dff0a877a78703e40c0ca9b7abad8d372b93f11d190693d5aced393a5ac21322

Sharing

Copy URL Twitter E-mail

General

Target

dff0a877a78703e40c0ca9b7abad8d372b93f11d190693d5aced393a5ac21322
Size

660KB
MD5

67e47db38905fc7e58851db55c2a5d20
SHA1

6fbd37e1495aad9930b2e87c9f58c22fb71d62b8
SHA256

dff0a877a78703e40c0ca9b7abad8d372b93f11d190693d5aced393a5ac21322
SHA512

7540d4b6efec133f199292159b7e7bdfa87ceb08c4f8134ce06c8480cade818dc04e01794c9d8e7808f44371b15be32011e4ff0e52d90e5fec01b64d207b5770
SSDEEP

12288:zGlNs/AT0V5wVO8RnO6NZ80oP0PfE5zpOperZ/qPq9tZOgF1IgPToXNFBX6noE9o:zwjRnOaZO8M5OY/Aq9tAgF1IgPToFX2a

Score

N/A

Malware Config

Signatures

Files

dff0a877a78703e40c0ca9b7abad8d372b93f11d190693d5aced393a5ac21322
.exe windows x86

16b81b80f65bf81003a67234b735409f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CopySid
GetLengthSid
IsValidSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
InitializeAcl
EventRegister
EventUnregister
EventWrite
AdjustTokenPrivileges
LookupPrivilegeValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
OpenThreadToken
LookupAccountNameW
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
MakeSelfRelativeSD
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorLength
GetSidSubAuthority
SetSecurityDescriptorSacl
MakeAbsoluteSD
InitializeSid
GetSidLengthRequired
DeleteAce
EqualPrefixSid
LookupAccountSidW
CreateWellKnownSid
DeregisterEventSource
RegisterEventSourceW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

GetModuleHandleW
SetLastError
InterlockedIncrement
InterlockedDecrement
LoadLibraryA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
GlobalFree
GlobalAlloc
WaitForMultipleObjects
GetTickCount
CreateThread
LoadLibraryW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
ResetEvent
LocalFree
GetHandleInformation
OpenEventW
GetCurrentProcessId
SetErrorMode
HeapSetInformation
lstrlenA
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
GetThreadTimes
GetCurrentProcess
GetProcessTimes
GetCurrentThreadId
WaitForSingleObject
SetEvent
CreateEventW
GetProcAddress
FreeLibrary
CloseHandle
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
lstrlenW
GetSystemDefaultLCID
CompareStringW
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
SearchPathW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetVersionExW
FindResourceExW
WaitForSingleObjectEx
OutputDebugStringW
CopyFileA
DeleteFileA
FlushViewOfFile
GetLocalTime
CreateFileA
FormatMessageA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
LCMapStringW
SetPriorityClass
IsValidCodePage
OpenFileMappingW
OpenSemaphoreW
CreateFileMappingW
VerSetConditionMask
VerifyVersionInfoW
ReleaseSemaphore
RegEnumValueW
RegQueryValueExW
RegDeleteKeyExW
ExpandEnvironmentStringsW
CreateFileW
DuplicateHandle
GetFileSize
GetFileTime
UnlockFile
LockFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
WriteFile
ReadFile
DeleteFileW
FormatMessageW
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
ReleaseMutex
GetCurrentThread
GetVersionExA

msvcrt

_vsnwprintf
bsearch
fprintf
_iob
_controlfp
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
strncmp
strerror
_itow_s
_set_error_mode
_wcsicmp
_wtoi
_itow
wcsncpy_s
memcpy_s
memcpy
memset
__CxxFrameHandler3
wcschr
_purecall
_wcsnicmp
wcsncmp
_CxxThrowException
malloc
free
iswspace
_wtol
_ultow
_vsnprintf

user32

LoadStringW
UnregisterClassA
GetLastInputInfo
MsgWaitForMultipleObjects
CharNextW
PeekMessageW
DispatchMessageW

ole32

CLSIDFromProgID
CoInitializeSecurity
CoDisconnectObject
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CreateBindCtx
CreateStreamOnHGlobal
CoUnmarshalInterface
CoTaskMemFree
PropVariantClear
CoUninitialize
CoInitializeEx
PropVariantCopy

oleaut32

SysStringLen
SetErrorInfo
CreateErrorInfo
VarUI4FromStr
GetErrorInfo
SysFreeString

tquery

?ciNewNoThrow@@YGPAXI@Z
?ciNew@@YGPAXI@Z
?ciDelete@@YGXPAX@Z

msshooks

LoadMSSearchHooks

imm32

ImmDisableIME

shlwapi

SHRegGetValueW

ntdll

WinSqmIncrementDWORD

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

16b81b80f65bf81003a67234b735409f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

tquery

msshooks

imm32

shlwapi

ntdll

Sections

.text Size: 147KB - Virtual size: 146KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.vmp0 Size: 500KB - Virtual size: 1.6MB

.text
Size: 147KB - Virtual size: 146KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB

.vmp0
Size: 500KB - Virtual size: 1.6MB