694046641f3e2e59a6087f13e175ace352b42d88907e4033ba4ce717e14a0436

Sharing

Copy URL Twitter E-mail

General

Target

694046641f3e2e59a6087f13e175ace352b42d88907e4033ba4ce717e14a0436
Size

1007KB
MD5

5184c2fdfaeefb0a414e73b9cd5bd480
SHA1

eaaef4187941852ae8e263980287b9fced8084e6
SHA256

694046641f3e2e59a6087f13e175ace352b42d88907e4033ba4ce717e14a0436
SHA512

09e2b7fbdbae6068b0f1453a08c7da721709af7173f04a7a278b783e1d356bb37ba41d13f7de04eb4d847235a4a79432c9fa2ec6d231e9e1ff05c7dcc218aa38
SSDEEP

24576:zJtvuo/Qlj+ZcWsfpq2h8u02RYnvNEJ6:zol+mWsfn102RY86

Score

N/A

Malware Config

Signatures

Files

694046641f3e2e59a6087f13e175ace352b42d88907e4033ba4ce717e14a0436
.exe windows x86

bcce0d2b7ed723cd121dc97cc8a48b0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
EventWrite
RegOpenKeyExW
RegSetKeyValueW
RegGetValueW
RegEnumKeyExW
RegDeleteValueW
OpenProcessToken
RegQueryValueExW
EventRegister
EventUnregister
EventEnabled
RegQueryInfoKeyW
InitializeAcl
InitializeSecurityDescriptor
CopySid
GetLengthSid
IsValidSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
StartServiceCtrlDispatcherW
SetSecurityDescriptorDacl
OpenThreadToken
LookupAccountNameW
SetServiceStatus
RegisterServiceCtrlHandlerExW
SetFileSecurityW
ImpersonateLoggedOnUser
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSidSubAuthority
RevertToSelf
MakeAbsoluteSD
InitializeSid
GetSidLengthRequired
AddAccessDeniedAce
LookupAccountSidW
CreateWellKnownSid
SetTokenInformation
IsValidAcl
DeregisterEventSource
RegisterEventSourceW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegDeleteKeyTransactedW
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
RegCreateKeyTransactedW
RegOpenKeyTransactedW
CheckTokenMembership

kernel32

InterlockedCompareExchange
DelayLoadFailureHook
HeapSetInformation
GetCurrentProcessId
SetPriorityClass
SetEnvironmentVariableW
CreateMutexW
Sleep
MultiByteToWideChar
LoadLibraryW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetCurrentProcess
GetNLSVersion
OutputDebugStringW
GetModuleFileNameW
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
GetSystemDirectoryW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
WideCharToMultiByte
GetSystemDefaultLCID
CompareStringW
lstrcmpiW
FreeLibrary
lstrlenW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDriveTypeW
GetVolumeInformationW
SetLastError
GetVolumePathNamesForVolumeNameW
SetErrorMode
GetLastError
CloseHandle
LoadLibraryExA
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetSystemPreferredUILanguages
ResolveLocaleName
LocaleNameToLCID
CreateFileMappingW
ReleaseMutex
MapViewOfFile
CopyFileA
DeleteFileA
FlushViewOfFile
GetLocalTime
CreateFileA
FormatMessageW
UnmapViewOfFile
LCMapStringW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
LocalFree
CreateFileW
lstrcmpW
CompareFileTime
RemoveDirectoryW
FindFirstFileW
GetCommandLineW
DeleteFileW
SearchPathW
MoveFileW
CopyFileW
GetFileAttributesW
SetFileAttributesW
GetVersionExA
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
InterlockedExchange
lstrlenA
GetEnvironmentVariableW
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
ExpandEnvironmentStringsW
CreateThread
WaitForSingleObject
FindClose
FindNextFileW
FindFirstFileExW
CreateDirectoryW
OpenEventW
GetCurrentThread
SetEvent
GetTickCount64
RegNotifyChangeKeyValue
DuplicateHandle
CreateEventW
RegEnumValueW
RegDeleteKeyExW

user32

MsgWaitForMultipleObjects
PeekMessageW
UnregisterClassA
UnregisterDeviceNotification
RegisterDeviceNotificationW
LoadStringW
CharNextW
DispatchMessageW

msvcrt

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
realloc
_exit
_cexit
__getmainargs
calloc
wcsncpy_s
malloc
memmove_s
memcpy
wcsrchr
swscanf_s
_wcsicmp
free
_wcsnicmp
wcsncmp
memcpy_s
_vsnwprintf
memset
__CxxFrameHandler3
_CxxThrowException
_errno
_controlfp
fprintf
wcsstr
wcspbrk
_vscwprintf
vswprintf_s
qsort
towupper
bsearch
_XcptFilter
wcschr
iswspace
_wtol
swscanf
_vsnprintf
strncmp
_iob

ntdll

NtOpenFile
RtlInitUnicodeString
RtlNtStatusToDosError
WinSqmAddToStream
WinSqmIncrementDWORD
WinSqmSetDWORD
WinSqmIsOptedIn

ole32

CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoRevertToSelf
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoInitializeSecurity
CoImpersonateClient

oleaut32

SysFreeString
SysAllocString
SysStringLen
VarBstrCat
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi

tquery

?ciDelete@@YGXPAX@Z
?ciNewNoThrow@@YGPAXI@Z
?ciNew@@YGPAXI@Z

shlwapi

PathIsUNCServerShareW
SHGetValueW
SHSetValueW
PathAddBackslashW
SHCopyKeyW
PathRemoveBackslashW
SHDeleteKeyW
ord154
PathIsDirectoryW
PathStripToRootW
PathCanonicalizeW
PathFindNextComponentW
PathSkipRootW
PathFileExistsW
SHRegGetValueW
SHStrDupW
PathAppendW
PathIsUNCW
PathIsUNCServerW
PathIsRootW

mssrch

??0CSearchServiceObj@@QAE@XZ
?Cleanup@CSearchServiceObj@@SGHXZ
??1CSearchServiceObj@@QAE@XZ

imm32

ImmDisableIME

Sections

.text
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 608KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bcce0d2b7ed723cd121dc97cc8a48b0c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

ole32

oleaut32

tquery

shlwapi

mssrch

imm32

Sections

.text Size: 291KB - Virtual size: 291KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 608KB - Virtual size: 2.4MB

.text
Size: 291KB - Virtual size: 291KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 608KB - Virtual size: 2.4MB