4ae74d3dddd6a6cba984477b0403b0fad2bb922c98f9502c5e891fbea7070e6d

Sharing

Copy URL Twitter E-mail

General

Target

4ae74d3dddd6a6cba984477b0403b0fad2bb922c98f9502c5e891fbea7070e6d
Size

820KB
MD5

6a9ca094d9f196b546b3e917ebae2160
SHA1

1a6a033a88974fcfdb02faac4caaa77ff9a44bb6
SHA256

4ae74d3dddd6a6cba984477b0403b0fad2bb922c98f9502c5e891fbea7070e6d
SHA512

6b82b705800152975d0c54bddcef7c14fc9f61c15036f948657c2ec3505d6b03af6c4d1a025819e82361dfdd60eb43f9c01698076707cb4fce94530ebe82f8e2
SSDEEP

24576:ulbiVfwRx3MrQQraTNealGnCadif7ZbDo6Q31jR0Ixdwwx661c7E0T/:ulbiVfwRZMrQQraTICadian0Ixdwwx61

Score

N/A

Malware Config

Signatures

Files

4ae74d3dddd6a6cba984477b0403b0fad2bb922c98f9502c5e891fbea7070e6d
.exe windows x86

890104de95dbe30862f938811d11bebe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceEvent
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
GetLengthSid
CopySid
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
SetThreadToken
RevertToSelf
IsWellKnownSid
RegConnectRegistryW
CredDeleteW
CredReadW
CredWriteW
CredFree
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
LogonUserW
RegCreateKeyExW
RegEnumValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
RegEnumKeyExW
RegQueryInfoKeyW
RegCopyTreeW
EventEnabled
EventWrite
EventUnregister
EventRegister
GetTokenInformation
RegDeleteKeyW
OpenProcessToken
GetSecurityDescriptorDacl
GetAce
MapGenericMask
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenThreadToken

kernel32

DeleteCriticalSection
EnterCriticalSection
CreateFileW
InitializeCriticalSectionAndSpinCount
GetFullPathNameW
ExpandEnvironmentStringsW
UnregisterWaitEx
CreateEventW
RegisterWaitForSingleObject
LeaveCriticalSection
OutputDebugStringA
HeapSetInformation
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
FormatMessageW
InterlockedExchange
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetLastError
MultiByteToWideChar
CloseHandle
GetCurrentThread
WideCharToMultiByte
CompareStringW
GetVersionExW
LoadLibraryExW
GetSystemDirectoryW
GetComputerNameExW
InterlockedIncrement
InterlockedDecrement
GetLocaleInfoW
EnumUILanguagesW

msvcrt

__CxxFrameHandler3
??1type_info@@UAE@XZ
_ultow
iswalnum
_itow
wcstoul
wcsstr
_purecall
??0exception@@QAE@XZ
_wtoi
_scwprintf
_CxxThrowException
memset
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
wcschr
memmove_s
memcpy_s
_vsnwprintf
memcpy
__wgetmainargs
_wcsicmp
fwprintf
_onexit
_wtoi64
iswspace
wcsncmp
_wcsnicmp
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
_iob

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear
SysStringLen
VarCmp
VariantInit

wsmsvc

?Alloc@WSManMemory@@SGPAXIABVCallSite@TestSystem@@W4Mode@3@@Z
?Free@WSManMemory@@SGXPAXABVCallSite@TestSystem@@@Z
?AllocBstr@WSManMemory@@SGPAGPBGHABVCallSite@TestSystem@@@Z

crypt32

CertGetCertificateChain
CryptStringToBinaryW
CertGetNameStringW
CertOpenStore
CertFindCertificateInStore
CryptAcquireCertificatePrivateKey
CertFindExtension
CertVerifyCertificateChainPolicy
CertCloseStore
CertGetCertificateContextProperty
CryptBinaryToStringW
CryptDecodeObjectEx
CertFreeCertificateContext
CertFreeCertificateChain
CertGetEnhancedKeyUsage

netapi32

NetGetJoinInformation
NetApiBufferFree

rpcrt4

UuidCreate

ws2_32

freeaddrinfo
getaddrinfo
getnameinfo
WSAStartup
WSACleanup

httpapi

HttpDeleteServiceConfiguration
HttpQueryServiceConfiguration
HttpSetServiceConfiguration
HttpTerminate
HttpInitialize

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 600KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

890104de95dbe30862f938811d11bebe

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

oleaut32

wsmsvc

crypt32

netapi32

rpcrt4

ws2_32

httpapi

Sections

.text Size: 212KB - Virtual size: 211KB

.data Size: 5KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 600KB - Virtual size: 2.4MB

.text
Size: 212KB - Virtual size: 211KB

.data
Size: 5KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 600KB - Virtual size: 2.4MB