d9486c8beecd30da3ebc43234f2ce038ebcd6f679b98d455f3cc82ff836bb853

Sharing

Copy URL Twitter E-mail

General

Target

d9486c8beecd30da3ebc43234f2ce038ebcd6f679b98d455f3cc82ff836bb853
Size

912KB
MD5

612c071b4259634143b4d80bc8c156ab
SHA1

75f5872defc5dd254533fb785dd5cdaf57b9aed4
SHA256

d9486c8beecd30da3ebc43234f2ce038ebcd6f679b98d455f3cc82ff836bb853
SHA512

e6199012ba55c2611d82efbcbb30af81e4a876dbcfedb1b10536433c04b057eec47e21612b15fa83db6f2581220008184da2a73628c0eed05f57be5ab28f05a4
SSDEEP

24576:dPLMNgiEy4V0XVqPflyH6egGOipp/drrrPM:BMaiw0XEFyH07ippJrP

Score

N/A

Malware Config

Signatures

Files

d9486c8beecd30da3ebc43234f2ce038ebcd6f679b98d455f3cc82ff836bb853
.exe windows x86

94d8bd81651439527b8608c5747cc9ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

mpr

WNetCloseEnum
WNetUseConnectionW
WNetGetUserW
WNetCancelConnection2W
WNetOpenEnumW
WNetEnumResourceA
WNetAddConnection3W
WNetEnumResourceW
WNetGetResourceInformationW
WNetGetProviderNameW
WNetGetUniversalNameW
WNetGetLastErrorW
WNetAddConnection2W
WNetGetConnectionW
WNetOpenEnumA
WNetGetUserA
WNetGetConnectionA

imagehlp

ImageRvaToSection
ImageGetCertificateData
ImageEnumerateCertificates
ImageRvaToVa
CheckSumMappedFile
SymInitialize
ImageNtHeader
ImageLoad
ImageDirectoryEntryToData
ImageUnload
EnumerateLoadedModules64
SymSetOptions

crypt32

RegQueryInfoKeyU

kernel32

AssignProcessToJobObject
GetCurrentThread
CreateToolhelp32Snapshot
CloseHandle
GetThreadTimes
GetAtomNameA
GetNumberFormatW
GetFileAttributesExW
SetLastError
VirtualAlloc
GlobalAlloc
FlushConsoleInputBuffer
GetSystemDirectoryW
MapViewOfFileEx
GetCommTimeouts
GetCommandLineA
GetUserDefaultUILanguage
SetCommMask
LockResource
ExpandEnvironmentStringsW
ReleaseMutex
GlobalMemoryStatusEx
CopyFileExA
WritePrivateProfileStructA
DosPathToSessionPathA
GetProcessHeap
LockFile
GetPrivateProfileSectionNamesA
OpenMutexA

msvcrt

_mbsicmp
iswascii
iswctype
_ismbcspace
ceil
raise
_mbsnicmp
_mbspbrk
__p__environ
iscntrl
isleadbyte
strtol
_wfullpath
_wfsopen
__RTtypeid
wcsncmp
_ultoa
_CxxThrowException
islower
_purecall

rasapi32

RasSetEntryPropertiesW
RasGetProjectionInfoW
RasDialW
RasFreeEapUserIdentityW
RasGetEntryPropertiesW
RasValidateEntryNameW
RasGetHport
RasGetEntryDialParamsW
RasEnumEntriesW
RasEnumDevicesW
RasSetCustomAuthDataW
RasGetEntryHrasconnW
RasConnectionNotificationW
RasGetCustomAuthDataW
RasSetCredentialsW
RasSetEapUserDataA
RasGetEapUserIdentityW
RasGetConnectStatusW
RasSetSubEntryPropertiesW
RasHangUpW
RasGetErrorStringW
RasGetEapUserDataW
RasGetCredentialsW
RasGetAutodialAddressW
RasEnumConnectionsW
RasGetSubEntryPropertiesW
RasDeleteEntryW
RasEnumConnectionsA
RasSetAutodialAddressW

uxtheme

GetThemePartSize
IsThemeBackgroundPartiallyTransparent
DrawThemeText
GetThemeMetric
IsThemeActive
GetThemeBackgroundRegion
IsThemePartDefined
GetThemeBackgroundExtent
GetThemeAppProperties
GetCurrentThemeName
SetWindowTheme
GetThemeMargins
GetWindowTheme
GetThemeFont
DrawThemeParentBackground
GetThemeSysFont
DrawThemeBackground
GetThemeSysColor
OpenThemeData
GetThemeRect
IsAppThemed

advapi32

SystemFunction031
RegisterServiceCtrlHandlerA
SetServiceObjectSecurity
RegQueryMultipleValuesA
CryptReleaseContext
CryptCreateHash
SystemFunction018
RegSetValueExA
SystemFunction035
GetSidLengthRequired
SystemFunction027
RegSaveKeyW
InitializeAcl
GetSecurityDescriptorGroup
SetEntriesInAclW
EnumServicesStatusW
GetTokenInformation
ElfDeregisterEventSource
GetCurrentHwProfileA

winspool.drv

DeletePrintProcessorW
EnumPrintersW
SetPrinterDataW
EnumPrintProcessorsW
ClosePrinter
FindClosePrinterChangeNotification
FreePrinterNotifyInfo
PrinterProperties
DeletePrinterDriverExW
EnumMonitorsW
SetJobA
DocumentPropertiesW
EndDocPrinter
AddPrintProcessorW
DeletePortW
EndPagePrinter

Sections

CODE
Size: 154KB - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 592KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

94d8bd81651439527b8608c5747cc9ab

Headers

DLL Characteristics

File Characteristics

Imports

mpr

imagehlp

crypt32

kernel32

msvcrt

rasapi32

uxtheme

advapi32

winspool.drv

Sections

CODE Size: 154KB - Virtual size: 625KB

.rdata Size: 592KB - Virtual size: 1.0MB

.rsrc Size: 163KB - Virtual size: 162KB

.reloc Size: 2KB - Virtual size: 1KB

CODE
Size: 154KB - Virtual size: 625KB

.rdata
Size: 592KB - Virtual size: 1.0MB

.rsrc
Size: 163KB - Virtual size: 162KB

.reloc
Size: 2KB - Virtual size: 1KB