ac9c71e956c9a57a4e07627d72b23df7e9a65a98f97205df428b733ace9f0573

Sharing

Copy URL Twitter E-mail

General

Target

ac9c71e956c9a57a4e07627d72b23df7e9a65a98f97205df428b733ace9f0573
Size

334KB
MD5

1be2ea78443bbdcd4171e2de14d5edcf
SHA1

0cdd2be6bd7ff5b08294c353c01ffdef1badddc0
SHA256

ac9c71e956c9a57a4e07627d72b23df7e9a65a98f97205df428b733ace9f0573
SHA512

06ad0c28f6051165b47ab1d76cdf26204792d0192f5676bcad5bb5ae1e5ceb50fa9b2cde6c32a52f486c469a60d40a825423ee4df0f42c0be1a3388cfeb80993
SSDEEP

6144:V6fTAnNXtnRJfmkqEiZD8mWCMm874pxyN90vEBiPSfl:0fTAnPnRYsXm04y90jU

Score

N/A

Malware Config

Signatures

Files

ac9c71e956c9a57a4e07627d72b23df7e9a65a98f97205df428b733ace9f0573
.exe windows x86

ddc91ecd17d943e2ee26d62fc9a4fb0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
InitiateSystemShutdownExW
RegSetValueExW
RegCreateKeyExW
CreateProcessAsUserW
RegDeleteKeyW
RegQueryValueExW
RegEnumKeyW
RegDeleteValueW
ConvertSidToStringSidW
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
CopySid
GetTokenInformation
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteKeyValueW
ControlTraceW
EnableTrace
CloseTrace
StartTraceW
GetLengthSid
IsValidSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
CryptReleaseContext
DecryptFileA
CryptGenRandom
CryptAcquireContextW
EventRegister
EventUnregister
EventWrite
EventEnabled

kernel32

ProcessIdToSessionId
GetCurrentProcessId
FormatMessageW
CreateFileW
GetFullPathNameW
GetCurrentProcess
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
InterlockedIncrement
LocalFree
MultiByteToWideChar
GetFileAttributesA
CreateDirectoryA
GetSystemDirectoryA
RemoveDirectoryW
MoveFileExW
DeleteFileW
lstrcmpW
CreateDirectoryW
OutputDebugStringW
lstrlenW
GetFileAttributesW
GetSystemDirectoryW
WaitForSingleObject
GetExitCodeProcess
GetExitCodeThread
FindFirstFileW
lstrcmpiW
FindNextFileW
GetSystemWindowsDirectoryW
InterlockedDecrement
GetLastError
CloseHandle
GetCommandLineW
CreateThread
FreeLibrary
GetProcAddress
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
FindClose

gdi32

GetStockObject
GetDeviceCaps
CreateFontIndirectW
DeleteObject
CreateCompatibleDC
SelectObject
GetTextExtentPoint32W
DeleteDC

user32

GetClientRect
FillRect
EndPaint
SetRect
SendDlgItemMessageW
GetDC
ReleaseDC
SetWindowLongW
ShowWindow
SystemParametersInfoW
MessageBoxW
PostMessageW
BeginPaint
DestroyAcceleratorTable
TranslateAcceleratorW
RegisterClassExW
CreateWindowExW
ShutdownBlockReasonCreate
ShutdownBlockReasonDestroy
DestroyWindow
DefWindowProcW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
PeekMessageW
SetFocus
EnableWindow
GetDlgItem
SetDlgItemTextW
UpdateWindow
LoadCursorW
LoadIconW
EndDialog
DialogBoxParamW
CreateAcceleratorTableW
SendMessageW

msvcrt

memmove
??3@YAXPAX@Z
_vsnwprintf
memset
wcsrchr
_controlfp
?terminate@@YAXXZ
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
memcpy
_vsnprintf
_ftol2
_wcsnicmp
iswdigit
wcschr
_wcsicmp
??2@YAPAXI@Z

ole32

CoInitializeSecurity
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoUninitialize

oleaut32

SysFreeString
VariantInit
SysAllocString

shell32

CommandLineToArgvW
SHGetPathFromIDListW
ShellExecuteExW
SHBrowseForFolderW
ord730

shlwapi

StrToIntExW

ntdll

WinSqmEndSession
WinSqmSetString
WinSqmStartSession
WinSqmSetDWORD

dpx

DpxNewJob

wtsapi32

WTSQueryUserToken

comctl32

InitCommonControlsEx

Sections

.text
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dccgcys
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ddc91ecd17d943e2ee26d62fc9a4fb0c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shell32

shlwapi

ntdll

dpx

wtsapi32

comctl32

Sections

.text Size: 201KB - Virtual size: 201KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 46KB - Virtual size: 47KB

dccgcys Size: - Virtual size: 4KB

.text
Size: 201KB - Virtual size: 201KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 46KB - Virtual size: 47KB

dccgcys
Size: - Virtual size: 4KB