a15f48ffd9af27e471c05d874d8d4cf3dd10d60d14c26af8964615d5d4b5804d

Sharing

Copy URL

Twitter E-mail

General

Target

a15f48ffd9af27e471c05d874d8d4cf3dd10d60d14c26af8964615d5d4b5804d
Size

507KB
MD5

493487f3623f00449b2274cdb1861510
SHA1

8675d435100b3c9d099188aec23de4380aceb468
SHA256

a15f48ffd9af27e471c05d874d8d4cf3dd10d60d14c26af8964615d5d4b5804d
SHA512

d17c83d780d95a0a373779fd3cf3b0aa49d6c4394329cbf38a5764339a8c40f95af18276eb9ccbf63834ad480e2f370e03518959498f0b3767423d2fbe91ea44
SSDEEP

12288:uYlyF+Wp8qaPTW88+Iv9/FWkQWeaZIRYrfHYH4FdVT:uBl8pPTsXsIjHbfT

Score

N/A

Malware Config

Signatures

Files

a15f48ffd9af27e471c05d874d8d4cf3dd10d60d14c26af8964615d5d4b5804d
.exe windows x86

1112ef3b571e3de40347faa3e9cf2db8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsnicmp
wcsrchr
towupper
iswspace
toupper
isalpha
strchr
wcscat
strncpy
memmove
wcstod
qsort
_wfopen
_stricmp
wcscspn
towlower
?terminate@@YAXXZ
_wsplitpath
wcscmp
_wcsupr
wcsncpy
mbstowcs
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_initterm
_CxxThrowException
_ftol
??3@YAXPAX@Z
wcsncmp
strcspn
_itow
__dllonexit
wcslen
_errno
bsearch
strtoul
wcsspn
swscanf
_wcslwr
wcstol
malloc
_except_handler3
iswdigit
iswalpha
swprintf
wcscpy
wcstoul
wcschr
_ultow
sprintf
_adjust_fdiv
wcstombs
isxdigit
??1type_info@@UAE@XZ
fclose
isdigit
__CxxFrameHandler
realloc
free
_wcsicmp
_strnicmp
_onexit
wcsstr
fgets

kernel32

DeviceIoControl
CreateNamedPipeW
DeleteCriticalSection
GetUserDefaultLCID
WaitForMultipleObjects
CreateDirectoryW
WaitForMultipleObjectsEx
GetCurrentThread
ReadFile
LeaveCriticalSection
SetErrorMode
GetThreadPriority
VirtualFree
ConnectNamedPipe
ReleaseMutex
GetSystemTimeAsFileTime
CreateEventW
InterlockedDecrement
IsValidLocale
InterlockedIncrement
FindNextFileW
CompareStringW
GetStringTypeW
GetSystemDirectoryW
GetTickCount
GetOverlappedResult
DuplicateHandle
CreateFileMappingW
LocalFileTimeToFileTime
SwitchToThread
GetFileAttributesW
GetCurrentProcess
IsDBCSLeadByteEx
TransactNamedPipe
GetComputerNameW
EnterCriticalSection
ResumeThread
SetEndOfFile
HeapSize
GetLogicalDrives
DeleteFileW
FlushFileBuffers
GlobalUnlock
CompareFileTime
GlobalFree
GetLastError
InterlockedExchange
GetVersionExW
ExpandEnvironmentStringsW
SetProcessWorkingSetSize
IsBadWritePtr
FreeLibrary
CreateMutexW
SetLastError
GetExitCodeProcess
WaitNamedPipeW
SetFileAttributesW
FileTimeToSystemTime
LoadLibraryA
FoldStringW
CreateFileW
GetModuleFileNameW
SleepEx
GetACP
WriteFile
GetLocalTime
SetUnhandledExceptionFilter
TryEnterCriticalSection
GetThreadTimes
WideCharToMultiByte
GetCPInfo
QueueUserAPC
UnmapViewOfFile
InitializeCriticalSectionAndSpinCount
OpenFileMappingW
GetVolumeInformationW
VirtualUnlock
WaitForSingleObjectEx
SetNamedPipeHandleState
RemoveDirectoryW
ReadFileEx
GetProcAddress
HeapFree
GetDiskFreeSpaceW
CloseHandle
SystemTimeToFileTime
QueryPerformanceCounter
FindFirstFileW
GetCalendarInfoW
WriteFileEx
OpenProcess
GetThreadLocale
HeapCreate
LocalAlloc
QueryDosDeviceW
FormatMessageW
GetFileSize
SetFilePointer
LoadLibraryExW
GetDriveTypeW
FindClose
WaitForSingleObject
FlushViewOfFile
DisconnectNamedPipe
SetPriorityClass
GetCurrentDirectoryW
OpenEventW
GlobalLock
SetEvent
MapViewOfFile
ResetEvent
lstrlenA
GlobalAlloc
SearchPathW
GetCurrentProcessId
GetLongPathNameW
SetCurrentDirectoryW
GetSystemDefaultLCID
ReadProcessMemory
GetLocaleInfoW
MultiByteToWideChar
PeekNamedPipe
GetFileAttributesExW
CancelIo
GetSystemPowerStatus
GetSystemInfo
LCMapStringW
SetThreadPriority
GetDiskFreeSpaceExW
HeapDestroy
LocalFree
CreateThread
SetThreadLocale
GetSystemTime
HeapAlloc

user32

RegisterDeviceNotificationW
MsgWaitForMultipleObjects
wsprintfW
DispatchMessageW
TranslateMessage
GetLastInputInfo
UnregisterDeviceNotification
PeekMessageW

ole32

PropSysFreeString
CoCreateInstance
CoTaskMemAlloc
StgConvertPropertyToVariant
PropVariantCopy
FreePropVariantArray
CLSIDFromString
CoFileTimeNow
PropVariantClear
StringFromGUID2
CoInitializeEx
GetClassFile
CoUninitialize
CoGetClassObject
StgConvertVariantToProperty
CoSetProxyBlanket
CreateBindCtx
PropSysAllocString
CoTaskMemFree
StgOpenStorage
CoFreeUnusedLibraries
CreateStreamOnHGlobal
StgPropertyLengthAsVariant

advapi32

StartServiceW
GetSecurityDescriptorLength
InitializeSecurityDescriptor
SetFileSecurityW
ImpersonateLoggedOnUser
RegCloseKey
RegEnumKeyW
LsaOpenSecret
ImpersonateNamedPipeClient
CopySid
QueryServiceStatus
ChangeServiceConfigW
AddAccessAllowedAce
RevertToSelf
GetUserNameW
GetNamedSecurityInfoW
RegOpenKeyExW
LsaClose
RegEnumValueW
RegQueryInfoKeyW
GetLengthSid
RegQueryValueExW
RegConnectRegistryW
RegSetValueExW
SetSecurityDescriptorOwner
LsaCreateSecret
LsaSetSecret
RegOpenKeyW
RegEnumKeyExW
AccessCheck
SetNamedSecurityInfoW
CloseServiceHandle
OpenServiceW
AllocateAndInitializeSid
RegDeleteValueW
LsaOpenPolicy
LsaNtStatusToWinError
AddAce
SetSecurityDescriptorDacl
RegOpenKeyA
RegisterEventSourceW
SetServiceStatus
QueryServiceConfigW
RegisterServiceCtrlHandlerExW
SetSecurityDescriptorGroup
OpenThreadToken
ReportEventW
RegDeleteKeyW
LogonUserW
LsaFreeMemory
SetSecurityDescriptorSacl
DeregisterEventSource
OpenSCManagerW
ControlService
RegCreateKeyExW
LsaRetrievePrivateData
FreeSid
InitializeAcl

rpcrt4

CStdStubBuffer_DebugServerQueryInterface
UuidFromStringW
CStdStubBuffer_QueryInterface
NdrCStdStubBuffer_Release
NdrOleAllocate
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerRelease
IUnknown_QueryInterface_Proxy
NdrDllUnregisterProxy
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
NdrDllGetClassObject
CStdStubBuffer_Disconnect
NdrDllRegisterProxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree

ntdll

NtDuplicateToken
NtQuerySystemTime
RtlInitUnicodeString
RtlNtStatusToDosError
RtlFreeHeap
NtQueryInformationToken
NtNotifyChangeDirectoryFile
RtlInitAnsiString
NtNotifyChangeKey
NtQuerySecurityObject
RtlUpcaseUnicodeChar
RtlQueryRegistryValues
RtlOemStringToUnicodeString
NtClose
RtlDosPathNameToNtPathName_U
NtOpenThreadToken
NtSetInformationFile
NtFsControlFile
NtOpenProcessToken
RtlCaptureStackBackTrace
NtCreateFile
NtOpenKey
NtQueryInformationFile
NtQuerySystemInformation
RtlUnicodeStringToOemString
NtWaitForSingleObject
NtQueryVolumeInformationFile
NtQueryDirectoryFile
NtDeviceIoControlFile
NtQueryInformationProcess
NtOpenFile
NtCancelIoFile
NtCreateEvent

shell32

SHGetDesktopFolder
SHBindToParent

Sections

.9618ds
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.B^br5
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.@#RFER
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.N^UHQt
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.h46asrg
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.64h4aer
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1112ef3b571e3de40347faa3e9cf2db8

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

ole32

advapi32

rpcrt4

ntdll

shell32

Sections

.9618ds Size: 2KB - Virtual size: 1KB

.B^br5 Size: 512B - Virtual size: 2B

.@#RFER Size: 171KB - Virtual size: 170KB

.N^UHQt Size: 58KB - Virtual size: 57KB

.h46asrg Size: 176KB - Virtual size: 176KB

.64h4aer Size: 97KB - Virtual size: 97KB

.9618ds
Size: 2KB - Virtual size: 1KB

.B^br5
Size: 512B - Virtual size: 2B

.@#RFER
Size: 171KB - Virtual size: 170KB

.N^UHQt
Size: 58KB - Virtual size: 57KB

.h46asrg
Size: 176KB - Virtual size: 176KB

.64h4aer
Size: 97KB - Virtual size: 97KB