ee869460efcb2c7df8a1cd12e0bafbeeff195f8a5bbe7f14b8ba579378f135d2

Sharing

Copy URL Twitter E-mail

General

Target

ee869460efcb2c7df8a1cd12e0bafbeeff195f8a5bbe7f14b8ba579378f135d2
Size

771KB
MD5

6b60709630b4b71cfb85dbb4b401ec59
SHA1

705296993d9608496707062427b4bf73cc6410f5
SHA256

ee869460efcb2c7df8a1cd12e0bafbeeff195f8a5bbe7f14b8ba579378f135d2
SHA512

034e400d91a425dae617576f36a490ee597cd588d1f0e3af0dae71a0576a0bf6eb72cf7103de390ee2c62d30bac2e691a71c3380b35a1f9b0462e46193548ef1
SSDEEP

24576:gHTktpMeMxHvF0hNPqifk3yPSd4JWweBt:g02bxN0hN01d

Score

N/A

Malware Config

Signatures

Files

ee869460efcb2c7df8a1cd12e0bafbeeff195f8a5bbe7f14b8ba579378f135d2
.exe windows x86

14d2e9d09e4a3ae098e68add4c97331a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

crypt32

CryptSIPRemoveSignedDataMsg

advapi32

RegNotifyChangeKeyValue
GetTraceLoggerHandle
GetKernelObjectSecurity
RegSetValueW
OpenSCManagerW
LsaLookupNames
WmiExecuteMethodW
IsValidAcl
RegQueryValueExW
FreeSid
LsaOpenSecret
CloseEventLog
CryptSignHashW
GetLengthSid
RegCreateKeyExW
WmiReceiveNotificationsW
LsaOpenPolicy
RegReplaceKeyA
RemoveUsersFromEncryptedFile
RegQueryMultipleValuesW

setupapi

SetupInstallFromInfSectionW
SetupGetTargetPathW
CM_Free_Res_Des_Handle
SetupOpenAppendInfFileW
SetupDecompressOrCopyFileW
SetupDiGetDeviceRegistryPropertyW
SetupLogErrorW
SetupDiCreateDeviceInterfaceRegKeyW
CM_Get_Device_IDW
SetupCloseInfFile
SetupQuerySourceListW
SetupCloseLog
SetupDiGetDriverInstallParamsW
SetupDiGetSelectedDevice
CM_Get_DevNode_Status_Ex
SetupDiRegisterDeviceInfo
SetupDiOpenClassRegKey
CM_Disconnect_Machine
SetupDiGetSelectedDriverW
SetupDiSetSelectedDriverA
SetupGetLineByIndexW
CM_Get_Device_ID_List_SizeW
SetupDiGetDeviceInstanceIdW
SetupGetLineTextW
SetupDiGetDeviceInstallParamsA
CM_Get_Res_Des_Data_Ex
SetupDiEnumDeviceInfo
pSetupMalloc
CM_Connect_MachineW

comctl32

ImageList_AddMasked
ImageList_Destroy
ImageList_SetOverlayImage
ImageList_GetImageCount
ImageList_DragLeave
ImageList_SetBkColor
CreatePropertySheetPageW
ImageList_Read
ImageList_GetBkColor
ImageList_BeginDrag
ImageList_LoadImageA
InitCommonControls
ImageList_SetIconSize
ImageList_DragEnter
ImageList_Write
ImageList_SetDragCursorImage
PropertySheetA
ImageList_Draw
ImageList_GetDragImage

shlwapi

HashData
AssocQueryStringW
PathUndecorateA
StrDupW
UrlCanonicalizeA
StrCmpNA
SHGetValueW
SHCreateStreamOnFileEx
PathFileExistsA
StrPBrkW
SHDeleteValueA
PathCanonicalizeW
PathParseIconLocationW
SHQueryValueExW
SHRegDuplicateHKey
StrToIntExW
SHSetValueA
PathAppendW
SHCreateStreamOnFileW
StrChrNW
UrlCombineW
wvnsprintfW

winspool.drv

DeletePrinterDriverW
AddPrinterDriverW
DeviceCapabilitiesA
StartPagePrinter
OpenPrinterW
SetPrinterDataExW
StartDocPrinterW
EndPagePrinter
AddMonitorA
EndDocPrinter
ClosePrinter
GetPrinterDriverDirectoryA
WritePrinter
FlushPrinter
GetPrinterW
FindClosePrinterChangeNotification
EnumMonitorsA
XcvDataW
DocumentPropertySheets
EnumPrintProcessorsW

msvcrt

fputc
_cabs
_access
modf
difftime
fgetc
_mbsspn
_getdrives
memmove
atoi
tmpnam
_iob
_isnan
gmtime
_snprintf
_mbsrchr
_ismbblead
_wtempnam
isalpha
strcat
_mbsicmp
_initterm

kernel32

GetConsoleCharType
TryEnterCriticalSection
SetLocalTime
IsBadStringPtrA
WriteProcessMemory
OpenProcess
GetProcessAffinityMask
FillConsoleOutputCharacterA
GetCurrentThreadId
GetLastError
GetSystemDirectoryW
PeekConsoleInputW
WritePrivateProfileStructA
GetDevicePowerState
EndUpdateResourceW
RegisterWaitForSingleObject
GetCommandLineW
VirtualFreeEx
GetCurrentProcessId
GetStringTypeExW
GetConsoleCommandHistoryA
AddAtomW
WaitNamedPipeA
SetTermsrvAppInstallMode
CreateEventA
GetProcessHeap
GetQueuedCompletionStatus
GlobalMemoryStatus
InterlockedExchange
VirtualAlloc
ExpandEnvironmentStringsW
CreateMailslotA
GlobalAddAtomA
RemoveDirectoryW
HeapUnlock
CreateNamedPipeW
GetDiskFreeSpaceW

Sections

.text
Size: 88KB - Virtual size: 379KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 620KB - Virtual size: 911KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14d2e9d09e4a3ae098e68add4c97331a

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

advapi32

setupapi

comctl32

shlwapi

winspool.drv

msvcrt

kernel32

Sections

.text Size: 88KB - Virtual size: 379KB

.data Size: 620KB - Virtual size: 911KB

.rsrc Size: 60KB - Virtual size: 59KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 88KB - Virtual size: 379KB

.data
Size: 620KB - Virtual size: 911KB

.rsrc
Size: 60KB - Virtual size: 59KB

.reloc
Size: 2KB - Virtual size: 1KB