54703c2c6572e70352fe5f298023be9fea25c7b57f4453ca24b3f9214537790b

Sharing

Copy URL Twitter E-mail

General

Target

54703c2c6572e70352fe5f298023be9fea25c7b57f4453ca24b3f9214537790b
Size

107KB
MD5

62a404d6a449f331ed552263d9103ad0
SHA1

55c3d09b8e8077ebb75341ebed300ebc3d71ddea
SHA256

54703c2c6572e70352fe5f298023be9fea25c7b57f4453ca24b3f9214537790b
SHA512

08110aa9da87b939e1fd9b00f8fc7e2f381008d75fb3bba4ee3d62d639c6c1589fde731d8be5e575745297cf947ce93330739032a423a16aa1743d76b1f0667d
SSDEEP

1536:mJIp05PZYuOA9hsuO7gKRSgZp6dr8C+zjG4y4MH491UvWwaqJ1Yz5Czz0Na:JiPuIhqzU4jjybWUS+ECzz0

Score

N/A

Malware Config

Signatures

Files

54703c2c6572e70352fe5f298023be9fea25c7b57f4453ca24b3f9214537790b
.exe windows x86

4d834c853615db808bf3d8641f36d6cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
TraceEvent
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegGetValueW
RegCreateKeyExW
RegSetValueExW

kernel32

RtlCaptureStackBackTrace
IsDebuggerPresent
DebugBreak
HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap
TerminateProcess
TerminateThread
GetCurrentThread
GetModuleHandleW
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
GetStartupInfoA
InterlockedCompareExchange
FreeLibrary
Sleep
GetUserDefaultLangID
FormatMessageW
GetExitCodeThread
WaitForSingleObject
RegisterWaitForSingleObject
GetThreadId
ProcessIdToSessionId
GetCurrentProcessId
GetCurrentProcess
SetProcessWorkingSetSize
GetSystemInfo
GetTickCount
GetProcAddress
LoadLibraryW
SetErrorMode
QueryFullProcessImageNameW
ExitProcess
GetCurrentThreadId
SetProcessShutdownParameters
SetUnhandledExceptionFilter
HeapSetInformation
WerSetFlags
SetLastError
GetLastError
GetTickCount64
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
ResumeThread
DuplicateHandle
InterlockedDecrement
InterlockedIncrement
LocalReAlloc
LocalAlloc
LocalFree
lstrcmpiW
WaitForMultipleObjectsEx
IsWow64Process
SetThreadPriority
CreateThread
OpenProcess
ReleaseMutex
CreateMutexW
SetEvent
OpenEventW
CreateEventW
SignalObjectAndWait
CloseHandle
UnhandledExceptionFilter
DelayLoadFailureHook
EnterCriticalSection
InterlockedExchange

gdi32

CreateCompatibleBitmap
DeleteObject
GetDIBits
CreateDIBSection
GetRandomRgn
GetStockObject
CreateRectRgn
GdiAlphaBlend
OffsetRgn
CombineRgn
CreateCompatibleDC
SelectClipRgn
SelectObject
GetRgnBox
DeleteDC
BitBlt
GetDeviceCaps

user32

RegisterSessionPort
DwmStopRedirection
GetDC
ReleaseDC
EnumDisplayDevicesW
DwmStartRedirection
UnregisterSessionPort
CheckDesktopByThreadId
EnumDisplaySettingsW
GetSystemMetrics
RegisterErrorReportingDialog
RegisterGhostWindow
HungWindowFromGhostWindow
InternalGetWindowIcon
GhostWindowFromHungWindow
RegisterFrostWindow
OpenThreadDesktop
SetForegroundWindow
IsHungAppWindow
MessageBeep
IsWindowEnabled
EnumWindows
FlashWindowEx
SystemParametersInfoW
IsWindow
GetCaretBlinkTime
EndTask
OpenDesktopW
IsDialogMessageW
GetAncestor
SetThreadDesktop
EndPaint
ClientToScreen
InternalGetWindowText
GetUpdateRgn
SetTimer
IsIconic
FillRect
KillTimer
IsZoomed
GetTitleBarInfo
GetWindowInfo
LogicalToPhysicalPoint
GetClientRect
BeginPaint
InvalidateRect
GetWindowLongW
GetWindowTextW
GetDCEx
SetWindowLongW
ShowWindow
GetSysColorBrush
GetGuiResources
SetWindowPos
LoadStringW
LoadIconW
RegisterWindowMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterPowerSettingNotification
PostQuitMessage
DestroyWindow
UnregisterPowerSettingNotification
DefWindowProcW
CreateWindowExW
RegisterClassExW
SetProcessDPIAware
PostMessageW
MsgWaitForMultipleObjectsEx
GetThreadDesktop
GetUserObjectInformationW
CloseDesktop
ChangeWindowMessageFilter
GetWindow
GetMonitorInfoW
GetPropW
AdjustWindowRectEx
MonitorFromWindow
GetClassNameW
SetClassLongW
OffsetRect
GetWindowRect
GetWindowThreadProcessId
DestroyIcon
SetWindowTextW
UpdateWindow
SendMessageW
IsWindowVisible
PostThreadMessageW
CreateDialogParamW

msvcrt

_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
memset
rand
srand
_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_purecall
_vsnwprintf
_wcsicmp
memmove
wcsrchr
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
memcpy

ntdll

RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
RtlInitializeGenericTable
DbgPrompt
DbgBreakPoint
NtQuerySystemInformation
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtRequestPort
NtConnectPort
NtRequestWaitReplyPort
WinSqmIsOptedIn
RtlUpcaseUnicodeChar
NtClose
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
RtlAllocateAndInitializeSid
WinSqmEventWrite
WinSqmEventEnabled
NtQueryInformationProcess
DbgPrintEx
WinSqmAddToStream
NtReplyPort
NtCreateWaitablePort
RtlInitUnicodeString
RtlInsertElementGenericTable
RtlNumberGenericTableElements
RtlIsGenericTableEmpty
RtlLookupElementGenericTable

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString

uxtheme

CloseThemeData
OpenThemeData

imm32

ImmDisableIME

dwmredir

DwmRedirectionManagerDispatchMessage
DwmRedirectionManagerShutdown
DwmRedirectionManagerInitialize
DwmShutdownTransport
DwmRedirectionManagerPlayingVideo
DwmRedirectionManagerFailMessage
DwmVersionCheck
DwmRedirectionManagerLockMemoryAllocations
DwmRedirectionManagerWaitForMultipleObjects
DwmInitializeTransport
DwmRedirectionManagerEnableMMCSS

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bfwrdpz
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4d834c853615db808bf3d8641f36d6cb

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

ole32

oleaut32

uxtheme

imm32

dwmredir

Sections

.text Size: 69KB - Virtual size: 69KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 30KB - Virtual size: 31KB

bfwrdpz Size: - Virtual size: 4KB

.text
Size: 69KB - Virtual size: 69KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 30KB - Virtual size: 31KB

bfwrdpz
Size: - Virtual size: 4KB