4f635434c306fb3baf3fbb3182a60e0c1b4f35e20c324916bc7e9551b590774a

Sharing

Copy URL Twitter E-mail

General

Target

4f635434c306fb3baf3fbb3182a60e0c1b4f35e20c324916bc7e9551b590774a
Size

49KB
MD5

158b6b5393d838a0d96aeec584b92700
SHA1

e0c162c2c58bd824a530252c519d012f257b743a
SHA256

4f635434c306fb3baf3fbb3182a60e0c1b4f35e20c324916bc7e9551b590774a
SHA512

f258be748c64c7645d449e784f2c881c98a10a76160a5e061606ca05c4b64fbccfea4ac73b82aff51b5f98b2fb4690ddc9d8c0f1a605a1051bae5555afb5849f
SSDEEP

768:+Zrg6595BU0dg/0ayqV+5NO2cqyzXazvmb1UedBktIsRdE6sNc7ZV:+Z865rBU0d+85NO2781DYRdPsNcb

Score

N/A

Malware Config

Signatures

Files

4f635434c306fb3baf3fbb3182a60e0c1b4f35e20c324916bc7e9551b590774a
.exe windows x86

cd34303891171fb5835b5bd38eea5ec5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__commode
__p__fmode
__setusermatherr
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
memcpy
memset
strcpy_s
_vsnprintf_s

ntdll

NtCreatePort
NtConnectPort
NtListenPort
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
NtSetSecurityObject
NtOpenEvent
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlSetProcessIsCritical
NtSetInformationProcess
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
NtSetInformationFile
RtlCreateSecurityDescriptor
RtlLengthSid
RtlSetOwnerSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlAllocateAndInitializeSid
RtlAddMandatoryAce
RtlSetSaclSecurityDescriptor
RtlMakeSelfRelativeSD
RtlUnhandledExceptionFilter
DbgPrintEx
NtRequestWaitReplyPort

rpcrt4

I_RpcMapWin32Status
RpcServerRegisterIf2
RpcServerListen
RpcServerUseProtseqEpW
NdrServerCall2

sspisrv

SspiSrvInitialize
SspiSrvClientCallback

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetErrorMode
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedCompareExchange
InterlockedExchange

api-ms-win-core-libraryloader-l1-1-0

GetProcAddress
LoadLibraryExW
GetModuleHandleA

api-ms-win-core-localregistry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-misc-l1-1-0

LocalAlloc
LocalFree
Sleep

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
SetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
ExitThread
CreateThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

SetEvent
OpenEventW
CreateEventW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-1-0

GetTokenInformation

Exports

Exports

LsaGetInterface
LsaRegisterExtension

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cd34303891171fb5835b5bd38eea5ec5

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

rpcrt4

sspisrv

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 972B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 29KB

.text
Size: 16KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 972B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 29KB