9dec840736de400e36c73db94d450469ab7b7208bdc979876d04cb06b3f768d3

Sharing

Copy URL

Twitter E-mail

General

Target

9dec840736de400e36c73db94d450469ab7b7208bdc979876d04cb06b3f768d3
Size

220KB
MD5

4b77a45b7e056b6503699b06fb31b8d0
SHA1

e03462cdea4def1b05646f6223efda679620407f
SHA256

9dec840736de400e36c73db94d450469ab7b7208bdc979876d04cb06b3f768d3
SHA512

bcaba793d7fc0aef817ed0d79dcef83796629a81155a1c5fab715861f5538bd1e6d7b1d7fcfcd78cebcda42afcdad06c2b78abef93d17597bca1ad1b194ee34f
SSDEEP

3072:Oany1C/fCSsl/5T3NLqbEKm3edlaeWX1avKPYQmHcBaeZ/R7WS3TXwn:pny1h5rNO7m3olar0Qmk/RFTwn

Score

N/A

Malware Config

Signatures

Files

9dec840736de400e36c73db94d450469ab7b7208bdc979876d04cb06b3f768d3
.exe windows x86

4064630da72a31c1ae8fe6b6b6d66e8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
RegQueryInfoKeyW
RegEnumValueW
ConvertStringSidToSidW
CreateWellKnownSid
EqualSid
GetAce
OpenThreadToken
ImpersonateSelf
AdjustTokenPrivileges
LookupPrivilegeValueW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetSecurityInfo
RevertToSelf
SetEntriesInAclW
QueryServiceStatusEx
StartServiceW
ControlService
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ChangeServiceConfigW

kernel32

lstrlenW
QueryFullProcessImageNameW
OpenProcess
MultiByteToWideChar
CloseHandle
SetEvent
OpenEventW
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateThread
WideCharToMultiByte
WaitForMultipleObjects
LocalFree
GetModuleHandleW
GetCurrentThread
CreateDirectoryW
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
lstrlenA
InterlockedDecrement
GetSystemTime
WriteFile
SetFilePointer
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetWindowsDirectoryW
GetTickCount64
CompareStringW
GetCurrentProcess
CreateProcessW
CopyFileW
GetModuleFileNameW
GetTempPathW
CreateEventW
DelayLoadFailureHook
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
InterlockedIncrement
GetProcAddress
LoadLibraryW
FlushFileBuffers
DeleteFileW
CompareFileTime
GetLastError
LocalAlloc
SetEndOfFile
MoveFileExW
OutputDebugStringW
CreateMutexW
OpenMutexW
ReleaseMutex
InterlockedExchange

msvcrt

wcsncat_s
wcscpy_s
wprintf_s
wcstol
_wcslwr_l
_controlfp
_except_handler4_common
_onexit
__dllonexit
_unlock
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
wcscat_s
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_callnewh
??0exception@@QAE@XZ
wcschr
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_lock
iswpunct
swscanf
wcsncmp
_wcsicmp
??0exception@@QAE@ABQBD@Z
memmove_s
_resetstkoflw
_purecall
_vsnwprintf
iswspace
memcpy
_wtoi
iswdigit
memset
__CxxFrameHandler3
wcsstr
_wcslwr_s_l
_CxxThrowException
free
_wcmdln
?what@exception@@UBEPBDXZ
wcsncpy_s
towlower
memcpy_s
malloc
_wcsdup

user32

LoadStringW
CharLowerBuffW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CLSIDFromString
StringFromCLSID
CoSetProxyBlanket
CoTaskMemAlloc
CoCreateGuid
StringFromIID

slc

SLInstallProofOfPurchase
SLGetPKeyInformation
SLConsumeWindowsRight
SLClose
SLOpen

slcext

SLActivateProduct

oleaut32

SafeArrayGetVartype
SysStringLen
SysFreeString
VarBstrCat
SafeArrayCopy
VariantClear
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayLock
SafeArrayUnlock
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
SysStringByteLen
SafeArrayCreate
SafeArrayDestroy
VariantInit
VarBstrCmp
VariantChangeType
VariantCopyInd

wmdrmsdk

WMDRMCreateProvider

ws2_32

WSAStringToAddressW
inet_addr
GetNameInfoW

shlwapi

PathFindFileNameW
UrlGetPartW
PathCombineW

iphlpapi

GetAdaptersInfo

propsys

PSRegisterPropertySchema
PSUnregisterPropertySchema

Sections

.text
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4064630da72a31c1ae8fe6b6b6d66e8a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ole32

slc

slcext

oleaut32

wmdrmsdk

ws2_32

shlwapi

iphlpapi

propsys

Sections

.text Size: 205KB - Virtual size: 205KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 12KB

.text
Size: 205KB - Virtual size: 205KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 12KB