c9cd289419865b98624f795cf88035440ff15b8fa68452dc6971ff8ccf8ff488

Sharing

Copy URL Twitter E-mail

General

Target

c9cd289419865b98624f795cf88035440ff15b8fa68452dc6971ff8ccf8ff488
Size

749KB
MD5

72247eb5de233c93f5b94e0058dff250
SHA1

39732d4fb154412d8e9fab689cce00066ac47278
SHA256

c9cd289419865b98624f795cf88035440ff15b8fa68452dc6971ff8ccf8ff488
SHA512

b0bb879df1d0097707a550bee6f55f3fd17a065a241c63b09e4a83e20d3b25dd8bd8dccc73b63358da6f42463578bf28fdd3f9a79eca1581c62f14ae40c7a2ca
SSDEEP

12288:dHGKbmme6HOwwIi7LLnSbHHQg6XNKM1gZyNr2wvoi8Nj5P1t51uHFIQJJWh0zuc8:dHG+enDfTSDQgCKGgZyNC/i8x1uhGh0u

Score

N/A

Malware Config

Signatures

Files

c9cd289419865b98624f795cf88035440ff15b8fa68452dc6971ff8ccf8ff488
.exe windows x86

6199b3f7b851154bc163fe8a178b52cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
UpdateTraceW
ControlTraceW
StopTraceW
EnableTraceEx
StartTraceW
RegQueryValueExW
QueryTraceW
IsValidSid
CloseTrace
ProcessTrace
OpenTraceW
ConvertSidToStringSidW
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CopySid
GetLengthSid
GetTokenInformation
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
RevertToSelf
ImpersonateLoggedOnUser
RegGetValueW
TraceEvent

kernel32

GetTickCount
SetThreadPriority
GetCurrentThread
CreateMutexW
GetCommandLineW
HeapSetInformation
GetLogicalProcessorInformationEx
LocalFree
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserGeoID
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GlobalMemoryStatusEx
GetSystemInfo
GetActiveProcessorCount
GetProductInfo
CompareFileTime
GetLastError
OpenMutexW
ReleaseMutex
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetModuleHandleW
FileTimeToSystemTime
FileTimeToDosDateTime
GetTempFileNameW
GlobalFree
WaitForMultipleObjects
GetTempPathW
GetLongPathNameW
SetLastError
WideCharToMultiByte
CreateDirectoryW
GetFileAttributesW
GetFileSizeEx
SetFilePointerEx
InterlockedDecrement
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
VirtualAlloc
UnmapViewOfFile
VirtualFree
InterlockedIncrement
ResetEvent
CreateThread
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeLibraryAndExitThread
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
GetFileSize
ReadFile
DuplicateHandle
SetEvent
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetSystemDirectoryW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
lstrlenW
SystemTimeToFileTime
GetModuleFileNameW
LocalAlloc
GetLocalTime
CreateFileW
SetFileAttributesW
WriteFile
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
DeleteFileW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
FindClose
MoveFileExW
GetVersionExW
GetSystemTime
GetThreadPriority

user32

LoadStringW
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
GetSystemMetrics

msvcrt

_initterm
wcstoul
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
wcstok_s
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
free
_callnewh
malloc
wcschr
memset
__CxxFrameHandler3
towupper
_vsnwprintf
wcsstr
wcsrchr
memcpy
_vsnprintf
memmove
_wcsicmp
realloc
_wcsnicmp
ceil
_ftol2
_purecall

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathCombineW
StrStrIW
StrToIntExW
PathFileExistsW
ord437
PathAppendW

tdh

TdhGetProperty
TdhGetPropertySize

ole32

CoCreateGuid
StringFromGUID2

shell32

CommandLineToArgvW
SHGetFolderPathW
SHGetFolderPathAndSubDirW

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpSetOption
WinHttpOpen
WinHttpGetDefaultProxyConfiguration
WinHttpWriteData
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpSetCredentials
WinHttpTimeFromSystemTime
WinHttpCloseHandle
WinHttpReadData
WinHttpSetStatusCallback
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpSendRequest

wevtapi

EvtClose
EvtNext
EvtQuery
EvtRender
EvtCreateRenderContext

powrprof

PowerDeterminePlatformRole

ntdll

NtQuerySystemTime
RtlFreeHeap
RtlAllocateHeap

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6199b3f7b851154bc163fe8a178b52cd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

tdh

ole32

shell32

winhttp

wevtapi

powrprof

ntdll

oleaut32

Sections

.text Size: 205KB - Virtual size: 204KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 13KB - Virtual size: 13KB

.vmp0 Size: 500KB - Virtual size: 1.6MB

.text
Size: 205KB - Virtual size: 204KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 13KB - Virtual size: 13KB

.vmp0
Size: 500KB - Virtual size: 1.6MB