d47ddab01df5261b9c9e35a56e9780e23cb032bdb54ea9a1049ef2e022b8d28d

Sharing

Copy URL

Twitter E-mail

General

Target

d47ddab01df5261b9c9e35a56e9780e23cb032bdb54ea9a1049ef2e022b8d28d
Size

656KB
MD5

584a78233a7a25afcff64c131e8a92f0
SHA1

7f487305bc3f83f4348ba4cdb85e07ff20ee52a0
SHA256

d47ddab01df5261b9c9e35a56e9780e23cb032bdb54ea9a1049ef2e022b8d28d
SHA512

eb2d7fd65c3781dd63434152e3b0a7d99f45acce03150ea3dcf3e3dbcdd97c0c3a0fc13e2d3ebef1b23a06343acc63a8d131020410c3b9fa2e2dbcb2c50b25c6
SSDEEP

12288:Zg+VMI/O4to6nVKnbGTzpq+7zkMNTMyRJgkdYLCjxbPginXynxuqKnJ:Z5Omo6VI6JpRJgkdY2jJIinXWxuqKnJ

Score

N/A

Malware Config

Signatures

Files

d47ddab01df5261b9c9e35a56e9780e23cb032bdb54ea9a1049ef2e022b8d28d
.exe windows x86

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
InitializeAcl
InitializeSecurityDescriptor
MakeAbsoluteSD
IsValidRelativeSecurityDescriptor
RegQueryValueExW
IsValidSecurityDescriptor
MakeSelfRelativeSD
FreeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
AllocateAndInitializeSid
AddAccessDeniedAce
GetAce
GetAclInformation
IsValidAcl
GetSecurityDescriptorDacl
DeleteAce
EqualSid
RegEnumValueW
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptGetUserKey
CryptAcquireContextW
CryptExportKey
CryptDecrypt
CryptImportKey
CryptEncrypt
EventUnregister
EventWrite
EventRegister

kernel32

InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
CloseHandle
CreateEventW
GetModuleFileNameW
FreeLibrary
InitializeCriticalSection
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetACP
WaitForSingleObject
CreateThread
Sleep
GetCurrentThreadId
SetEvent
GetCommandLineW
CompareStringW
InterlockedIncrement
ResetEvent
SetLastError
GetSystemDirectoryW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
GetVersionExA
GetLastError
HeapSetInformation
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringA
lstrlenW
MultiByteToWideChar

user32

CharNextW
UnregisterClassA
CharUpperW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW

msvcrt

_onexit
__wgetmainargs
_callnewh
_controlfp
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
wcsncmp
??1exception@@UAE@XZ
_lock
__dllonexit
_unlock
_errno
_wtol
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memcpy
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
memset
_purecall
__CxxFrameHandler3
wcsncpy_s
_CxxThrowException
memcpy_s
free
malloc
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
realloc
_cexit
??0exception@@QAE@ABV0@@Z
iswdigit

shlwapi

StrCmpIW

oleaut32

SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SafeArrayDestroy
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
VarBstrCmp
SysAllocStringLen
VarBstrCat

ole32

CoWaitForMultipleHandles
CoResumeClassObjects
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

netapi32

NetLocalGroupGetInfo
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetLocalGroupGetMembers
NetApiBufferFree

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 564KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

oleaut32

ole32

wtsapi32

shell32

netapi32

crypt32

Sections

.text Size: 77KB - Virtual size: 76KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 564KB - Virtual size: 2.3MB

.text
Size: 77KB - Virtual size: 76KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 564KB - Virtual size: 2.3MB