ae1ca6e881fa80c7ec206d835923d07fc0d9683098e8a10769354bc57afb6614

Sharing

Copy URL Twitter E-mail

General

Target

ae1ca6e881fa80c7ec206d835923d07fc0d9683098e8a10769354bc57afb6614
Size

753KB
MD5

6c451be3c87c5d9854275e45ffee95f9
SHA1

cf2299a1d34c6ed09b8d46c47b38e72955e7227b
SHA256

ae1ca6e881fa80c7ec206d835923d07fc0d9683098e8a10769354bc57afb6614
SHA512

2c9314eda574d619691d9372c68b73cddcafab6a444b3b9e157dcba44dd466f7ff3fbbd450518b0610d8ba0d88feb9326a7604677c823d724cc2776c2d1b076f
SSDEEP

12288:6q5EQvAsdlYZ7uQLlov+3zQr1jqn/oUK10HdUGMTaFq2jzw:6QEQv5TYpfLAez8UlC86TaF1

Score

N/A

Malware Config

Signatures

Files

ae1ca6e881fa80c7ec206d835923d07fc0d9683098e8a10769354bc57afb6614
.exe windows x86

6b4b5f3df831f4c9e31b4914e368efbe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

shlwapi

StrCatBuffA
SHDeleteValueW
StrRChrW
SHEnumValueW
PathIsUNCServerShareW
PathRemoveBlanksA
StrRStrIW
PathMakeSystemFolderW
StrRetToBSTR
StrRetToBufW
AssocCreate
SHCreateShellPalette
SHDeleteEmptyKeyW

mscms

IsColorProfileValid
InternalGetPS2CSAFromLCS
CreateColorTransformA
TranslateBitmapBits
CreateColorTransformW
GetStandardColorSpaceProfileW
InternalGetPS2ColorRenderingDictionary
CloseColorProfile
TranslateColors
OpenColorProfileA
GetColorProfileElement
GetColorProfileHeader
GetColorDirectoryA
InternalGetPS2PreviewCRD
EnumColorProfilesA
DeleteColorTransform
InternalGetPS2ColorSpaceArray
OpenColorProfileW
InstallColorProfileW
GetColorDirectoryW
EnumColorProfilesW
UninstallColorProfileW

advapi32

ControlTraceW
UnlockServiceDatabase
LogonUserW
I_ScSetServiceBitsW
AdjustTokenPrivileges
LsaICLookupNames
LsaLookupPrivilegeValue
RegEnumKeyExA
ConvertSidToStringSidW
CryptAcquireContextA
RegDeleteKeyW
RegQueryValueExA
CryptExportKey
QueryServiceConfigW
RegisterTraceGuidsW
RegQueryMultipleValuesW
GetCurrentHwProfileW
ReportEventA
ImpersonateSelf
InitializeAcl
EqualPrefixSid
GetTokenInformation
ObjectCloseAuditAlarmW
CryptSetHashParam
OpenEventLogA
GetLengthSid
LookupAccountNameW
RemoveUsersFromEncryptedFile
SetSecurityDescriptorGroup
QueryServiceStatus
RegRestoreKeyW

secur32

LsaRegisterPolicyChangeNotification
ApplyControlToken
LsaConnectUntrusted
InitializeSecurityContextW
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
QuerySecurityPackageInfoW
LsaRegisterLogonProcess
InitSecurityInterfaceW
TranslateNameW
DeleteSecurityContext
LsaLookupAuthenticationPackage
FreeCredentialsHandle
LsaLogonUser
FreeContextBuffer
EnumerateSecurityPackagesW
LsaGetLogonSessionData
AcceptSecurityContext
EncryptMessage

kernel32

WriteProfileStringW
WritePrivateProfileStringA
GetCurrencyFormatW
GetBinaryTypeW
ExitProcess
DefineDosDeviceW
Process32NextW
GetOEMCP
LocalUnlock
RegisterWaitForSingleObject
GlobalDeleteAtom
SetErrorMode
QueryPerformanceCounter
SetConsoleTitleA
TerminateThread
EnumResourceLanguagesW
SetConsoleTextAttribute
SetConsoleWindowInfo
GetLastError
OpenFileMappingW
ShowConsoleCursor
HeapUnlock
GetEnvironmentStringsA
SetFileTime
CmdBatNotification
SystemTimeToTzSpecificLocalTime
IsDBCSLeadByte
VirtualAlloc
FindVolumeClose
GetDiskFreeSpaceW
GetPrivateProfileSectionNamesW
GetTempPathA
SetSystemTimeAdjustment
SetUnhandledExceptionFilter
SetHandleCount
GetPrivateProfileIntA

cfgmgr32

CM_Get_Device_Interface_List_ExW
CM_Get_Parent_Ex
CM_Enumerate_Classes_Ex
CM_Locate_DevNodeW
CM_Reenumerate_DevNode
CM_Locate_DevNode_ExW
CM_Get_DevNode_Registry_PropertyW
CM_Connect_MachineW
CM_Set_HW_Prof_Flags_ExW
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Device_ID_List_Size_ExW
CM_Get_Child
CMP_WaitNoPendingInstallEvents
CM_Free_Log_Conf_Handle
CM_Open_DevNode_Key_Ex
CM_Get_Res_Des_Data_Ex
CM_Free_Res_Des_Handle
CM_Get_Next_Res_Des_Ex
CM_Get_Class_Name_ExW

winspool.drv

AddPrinterW
AbortPrinter
EnumJobsW
EnumPrintersA
AddFormW
EnumPrinterDataW
GetPrinterW
ConfigurePortW
OpenPrinterW
DevicePropertySheets
DeviceCapabilitiesW
OpenPrinterA
GetPrintProcessorDirectoryW
GetFormW
DocumentPropertiesW

crypt32

CryptExportPKCS8

msvcrt

_wunlink
fwprintf
wcscpy
_mbsnextc
_beginthreadex
_ismbcdigit
_statusfp
__getmainargs
_swab
__crtLCMapStringA
iscntrl
strpbrk
__p__fmode
_CIpow
sqrt
_wgetcwd
isdigit
_wfopen
fputs
labs
iswgraph
_winmajor
strtok
_mbsspn
_mbsrchr
_ftol
__p__commode
_wremove
iswcntrl
_CIsin
_mbsupr

Sections

.text
Size: 31KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 205KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 355KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b4b5f3df831f4c9e31b4914e368efbe

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

mscms

advapi32

secur32

kernel32

cfgmgr32

winspool.drv

crypt32

msvcrt

Sections

.text Size: 31KB - Virtual size: 414KB

.idata Size: 205KB - Virtual size: 428KB

.edata Size: 355KB - Virtual size: 514KB

.rsrc Size: 160KB - Virtual size: 159KB

.reloc Size: 1024B - Virtual size: 220B

.text
Size: 31KB - Virtual size: 414KB

.idata
Size: 205KB - Virtual size: 428KB

.edata
Size: 355KB - Virtual size: 514KB

.rsrc
Size: 160KB - Virtual size: 159KB

.reloc
Size: 1024B - Virtual size: 220B