f5aae8ae7ba3e6d327bf16a09aeced4c660b9b86fe8f77c6be404402234e9a70

Sharing

Copy URL Twitter E-mail

General

Target

f5aae8ae7ba3e6d327bf16a09aeced4c660b9b86fe8f77c6be404402234e9a70
Size

901KB
MD5

61ce77fd132ebaa4929064686c862b60
SHA1

bb5bd1ae893e91db8f653aaa5bc63c0825428034
SHA256

f5aae8ae7ba3e6d327bf16a09aeced4c660b9b86fe8f77c6be404402234e9a70
SHA512

6007c573e4fb358e5b227663f0e5707e810bf078d266c56e1ed03c8fb9c2ef2d9d0ff57c977f7980bae98779f2d7934fa646d083c1b5c680b62598ce4cf1855c
SSDEEP

12288:VuKgqohgiwG8PJ4BY/DoIq3nyQoO+uypjlE1G7vif8GetCjepP3Ju90fCoi64RNc:VR/fJFm3kLuyxljgJuCjkPZu90qocE

Score

N/A

Malware Config

Signatures

Files

f5aae8ae7ba3e6d327bf16a09aeced4c660b9b86fe8f77c6be404402234e9a70
.exe windows x64

c91c4370092fca56ff29d3efb302f6fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueExW
TraceMessage
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
RegisterEventSourceW
ReportEventW
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyW
RegDeleteKeyW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
LsaClose
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory

kernel32

HeapAlloc
HeapFree
GetProcessHeap
GetLastError
LockResource
LoadResource
FindResourceExW
VirtualQuery
EnterCriticalSection
LeaveCriticalSection
SetEvent
InitializeCriticalSectionAndSpinCount
GetSystemTime
SystemTimeToFileTime
FreeLibrary
CloseHandle
SetLastError
SetThreadPriority
GetCurrentThread
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryW
CreateThread
WaitForSingleObject
GetModuleHandleW
CreateEventW
RegisterApplicationRestart
UnregisterWaitEx
RegisterWaitForSingleObject
HeapSetInformation
GetCommandLineW
EncodePointer
DecodePointer
LocalFree
GetModuleHandleExW
GetProcAddress
DeleteCriticalSection
FormatMessageW
LocalAlloc
LoadLibraryExW
CheckElevationEnabled
GetVersionExW
GetSystemDirectoryW
GetUserDefaultLCID
ExpandEnvironmentStringsW
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep

user32

CallWindowProcW
GetDesktopWindow
GetWindowLongW
SetForegroundWindow
SendMessageW
GetSysColor
MessageBoxW
SystemParametersInfoW
SetSysColors
SetCursor
PostMessageW
CreateWindowExW
RegisterClassW
GetCursorPos
PostQuitMessage
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
SetTimer
CopyIcon
LoadIconW
DestroyIcon
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
AllowSetForegroundWindow
DefWindowProcW

msvcrt

memcpy
memcmp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
swscanf_s
_vsnwprintf
memmove
_wcsicmp
towupper
_wtoi
wcsstr
wcschr
_waccess_s
memset
__getmainargs
__C_specific_handler
_XcptFilter
_exit
_ismbblead

sppcommdlg

SLUXActivationWizard

winbrand

BrandingLoadString

ntdll

WinSqmAddToStream

ole32

CoMarshalInterThreadInterfaceInStream
StringFromGUID2
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitializeSecurity
CoAllowSetForegroundWindow
CoSuspendClassObjects
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateInstance
CoInitializeEx
CoResumeClassObjects

oleaut32

SysFreeString
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
VariantTimeToSystemTime

rpcrt4

UuidFromStringW
I_RpcMapWin32Status
RpcStringFreeW
UuidToStringW

shell32

ShellExecuteExW
CommandLineToArgvW
Shell_NotifyIconW

slc

SLUnregisterWindowsEvent
SLRegisterWindowsEvent
SLOpen
SLClose

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp1
Size: 560KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c91c4370092fca56ff29d3efb302f6fd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

sppcommdlg

winbrand

ntdll

ole32

oleaut32

rpcrt4

shell32

slc

Sections

.text Size: 105KB - Virtual size: 104KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 229KB - Virtual size: 229KB

.reloc Size: 1KB - Virtual size: 1KB

.vmp1 Size: 560KB - Virtual size: 1.8MB

.text
Size: 105KB - Virtual size: 104KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 229KB - Virtual size: 229KB

.reloc
Size: 1KB - Virtual size: 1KB

.vmp1
Size: 560KB - Virtual size: 1.8MB