31769679a34320dd11d8141f386e1c547af9bb759e8c9b053436eb0aba1a06a8

Sharing

Copy URL Twitter E-mail

General

Target

31769679a34320dd11d8141f386e1c547af9bb759e8c9b053436eb0aba1a06a8
Size

149KB
MD5

4376efffbd9e2974bbbaa2f51c4f48a0
SHA1

697d89e2f454a9668b32b32bc15c7a1043c62896
SHA256

31769679a34320dd11d8141f386e1c547af9bb759e8c9b053436eb0aba1a06a8
SHA512

4cc6b3673eee577f81f6c7a34225ff10af3749709ec98c87be451d33079d97de633e5ed3979c5a61b1a3a2ff90dc58c616f5295da3a580bf87e238bd7efa6699
SSDEEP

3072:ikB1vUZfhcaqExFltG6NLJ+R7Y5IMTL9jPN72YG:i618Zfs6N1cUfTi

Score

N/A

Malware Config

Signatures

Files

31769679a34320dd11d8141f386e1c547af9bb759e8c9b053436eb0aba1a06a8
.exe windows x86

6390cce81012bdffd3ad199754551426

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
FreeSid
LookupAccountSidW
AllocateAndInitializeSid
LsaFreeMemory
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
ConvertStringSidToSidW
InitializeAcl
BuildSecurityDescriptorW
BuildTrusteeWithNameW
AddAccessAllowedAce
GetLengthSid
AddAce
GetSecurityDescriptorDacl
IsWellKnownSid
ConvertSidToStringSidW
GetSidSubAuthority
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
LsaLookupNames
SetThreadToken
OpenThreadToken
GetTokenInformation
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LogonUserW
LsaRetrievePrivateData
LsaStorePrivateData
LsaRemoveAccountRights
LsaEnumerateAccountRights
LsaAddAccountRights
IsValidSecurityDescriptor
GetSecurityDescriptorLength
OpenProcessToken
CreatePrivateObjectSecurityEx
DestroyPrivateObjectSecurity
BuildTrusteeWithSidW
RegConnectRegistryW

kernel32

LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
HeapSetInformation
GetModuleFileNameW
MoveFileExW
OpenEventW
SetEvent
GetWindowsDirectoryA
GetLastError
CreateFileA
CreateFileW
GetFileSize
CloseHandle
SetFilePointer
GetLocalTime
WriteFile
lstrlenW
lstrlenA
GetVersionExA
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
IsDebuggerPresent
GetCurrentThread
GetThreadContext
DebugBreak
CreateDirectoryW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
SetFileAttributesW
DeleteFileW
GetModuleHandleW
FindResourceW
LoadResource
InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
RegOpenKeyExW
RegFlushKey
RegDeleteValueW
RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
LoadLibraryW
FindClose
FindNextFileW
FindFirstFileW
LocalFree
LocalAlloc
LocalSize
LocalReAlloc
GetComputerNameW
CompareStringW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
FormatMessageW
LockResource

msvcrt

__CxxFrameHandler3
wcsrchr
_wcsnicmp
free
_vsnwprintf
malloc
_waccess
_local_unwind4
_wstrtime
_wcsicmp
realloc
_wstrdate
memcpy
_onexit
_lock
__dllonexit
_unlock
_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
_strtime
_stricmp
clock
wcsstr
memset
wcstombs
wcschr

user32

CharPrevA
CharNextA
IsCharAlphaW
CharPrevW
CharNextW
LoadStringW
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetDesktopWindow
SetThreadDesktop
OpenDesktopW
SetProcessWindowStation
OpenWindowStationW
GetThreadDesktop
GetProcessWindowStation
DialogBoxParamW
EndDialog
SetDlgItemTextW
CloseWindowStation
CloseDesktop
IsCharAlphaNumericW

ole32

CoTaskMemRealloc
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateInstance
CoGetObjectContext
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

version

VerQueryValueW

Exports

Exports

?GetRegNodeDispenser@@YGJPAPAUIRegNodeDispenser@@@Z

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nmmpwxs
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6390cce81012bdffd3ad199754551426

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 111KB

.data Size: 512B - Virtual size: 31KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 34KB - Virtual size: 35KB

nmmpwxs Size: - Virtual size: 4KB

.text
Size: 112KB - Virtual size: 111KB

.data
Size: 512B - Virtual size: 31KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 34KB - Virtual size: 35KB

nmmpwxs
Size: - Virtual size: 4KB