14e003c8fcf8e7753eb382c5049d5a12cf3045b3e97aec1ef5269325f11e5897

Sharing

Copy URL Twitter E-mail

General

Target

14e003c8fcf8e7753eb382c5049d5a12cf3045b3e97aec1ef5269325f11e5897
Size

46KB
MD5

489d6e908b2287224a8c8f1cd925c794
SHA1

22c27c2a6064d868d2a350886659b6a32f4f35f0
SHA256

14e003c8fcf8e7753eb382c5049d5a12cf3045b3e97aec1ef5269325f11e5897
SHA512

e03d3411f406dbb25799fb1bf4e456c8161f4064d32c0c32ec9de09398f6d780aa2533236656ca0157656244cae301c9cf14b3eb467061f1df347f521d8cf899
SSDEEP

768:KcqD0Xnbvk3vX4f6rFURh/pPhpqlk4xtN6qcAnbCqjnIPrdm7YnvsH+qf83B:K5Ubvk/M6ZmhdAk4xtN6qcEbIP42qqB

Score

N/A

Malware Config

Signatures

Files

14e003c8fcf8e7753eb382c5049d5a12cf3045b3e97aec1ef5269325f11e5897
.exe windows x86

7b9d368711f6c3a1d25583fce708759f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shutil

REG_OpenEx
OMP_ARRAY_Create
RemoveSchedTaskFromCMA
OMP_ARRAY_RemoveAt
OMP_ARRAY_Add
LoadSchedTaskData
SaveSchedTaskData
REG_SetValueEx
OMP_ARRAY_GetCount
OMP_ARRAY_GetAt
OMP_ARRAY_Destroy
REG_DeleteValue
REG_EnumTasks
REG_QueryValueEx
REG_DeleteKey
GetComponentPath
REG_GetOpt
REG_SetOpt
REG_GetKey
REG_Close
REG_Open
Sh_AddToRolledbackDATList

naicondl

NaiConsoleServerCreate1

msvcrt

__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_c_exit
sprintf
strrchr
qsort
_snwprintf
wcsstr
_wcsnicmp
free
memmove
wcscmp
time
srand
wcsncpy
_except_handler3
_wcsicmp
malloc
wcslen
wcscpy
wcscat
wcsrchr
wcschr
_controlfp
_strdup

kernel32

FindFirstFileExW
GetProcAddress
LoadLibraryW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
GetCurrentProcess
SetProcessWorkingSetSize
GlobalFree
GlobalUnlock
GlobalHandle
OpenEventW
CreateProcessW
GlobalLock
GlobalAlloc
WriteFile
SetFilePointer
SetLastError
SetErrorMode
GetLocalTime
GetLastError
OpenProcess
FreeLibrary
LoadLibraryA
CreateDirectoryA
FindFirstFileA
CreateFileA
GetCurrentProcessId
WritePrivateProfileStringA
OpenEventA
SetUnhandledExceptionFilter
LoadLibraryExW
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
FindFirstFileW
FormatMessageW
WaitForMultipleObjects
GetCurrentThreadId
SetEvent
Sleep
WaitForSingleObject
CreateEventW
CloseHandle
CreateThread
CreateFileW
GetModuleFileNameW
FindClose
FindNextFileW
GetExitCodeProcess

user32

RegisterWindowMessageA
MessageBoxW
wsprintfA
PostMessageA
wsprintfW

advapi32

RegOpenKeyExA
AddAccessAllowedAce
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
InitializeAcl
InitializeSecurityDescriptor
CloseServiceHandle
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
StartServiceW
ControlService
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
RegQueryValueExA

ntdll

_wcslwr

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7b9d368711f6c3a1d25583fce708759f

Headers

File Characteristics

Imports

shutil

naicondl

msvcrt

kernel32

user32

advapi32

ntdll

version

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 4KB

.rsrc Size: 19KB - Virtual size: 21KB

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 19KB - Virtual size: 21KB