

dpx

DpxNewJob

wtsapi32

WTSQueryUserToken

comctl32

InitCommonControlsEx

Sections

.text
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ddc91ecd17d943e2ee26d62fc9a4fb0c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shell32

shlwapi

ntdll

dpx

wtsapi32

comctl32

Sections

.text Size: 201KB - Virtual size: 201KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 46KB - Virtual size: 47KB

.text
Size: 201KB - Virtual size: 201KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 46KB - Virtual size: 47KB