6834e748b56a0e2236df52190f546bbdedfe779a3050c0fce070ebb0a90275f0

Sharing

Copy URL Twitter E-mail

General

Target

6834e748b56a0e2236df52190f546bbdedfe779a3050c0fce070ebb0a90275f0
Size

454KB
MD5

6d06ec3eb62c0b469fa1bbdb65841b00
SHA1

90c8aa0a449c92ff6be380e65446f2ec45b08a37
SHA256

6834e748b56a0e2236df52190f546bbdedfe779a3050c0fce070ebb0a90275f0
SHA512

d6923551bc2bc74dff29478e783f17207f833b7bc3c9a8ffc91a53942309fabcb1e9d0b9580ae6c9ea85f295f42d7121ac7edc60ffbede987cc9b5242bc7235b
SSDEEP

6144:BYsm62bL/dOuvi6IXUiQQfTAnNXbu9jrZwz73hQ1UE/V3opWE5nbww9Hn4:pnjfTAnpirZwztQ9w1JHVn

Score

N/A

Malware Config

Signatures

Files

6834e748b56a0e2236df52190f546bbdedfe779a3050c0fce070ebb0a90275f0
.exe windows x86

4973f03be13a7ad324eb311f66a173b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
MakeSelfRelativeSD
GetSecurityDescriptorLength
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegLoadKeyW
RegOpenKeyExW
ConvertSidToStringSidW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
LookupAccountNameW
AddAce
InitializeAcl
SetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
RegFlushKey
InitiateShutdownW
GetLengthSid
IsValidSid
CopySid
GetAclInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
QueryServiceConfigW
OpenServiceW
CloseServiceHandle
EnumServicesStatusW
OpenSCManagerW
EventRegister
EventUnregister
EventWrite

kernel32

CreateProcessW
ReleaseMutex
GetNativeSystemInfo
IsWow64Process
GetCurrentProcess
GetFileAttributesW
GetWindowsDirectoryW
GetUILanguageInfo
EnumUILanguagesW
GetProductInfo
GetVersionExW
DeviceIoControl
LocalFree
LocalAlloc
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
SetLastError
Sleep
InterlockedIncrement
WaitForSingleObject
CreateEventW
SetEvent
InterlockedDecrement
GetSystemPowerStatus
GetFileMUIPath
CreateDirectoryW
CreateThread
SystemTimeToFileTime
GetSystemTime
GetFileSizeEx
FindClose
FindNextFileW
FindFirstFileW
GetModuleFileNameW
GetSystemWindowsDirectoryW
GetFullPathNameW
FormatMessageW
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
lstrlenW
WideCharToMultiByte
GlobalFree
ReadFile
GetFileSize
WriteFile
SetEndOfFile
SetFilePointer
OutputDebugStringA
GetEnvironmentVariableW
SearchPathW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetExitCodeProcess
CreateFileW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateMutexW
CloseHandle
GetLastError
HeapSize
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
HeapDestroy
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
DeleteFileW
CompareFileTime
SetFileTime
MoveFileExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
GetFileAttributesExW

user32

UnregisterClassA
MessageBoxW

msvcrt

_initterm
vsprintf_s
_vscprintf
iswdigit
_wtoi
memcpy
wcstoul
__wgetmainargs
_cexit
_vsnwprintf
wcsncmp
wcsstr
_wcsnicmp
isdigit
_wtol
_purecall
wcschr
_wcslwr_s
towupper
wcsrchr
calloc
_resetstkoflw
wcscspn
??2@YAPAXI@Z
memset
memmove_s
malloc
free
_exit
_XcptFilter
vswprintf_s
_vscwprintf
_wcsicmp
_CxxThrowException
memcpy_s
??_V@YAXPAX@Z
__CxxFrameHandler3
exit
_vsnprintf
_controlfp
?terminate@@YAXXZ
??_U@YAPAXI@Z
??3@YAXPAX@Z
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
iswspace
_ftol2

shell32

SHFileOperationW
SHCreateItemFromParsingName
CommandLineToArgvW

ole32

CoCreateInstance
CoSetProxyBlanket
CoGetMalloc
CoInitializeEx
CoInitializeSecurity
CoUninitialize
StringFromGUID2

oleaut32

VariantInit
SysFreeString
SysAllocStringLen
VariantChangeType
VariantClear

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ntdll

RtlInitializeBitMap
RtlNumberOfClearBits
RtlAreBitsClear
RtlAreBitsSet
RtlSetBits

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

shlwapi

PathRemoveFileSpecW
PathIsURLW
SHCreateStreamOnFileW
PathFileExistsW
PathFindFileNameW
PathCombineW

xmllite

CreateXmlReader

crypt32

CertCreateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore

userenv

UnloadUserProfile

sqmapi

SqmCreateNewId
SqmSetMachineId
SqmSet
SqmIsWindowsOptedIn
SqmStartUpload
SqmWaitForUploadComplete
SqmEndSession
SqmReadSharedMachineId
SqmSetBits
SqmSetString
SqmSetAppId
SqmSetEnabled
SqmGetSession
SqmAddToStreamV
SqmWriteSharedMachineId

winbrand

BrandingFormatString

wer

WerReportSetUIOption
WerReportSetParameter
WerpSetCallBack
WerReportCreate
WerReportCloseHandle
WerReportSubmit

wintrust

CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext

Sections

.text
Size: 402KB - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4973f03be13a7ad324eb311f66a173b6

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

oleaut32

version

ntdll

wtsapi32

shlwapi

xmllite

crypt32

userenv

sqmapi

winbrand

wer

wintrust

Sections

.text Size: 402KB - Virtual size: 402KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 46KB - Virtual size: 49KB

.text
Size: 402KB - Virtual size: 402KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 46KB - Virtual size: 49KB