02720c1cac2d6d17f93e90be1a188648240a85188fce9fcdfb80b228f5710739

Sharing

Copy URL Twitter E-mail

General

Target

02720c1cac2d6d17f93e90be1a188648240a85188fce9fcdfb80b228f5710739
Size

146KB
MD5

6d7e98f631c54ecf0b116ec384180ed0
SHA1

3cca65d8e22f4954bc0c2f7b90cee378b654b351
SHA256

02720c1cac2d6d17f93e90be1a188648240a85188fce9fcdfb80b228f5710739
SHA512

956af67db48e328a8edec1f78fef46ce870067353213444f6f7508859fdb64209118f44af4a175fc8354a93789d3b3914d33471f23f5f71f6d9941c3e592271f
SSDEEP

3072:DHxuJiqVJaInIS/GDFoCIf0o0XQJ9hF1EkvtuRByIFySrfnxaQXh0DP+s7G7x2RB:sJiqaGI2QXh0RAgX80

Score

N/A

Malware Config

Signatures

Files

02720c1cac2d6d17f93e90be1a188648240a85188fce9fcdfb80b228f5710739
.dll windows x86

53491f234fe86173672d788e8602acd7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
_vsnwprintf
wcschr
_purecall
wcsrchr
wcsncmp
wcstoul
_wcslwr
_wcsicmp
__CxxFrameHandler3
_wcsnicmp
memcpy
swscanf
_XcptFilter
malloc
free
_initterm
_amsg_exit
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit

ntdll

RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlNtStatusToDosError
RtlAdjustPrivilege
RtlConvertSidToUnicodeString
RtlUnicodeStringToInteger
RtlInitUnicodeString
RtlFreeUnicodeString

kernel32

FindClose
FindFirstFileW
DisableThreadLibraryCalls
GetSystemDefaultLangID
DebugBreak
ResetEvent
SetEvent
WriteFile
SetEndOfFile
CreateFileW
DeleteCriticalSection
InitializeCriticalSection
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
FindNextFileW
GetSystemTime
GetSystemInfo
GetComputerNameW
CompareStringW
GetProcAddress
LoadLibraryW
FreeLibrary
MoveFileExW
LeaveCriticalSection
EnterCriticalSection
FreeLibraryAndExitThread
WaitForSingleObjectEx
ReadFileEx
GetCurrentProcess
GetModuleHandleExW
ExpandEnvironmentStringsW
MoveFileW
CompareFileTime
SetFilePointer
OutputDebugStringW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
FormatMessageW
InterlockedDecrement
InterlockedIncrement
GetFullPathNameW
GetCurrentDirectoryW
RemoveDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetFileSize
ReadFile
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FileTimeToSystemTime
CopyFileW
lstrcmpW
LocalAlloc
LocalFree
lstrlenW
CreateEventW
CreateThread
WaitForMultipleObjects
WaitForSingleObject
GetCurrentThread
DeleteFileW
lstrcmpiW
GetLastError
CloseHandle
SetLastError
GetSystemDirectoryW
GetFileAttributesExW

userenv

FreeGPOListW
GetAppliedGPOListW
ForceSyncFgPolicy
RsopSetPolicySettingStatus
RsopAccessCheckByType
EnterCriticalPolicySection
LeaveCriticalPolicySection
RsopResetPolicySettingStatus

advapi32

SetFileSecurityW
DeleteAce
EqualSid
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
OpenEventLogW
ReportEventW
CloseEventLog
OpenProcessToken
GetTokenInformation
RegDeleteKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
FreeSid
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
OpenThreadToken
RegisterServiceCtrlHandlerW
SetServiceStatus
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
RegSetValueExW
DuplicateTokenEx
ImpersonateLoggedOnUser
RegOpenCurrentUser
RevertToSelf
RegCloseKey
GetAce
AddAccessAllowedAce
RegEnumKeyW
DuplicateToken
GetUserNameW
CheckTokenMembership
ConvertSidToStringSidW
ConvertStringSidToSidW
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

rpcrt4

RpcServerUseProtseqW
RpcBindingToStringBindingW
UuidCreate
RpcImpersonateClient
NdrServerCall2
RpcStringBindingParseW
RpcStringFreeW
RpcEpUnregister
RpcEpRegisterW
UuidFromStringW
RpcServerInqBindings
RpcRaiseException
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcBindingVectorFree

adsldpc

ADSISetObjectAttributes
ADSICloseDSObject
ADSIGetObjectAttributes
ADSICloseSearchHandle
ADSIFreeColumn
ADSIGetFirstRow
ADSIExecuteSearch
ADSIDeleteDSObject
ADSISetSearchPreference
ADSICreateDSObject
BuildADsPathFromParent
ADSIGetNextRow
ADsEncodeBinaryData
ADSIGetColumn
ADSIOpenDSObject
BuildADsParentPath
FreeADsMem

oleaut32

SysStringLen
VariantInit
VariantClear
SafeArrayCreate
SafeArrayPutElement
SysFreeString
SysAllocString

ole32

CoInitializeEx
CoUninitialize

Exports

Exports

CsCreateClassStore
CsEnumApps
CsGetAppCategories
CsGetClassAccess
CsGetClassStore
CsGetClassStorePath
CsRegisterAppCategory
CsServerGetClassStore
CsSetOptions
CsUnregisterAppCategory
DllCanUnloadNow
DllGetClassObject
GenerateGroupPolicy
IID_IClassAdmin
ProcessGroupPolicyObjectsEx
ReleaseAppCategoryInfoList
ReleasePackageDetail
ReleasePackageInfo
ServiceMain

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53491f234fe86173672d788e8602acd7

Headers

File Characteristics

Imports

msvcrt

ntdll

kernel32

userenv

advapi32

rpcrt4

adsldpc

oleaut32

ole32

Exports

Exports

Sections

.text Size: 136KB - Virtual size: 136KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 136KB - Virtual size: 136KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB