170ab5ae9a853d1a8bee98c351a6e785ec547327fc5bcfb9e32680a6e37d4324

Sharing

Copy URL Twitter E-mail

General

Target

170ab5ae9a853d1a8bee98c351a6e785ec547327fc5bcfb9e32680a6e37d4324
Size

887KB
MD5

4a234355ad6ce10574e118f4a304e4a0
SHA1

d72e4b056521bda3c7070da6a4166f255bb08936
SHA256

170ab5ae9a853d1a8bee98c351a6e785ec547327fc5bcfb9e32680a6e37d4324
SHA512

3ed41899ce5a926872b00c3cee9c0509ac6f9f865aa99420ecbfa9a3fa73037432970f0f68eceae3bde53df2a36f59352f0e07236f54689aa860154e878331d5
SSDEEP

24576:9sFpudXGXxPdPOQga6rKF9jEbtunH2wbgg+jCtzYsgfCPhJ0DH68wvPrTzIHO32I:OoX+/qYmLwnrTzI980Q

Score

N/A

Malware Config

Signatures

Files

170ab5ae9a853d1a8bee98c351a6e785ec547327fc5bcfb9e32680a6e37d4324
.exe windows x86

438eeba5fd3cbd0b49aa96d85e4d9b29

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegisterEventSourceW
ReportEventW
DeregisterEventSource
IsValidSid
CopySid
DuplicateToken
CheckTokenMembership
FreeSid
TraceEvent
RegQueryValueExW
EqualSid
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
StartTraceW
EnableTrace
FlushTraceW
StopTraceW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
AllocateAndInitializeSid
InitializeAcl
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FileEncryptionStatusW
RegDeleteKeyW
GetKernelObjectSecurity
RegGetValueW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
OpenProcessToken
ImpersonateLoggedOnUser
CreateProcessAsUserW
RevertToSelf
DuplicateTokenEx
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority

kernel32

InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OpenProcess
lstrlenW
OutputDebugStringA
CloseHandle
VirtualFree
VirtualAlloc
VirtualFreeEx
CreateProcessW
WriteProcessMemory
VirtualAllocEx
GetThreadId
CreateEventW
DuplicateHandle
GetProcessId
CreateMutexW
InterlockedIncrement
InterlockedDecrement
ReadProcessMemory
IsWow64Process
SetEvent
WaitForSingleObject
SetLastError
GetSystemInfo
LocalFree
GetApplicationRecoveryCallback
GetSystemDirectoryW
GetSystemWow64DirectoryW
UnmapViewOfFile
WaitForMultipleObjects
MapViewOfFile
CreateFileMappingW
GetThreadContext
OpenThread
WerGetFlags
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
CreateFileW
QueryFullProcessImageNameW
CheckRemoteDebuggerPresent
CompareStringW
FormatMessageW
GetDriveTypeW
GetFileAttributesW
GetVersion
LoadLibraryW
GetModuleFileNameW
ResetEvent
GetUserDefaultLCID
GetProductInfo
GetVersionExW
CopyFileW
GetLongPathNameW
GetComputerNameExW
DelayLoadFailureHook
FindFirstFileExW
CreateDirectoryW
WriteFile
HeapAlloc
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
HeapFree
FreeConsole
GetConsoleWindow
AttachConsole
CreateThread
lstrcmpiW
GetThreadUILanguage
VirtualQueryEx
SetThreadPriority
GetThreadPriority
GetCurrentThread
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetProcessWorkingSetSize
GetNativeSystemInfo
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
SetFilePointer
OpenFileMappingW
VirtualQuery
SetPriorityClass
GetPriorityClass
InitializeCriticalSection
SetThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
DeleteCriticalSection
CreateThreadpoolWait
GetTempFileNameW
GetTempPathW
InitializeConditionVariable
WakeConditionVariable
ExpandEnvironmentStringsW
GlobalFree
GetStringTypeExW
SleepConditionVariableCS
Process32NextW
Process32FirstW
SearchPathW
RemoveDirectoryW
GetFileSize
GetProcessIoCounters
GetProcessTimes
GetThreadTimes
GetFileSizeEx
OpenMutexW
GetExitCodeProcess
Thread32Next
Thread32First
GetProcessIdOfThread
OpenEventW
GlobalMemoryStatus
GetWindowsDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
FindNextFileNameW
FindFirstFileNameW
SystemTimeToFileTime
GetSystemTime
LoadLibraryExW
TlsGetValue
TlsSetValue
HeapDestroy
TlsFree
TlsAlloc
GetProcessHeap
HeapCreate
SizeofResource
LockResource
LoadResource
FindResourceExW
AddAtomW
DeleteAtom
GetAtomNameW
MulDiv
IsProcessorFeaturePresent
GetThreadLocale
LocalAlloc
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
FindAtomW
GlobalUnlock
GlobalLock
GlobalAlloc
FindResourceW
FreeLibraryAndExitThread
GetModuleHandleExW
SetProcessWorkingSetSize
GetLocaleInfoW
GetUserDefaultUILanguage
DebugBreak
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
HeapSetInformation
SetErrorMode
GetCurrentProcess
SetEnvironmentVariableW
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LCMapStringW
CreateRemoteThread
IsDBCSLeadByte
FileTimeToSystemTime
SetFilePointerEx
FileTimeToDosDateTime
ReadFile
lstrlenA
GetApplicationRestartSettings
DeviceIoControl
GetLastError
CompareFileTime
LoadLibraryA

msvcrt

iswalpha
realloc
_ftol2_sse
_isnan
iswalnum
??1type_info@@UAE@XZ
time
srand
rand
strncmp
_atoi64
atoi
_CxxThrowException
wcspbrk
iswspace
_vscwprintf
tolower
_wtol
wcsstr
_wcstoui64
memcpy
wcsrchr
_wcsdup
qsort
wcschr
_purecall
wcstoul
_wcstoi64
towlower
free
wcstol
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsnicmp
_onexit
_lock
wcsncmp
memset
_vsnwprintf
_vsnprintf
_wcsicmp
_wtoi64
_wtoi
_controlfp
_except_handler4_common
__wgetmainargs
memmove
_ftol2
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
__dllonexit
_unlock

ntdll

RtlAdjustPrivilege
NtSetSystemInformation
NtOpenThreadToken
NtOpenProcessToken
NtQueryInformationToken
NtSystemDebugControl
RtlNtStatusToDosError
RtlCompareMemory
RtlUpcaseUnicodeChar
WinSqmEndSession
WinSqmStartSession
WinSqmEventEnabled
WinSqmEventWrite
DbgPrint
RtlQueryHeapInformation
WinSqmAddToStream
NtQueryInformationThread
NtResumeProcess
NtSuspendProcess
RtlAllocateHeap
RtlFreeHeap
NtGetNextThread
NtSuspendThread
NtResumeThread
RtlInitUnicodeString
RtlAllocateAndInitializeSid
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
ShipAssert
NtClose
NtQuerySystemInformation
RtlDetermineDosPathNameType_U
RtlGetCurrentTransaction
RtlSetCurrentTransaction
NtWaitForMultipleObjects
NtOpenKey
RtlInitUnicodeStringEx
NtQueryValueKey
NtQueryInformationProcess
RtlImageNtHeaderEx
NtQueryEvent
NtOpenEvent
RtlGetUnloadEventTrace

user32

RegisterWindowMessageW
IsWindowVisible
SetParent
GetWindow
EndDialog
DestroyMenu
TrackPopupMenuEx
SetForegroundWindow
SetMenuDefaultItem
GetSubMenu
LoadMenuW
GetCursorPos
FlashWindowEx
GetSysColor
GetWindowTextLengthW
EnableMenuItem
GetWindowInfo
GetWindowThreadProcessId
SystemParametersInfoW
EnumWindows
MonitorFromPoint
LogicalToPhysicalPoint
MonitorFromWindow
IsIconic
GetForegroundWindow
DrawAnimatedRects
FindWindowExW
FindWindowW
ChangeDisplaySettingsW
DestroyIcon
IsHungAppWindow
GetClassNameW
IsWindowEnabled
DispatchMessageW
TranslateMessage
SetRect
GetIconInfo
LoadImageW
ReleaseDC
GetDC
CreateIconIndirect
EqualRect
DrawFrameControl
SetWindowLongW
FillRect
GetSysColorBrush
ChangeWindowMessageFilter
DrawTextW
GetKeyNameTextW
MapVirtualKeyW
GetMonitorInfoW
IntersectRect
DrawIconEx
CopyRect
SetRectEmpty
CallWindowProcW
CreateWindowExW
IsChild
GetFocus
RedrawWindow
SetWindowTextW
GetWindowTextW
UpdateWindow
SetWindowRgn
GetWindowRgnBox
MapWindowPoints
GetParent
SetFocus
DestroyWindow
RegisterClassExW
DefWindowProcW
LoadCursorW
GetClassInfoExW
EnableWindow
SetScrollInfo
GetKeyState
GetClientRect
RemovePropW
SetPropW
GetPropW
CharUpperA
NotifyWinEvent
ScreenToClient
CharUpperW
SetTimer
ClientToScreen
AdjustWindowRectEx
EnumChildWindows
KillTimer
SetCursor
GetMessagePos
InvalidateRect
IsCharAlphaNumericW
PostMessageW
SetWindowPos
ShowWindow
GetWindowRect
CheckWindowThreadDesktop
IsRectEmpty
MonitorFromRect
LoadIconW
GetSystemMetrics
IsWindow
LoadStringW
RegisterErrorReportingDialog
CloseDesktop
CloseWindowStation
SendMessageW
DrawFocusRect
GetWindowLongW
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
PeekMessageW
MsgWaitForMultipleObjects
InflateRect

faultrep

UpdatePerUserLastCrossProcessCollectionTime
CheckPerUserCrossProcessThrottle

oleaut32

VariantInit
SysStringLen
SysAllocStringLen
SysFreeString
SafeArrayCreateVector
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetDim
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocString

psapi

GetMappedFileNameW
EnumProcessModules
GetModuleFileNameExW

gdi32

GetObjectW
StretchBlt
CreateCompatibleBitmap
CreateDIBSection
DeleteEnhMetaFile
GetDeviceCaps
PatBlt
GdiAlphaBlend
GdiGradientFill
GdiTransparentBlt
SetBkMode
SetBkColor
SetTextColor
GetStockObject
SetTextAlign
GetTextAlign
GetLayout
GetTextColor
ExtTextOutW
SetStretchBltMode
BitBlt
PlayEnhMetaFile
GetTextExtentPoint32W
CreatePatternBrush
CreateSolidBrush
SetWindowOrgEx
OffsetWindowOrgEx
GetBkMode
CombineRgn
ExtCreateRegion
GetRegionData
RectVisible
GetRgnBox
OffsetRgn
CreateRectRgn
CreateFontIndirectW
SetBrushOrgEx
GetBrushOrgEx
RealizePalette
SelectPalette
CreateHalftonePalette
GetDIBits
SetLayout
GetBkColor
CreateDIBPatternBrushPt
StretchDIBits
LPtoDP
GetTextMetricsW
GdiGetCharDimensions
SelectObject
DeleteObject
DeleteDC
GetPixel
CreateCompatibleDC

oleacc

GetRoleTextW
CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow
ObjectFromLresult

dbgeng

DebugCreate

ncrypt

BCryptFinishHash
BCryptCreateHash
BCryptGetProperty
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptHashData

imm32

ImmDisableIME

sensapi

IsNetworkAlive

Sections

.text
Size: 731KB - Virtual size: 730KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rhearma
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

438eeba5fd3cbd0b49aa96d85e4d9b29

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

user32

faultrep

oleaut32

psapi

gdi32

oleacc

dbgeng

ncrypt

imm32

sensapi

Sections

.text Size: 731KB - Virtual size: 730KB

.data Size: 51KB - Virtual size: 57KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 82KB - Virtual size: 83KB

rhearma Size: - Virtual size: 4KB

.edata Size: 20KB - Virtual size: 20KB

.text
Size: 731KB - Virtual size: 730KB

.data
Size: 51KB - Virtual size: 57KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 82KB - Virtual size: 83KB

rhearma
Size: - Virtual size: 4KB

.edata
Size: 20KB - Virtual size: 20KB