3a329cbac696ada92e5f7f0789d0e2e1dca370ff74bcfa3126398ff4cc71e79c

Sharing

Copy URL Twitter E-mail

General

Target

3a329cbac696ada92e5f7f0789d0e2e1dca370ff74bcfa3126398ff4cc71e79c
Size

584KB
MD5

0712cb4a264e461503fd176afd17fed0
SHA1

33a382350432374fca15852ef77012ebf1129f42
SHA256

3a329cbac696ada92e5f7f0789d0e2e1dca370ff74bcfa3126398ff4cc71e79c
SHA512

ca7dfc834b6640b714f883bd534fc99f44cebddbb3dc7cbc56af036d81bae883e7e80c2f3f225dfe7d4b3aafdcd03bb8fbad763ae3b6711b80f8d49ccba03bb8
SSDEEP

12288:L78hvj0SfnI2935Po0PiLt3AlS4H0EhsD8PJJ9x7QS8Vtim:X8t0SfnL935w0PiLtwwq0EhsD8PJJDEP

Score

N/A

Malware Config

Signatures

Files

3a329cbac696ada92e5f7f0789d0e2e1dca370ff74bcfa3126398ff4cc71e79c
.exe windows x86

9daa2d3b399f341549338f028b52bf00

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
WTSQueryUserToken
WTSQuerySessionInformationW
WTSFreeMemory

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

kernel32

CreateThread
WideCharToMultiByte
CreateEventW
GetLocaleInfoA
HeapSize
RtlUnwind
HeapReAlloc
VirtualAlloc
IsValidCodePage
GetOEMCP
GetACP
WaitForSingleObject
IsWow64Process
GetCurrentProcess
CloseHandle
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
Sleep
GetCPInfo

user32

GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
DefWindowProcW
DestroyWindow
PostQuitMessage
CreateWindowExW
UpdateWindow
SendMessageW

advapi32

RegisterServiceCtrlHandlerW
RegOpenKeyW
RegEnumValueW
RegCloseKey
RegOpenKeyExW
CreateProcessAsUserW
OpenProcessToken
DuplicateTokenEx
LookupPrivilegeValueW
AdjustTokenPrivileges
SetTokenInformation
SetServiceStatus
StartServiceCtrlDispatcherW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9daa2d3b399f341549338f028b52bf00

Headers

File Characteristics

Imports

wtsapi32

userenv

kernel32

user32

advapi32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 28KB - Virtual size: 24KB

.vmp0 Size: 508KB - Virtual size: 1.6MB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 28KB - Virtual size: 24KB

.vmp0
Size: 508KB - Virtual size: 1.6MB