801a1bb7ef65ca551cab915a813cb9422bf4e8240aa9b2fa6175ca47c5e633ec

Sharing

Copy URL Twitter E-mail

General

Target

801a1bb7ef65ca551cab915a813cb9422bf4e8240aa9b2fa6175ca47c5e633ec
Size

56KB
MD5

00cda54c5f29861a3d5e0f321e6f0ba0
SHA1

ed39b2ca122ef6fb0bf370634e40d0dea1d5097d
SHA256

801a1bb7ef65ca551cab915a813cb9422bf4e8240aa9b2fa6175ca47c5e633ec
SHA512

93b52f55aedb72c88a9759ff349f0223e1744be7fbd2a2c91ccf2988d5a0d41b37de32fc7febb4b93031ecb25ead0c15fba0f7fbee7bceeb334bac4057b5f64e
SSDEEP

768:bshDQSMvyMeo2oliqSwuaAQCYE2MCRLJ0wvJgPY2htKFjllamkfh1M7:bGDQJeChdAFYsCNJ0wvMFSFvamg+

Score

N/A

Malware Config

Signatures

Files

801a1bb7ef65ca551cab915a813cb9422bf4e8240aa9b2fa6175ca47c5e633ec
.exe windows x86

fb92ef247e1be6be67cfa6625459427e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EncryptFileW
DecryptFileW
AddUsersToEncryptedFile
RemoveUsersFromEncryptedFile
AddUsersToEncryptedFileEx
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
LookupAccountSidW
FreeEncryptedFileKeyInfo
FreeEncryptionCertificateHashList
QueryRecoveryAgentsOnEncryptedFile
QueryUsersOnEncryptedFile
EncryptedFileKeyInfo
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetUserKey
FlushEfsCache
SetUserFileEncryptionKey

kernel32

GetFullPathNameW
GetComputerNameW
ReadConsoleW
SetConsoleMode
VirtualFree
VirtualAlloc
CloseHandle
SetEndOfFile
SetFilePointer
CreateFileW
DeviceIoControl
GetVolumeNameForVolumeMountPointW
VerifyVersionInfoW
VerSetConditionMask
FindClose
FindNextFileW
WideCharToMultiByte
FindFirstFileW
GetFileAttributesW
QueryDosDeviceW
FindVolumeClose
FindNextVolumeW
GetVolumeInformationW
FindFirstVolumeW
SetErrorMode
RemoveDirectoryW
SetLastError
GetTempFileNameW
CreateDirectoryW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetVolumePathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapSetInformation
DelayLoadFailureHook
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
LocalFree
WriteConsoleW
FlushFileBuffers
lstrlenW
WriteFile
HeapFree
GetProcessHeap
HeapAlloc
FormatMessageW
GetFileType
GetStdHandle
GetConsoleMode
GetModuleHandleW
GetLastError
GetProcAddress
lstrcmpW

msvcrt

__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
__set_app_type
?terminate@@YAXXZ
_controlfp
_get_osfhandle
_vsnwprintf
_except_handler4_common
_exit
_cexit
__wgetmainargs
_putws
_wcsnicmp
memcpy
getchar
printf
memset
_iob
fgetws
towupper
wcschr
_wcsicmp

ntdll

RtlNtStatusToDosError

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

user32

MessageBoxW

ntdsapi

DsCrackNamesW
DsBindW
DsUnBindW
DsFreeNameResultW

crypt32

CertCloseStore
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW
CertAddCertificateContextToStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CryptQueryObject
PFXExportCertStoreEx
CertEnumCertificatesInStore
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey
BCryptCloseAlgorithmProvider

netapi32

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

efsutil

EfsUtilCreateSelfSignedCertificate
EfsUtilGetSmartcardProviderName
EfsUtilGetCurrentUserInformation

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb92ef247e1be6be67cfa6625459427e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

rpcrt4

user32

ntdsapi

crypt32

bcrypt

netapi32

efsutil

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 22KB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 22KB