24179e3bfa458d73e9205a85cfc7813f45e5ed81aa6c0fccaaca2813e1d4a426

Sharing

Copy URL Twitter E-mail

General

Target

24179e3bfa458d73e9205a85cfc7813f45e5ed81aa6c0fccaaca2813e1d4a426
Size

529KB
MD5

6106be7ec2f24d2250de49510f8a71c0
SHA1

87f839238b2abf3f8538186d189ec0428c74051f
SHA256

24179e3bfa458d73e9205a85cfc7813f45e5ed81aa6c0fccaaca2813e1d4a426
SHA512

8d19faaaf9bbcdaffe0a8c5dc3000e286a68fe9223211ac5b838a2bd75b5893c982f0acc3e465b22df881b9646d0846b5da0286fdc1b13f98df04f1e4c9b1808
SSDEEP

12288:VQ90Tgx1JZ/BeL4z5LzN+jpKwm0YPATIOML:VhTgxrZpK4z53N1PAkO

Score

N/A

Malware Config

Signatures

Files

24179e3bfa458d73e9205a85cfc7813f45e5ed81aa6c0fccaaca2813e1d4a426
.exe windows x64

7e083730597ae9446d26be0382d3945b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RtlUnwindEx
IsProcessorFeaturePresent
RtlPcToFileHeader
SetLastError
GetCurrentThread
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
CreateSemaphoreW
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LCMapStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
LocalFree
CreateDirectoryW
DeleteFileW
RemoveDirectoryW
WaitForMultipleObjects
LoadLibraryW
WaitForSingleObject
GetExitCodeProcess
DuplicateHandle
ReleaseMutex
GetEnvironmentVariableW
lstrcmpiW
VirtualQuery
GetTempPathW
GetLocalTime
OutputDebugStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcmpW
lstrlenW
SetFilePointer
CreateMutexW
MultiByteToWideChar
TryEnterCriticalSection
SetEvent
ResetEvent
GetFileAttributesExW
VerifyVersionInfoW
VerSetConditionMask
MoveFileExW
GetFileTime
ReadFile
DeviceIoControl
SetProcessWorkingSetSize
OpenProcess
CreateProcessW
ReadProcessMemory
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CreateThread
DebugActiveProcess
GetThreadContext
DebugActiveProcessStop
VirtualQueryEx
GetProcessId
GetSystemInfo
ContinueDebugEvent
WaitForDebugEvent
GetProcAddress
GetModuleHandleExW
ExitProcess
GetCommandLineW
EncodePointer
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
ReleaseSemaphore
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
IsDebuggerPresent
InitializeCriticalSection
GetUserDefaultLangID
GetSystemDefaultLangID
GetComputerNameExW
GetOverlappedResult
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
UnregisterWait
GetProcessTimes
UnregisterWaitEx
RegisterWaitForSingleObject
VirtualProtect
VirtualAlloc
HeapReAlloc

user32

SetClipboardData
EmptyClipboard
OpenClipboard
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
CloseClipboard
CharLowerW
wvsprintfW
DispatchMessageW
GetMessageW
PeekMessageW
wsprintfW
MessageBoxW
GetProcessWindowStation
PostThreadMessageW
SetThreadDesktop
CharUpperW
CreateWindowStationW
CloseWindowStation
GetThreadDesktop
SetProcessWindowStation
CloseDesktop
CreateDesktopW

advapi32

SetTokenInformation
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetAce
MakeSelfRelativeSD
GetSecurityDescriptorLength
EqualSid
SetNamedSecurityInfoW
ConvertStringSidToSidW
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
ConvertSidToStringSidW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent

ole32

CoCreateGuid
StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetWkstaGetInfo
NetApiBufferFree

rpcrt4

UuidCreate

shlwapi

PathIsRelativeW
SHQueryValueExW
PathRemoveExtensionW
PathRemoveFileSpecW
PathStripPathW
PathCanonicalizeW
PathAppendW

userenv

UnloadUserProfile

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 240KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e083730597ae9446d26be0382d3945b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

netapi32

rpcrt4

shlwapi

userenv

version

Sections

.text Size: 191KB - Virtual size: 190KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 8KB - Virtual size: 22KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 240KB - Virtual size: 464KB

.text
Size: 191KB - Virtual size: 190KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 8KB - Virtual size: 22KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 240KB - Virtual size: 464KB