23f3d9efa9c0ca27c3b10441d61c82c7a143377f8571b8407ed0e747fd44cbec

Sharing

Copy URL Twitter E-mail

General

Target

23f3d9efa9c0ca27c3b10441d61c82c7a143377f8571b8407ed0e747fd44cbec
Size

1.3MB
MD5

598508a6413507d3c737dd77d176ee0e
SHA1

c761e5b44e09fcee9ed4112dfe1d58bee313e6eb
SHA256

23f3d9efa9c0ca27c3b10441d61c82c7a143377f8571b8407ed0e747fd44cbec
SHA512

571d909ffec5c7ddcc70fde99e16f837ea1053e2809596416bb6edeeecbdf011e0d179b65143d73c1363688544ffbd6d62ccbac4ab03a9525e5d948bfc9f3812
SSDEEP

24576:VPFi9XiWl8dg0mEx24J302pd3YdBp2DPP4TWdYwjRqPujEhv79rD8udiD:zi9XiNNYdBuPgTxwjRREhv79rHg

Score

N/A

Malware Config

Signatures

Files

23f3d9efa9c0ca27c3b10441d61c82c7a143377f8571b8407ed0e747fd44cbec
.exe windows x86

3429a39fc09a8fbca9f38ef344467168

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharUpperA
CharLowerW
GetSystemMetrics
CharUpperW

shell32

SHGetFolderPathW

advapi32

ImpersonateLoggedOnUser
ControlService
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
GetUserNameW
RegOpenCurrentUser
RegEnumKeyExW
RegSetValueExW
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptGenRandom
CryptDeriveKey
CryptAcquireContextW
CryptGetHashParam
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegEnumValueW
RegQueryInfoKeyW
IsTextUnicode
RevertToSelf

kernel32

FindFirstFileW
GetCurrentProcess
GetSystemWindowsDirectoryW
FindClose
FindNextFileW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetTickCount
CompareFileTime
GetSystemTimeAsFileTime
GetFileTime
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
Sleep
GetCommandLineW
HeapSetInformation
GetLastError
HeapFree
HeapReAlloc
RaiseException
GetCPInfo
RtlUnwind
HeapAlloc
LCMapStringW
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetLongPathNameW
SetHandleCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
IsProcessorFeaturePresent
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
GetSystemInfo
IsValidLocale
HeapSize
FreeLibrary
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
ReadFile
GetVersionExW
GetComputerNameW
InitializeCriticalSectionAndSpinCount
DeviceIoControl
SetEnvironmentVariableA
GetFileAttributesExW
GetShortPathNameW
GetFileSizeEx
LocalFree
FileTimeToLocalFileTime
GetTimeZoneInformation
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
BackupRead
FlushFileBuffers
BackupSeek
SetThreadExecutionState
DeleteFileW
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
GetSystemTime
CloseHandle
Module32NextW
CreateToolhelp32Snapshot
Process32NextW
Module32FirstW
Process32FirstW
GetProcAddress
TerminateProcess
OpenProcess
GetModuleHandleW
WaitForSingleObject
CreateProcessW
GetVolumeInformationW
CreateDirectoryW
FindResourceW
LoadResource
SizeofResource
GetEnvironmentStringsW
EnumSystemLocalesA
GetTempPathW
GetDateFormatW
SystemTimeToFileTime
GetTimeFormatW
FileTimeToSystemTime
LockResource

shlwapi

SHRegGetPathW

userenv

GetUserProfileDirectoryW
ExpandEnvironmentStringsForUserW
GetDefaultUserProfileDirectoryW
GetProfilesDirectoryW

mpr

WNetGetConnectionW

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WinVerifyTrust

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW

Sections

.text
Size: 673KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3429a39fc09a8fbca9f38ef344467168

Headers

DLL Characteristics

File Characteristics

Imports

user32

shell32

advapi32

kernel32

shlwapi

userenv

mpr

psapi

version

wintrust

wtsapi32

Sections

.text Size: 673KB - Virtual size: 672KB

.rdata Size: 136KB - Virtual size: 135KB

.data Size: 15KB - Virtual size: 24KB

.rsrc Size: 512B - Virtual size: 504B

.reloc Size: 43KB - Virtual size: 42KB

.vmp0 Size: 508KB - Virtual size: 1.6MB

.text
Size: 673KB - Virtual size: 672KB

.rdata
Size: 136KB - Virtual size: 135KB

.data
Size: 15KB - Virtual size: 24KB

.rsrc
Size: 512B - Virtual size: 504B

.reloc
Size: 43KB - Virtual size: 42KB

.vmp0
Size: 508KB - Virtual size: 1.6MB