1bfad00f6ecc33ec542a37226dc6c1774ca707dabfd5cb2b9ab8c0df770387d9

Sharing

Copy URL Twitter E-mail

General

Target

1bfad00f6ecc33ec542a37226dc6c1774ca707dabfd5cb2b9ab8c0df770387d9
Size

205KB
MD5

637dae2530cc39fb73ac560f71d9c729
SHA1

e5534462e998f78a11c5ad9f735e8b412c2ea98a
SHA256

1bfad00f6ecc33ec542a37226dc6c1774ca707dabfd5cb2b9ab8c0df770387d9
SHA512

07aa104384f356fe9dd3aa2faf6c92c03cb743184c5912a0a1fdeb8f13d99bf04157fc4f01b2defb1e80796b092b4d634f22e7433d6dee75810010a43b741520
SSDEEP

3072:Tb0LiBUAyP1dpw+Vl9LUgyRolcK3Jzj34wTSJae95vaty:Tb0kdyjVl9Ag3Jzjow6a+D

Score

N/A

Malware Config

Signatures

Files

1bfad00f6ecc33ec542a37226dc6c1774ca707dabfd5cb2b9ab8c0df770387d9
.exe windows x86

d996a1d004cd316835839d4bb144613f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
GetCurrentProcess
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
CloseHandle
CreateThread
WaitForSingleObject
TerminateThread
GetModuleFileNameA
LocalAlloc
LocalFree
GetProcessHeap
HeapAlloc
HeapFree
GetTickCount
Sleep
GetLastError
SetEndOfFile
ReadFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
FlushFileBuffers
SetStdHandle
GetLocaleInfoW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleHandleA
WriteFile
GetStdHandle
ExitProcess
HeapSize
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

advapi32

CryptSetProvParam
QueryServiceStatusEx
RegisterEventSourceA
ReportEventA
DeregisterEventSource
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
CreateServiceA
ChangeServiceConfig2A
SetServiceStatus
QueryServiceConfigA
ChangeServiceConfigA
DeleteService
EnumDependentServicesA
ControlService
CryptAcquireContextA
CryptReleaseContext
CryptDestroyHash
CryptGetKeyParam
CryptGetUserKey
CryptSignHashA
CryptHashData
CryptCreateHash
StartServiceA

cryp_api

Crypt_OpenDevice
Crypt_CloseDevice
Crypt_BinaryToBase64String
Crypt_ReadCert
Crypt_Sign
Crypt_Login
Crypt_Base64StringToBinary

decodecert

GetCertInfo

ws2_32

setsockopt
recv
send
accept
listen
WSACleanup
WSAStartup
socket
gethostname
gethostbyname
inet_ntoa
inet_addr
htons
bind
closesocket
WSAGetLastError

psapi

GetModuleBaseNameA

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d996a1d004cd316835839d4bb144613f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

cryp_api

decodecert

ws2_32

psapi

Sections

.text Size: 166KB - Virtual size: 165KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 166KB - Virtual size: 165KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 1KB - Virtual size: 1KB