820a2f07f1dfbcb01b99e1e761e436a94b186bc32ceacc154ca014110ba7201f

Sharing

Copy URL

Twitter E-mail

General

Target

820a2f07f1dfbcb01b99e1e761e436a94b186bc32ceacc154ca014110ba7201f
Size

866KB
MD5

486fe9640b5814968bcd30107c544890
SHA1

b9788b8b2de607c69f2581481dfa78b868a66a60
SHA256

820a2f07f1dfbcb01b99e1e761e436a94b186bc32ceacc154ca014110ba7201f
SHA512

0e8716cd422abac68c08464154d8ccefd0ba34634f337e0bfc734806b517d079431fa06fab70e1f7caa21b9bd74b9824ffebadfcda8b6e45cc039039b119a8b0
SSDEEP

12288:I4nOyFJtKU2jeaPcAq1BNpJ2Ly+K4GFlAhRi25TggG4eLkuK+ASXqqG/Q9rsG:IMfFrAjPc31H0I/lAhp64EXtG/QBsG

Score

N/A

Malware Config

Signatures

Files

820a2f07f1dfbcb01b99e1e761e436a94b186bc32ceacc154ca014110ba7201f
.exe windows x86

33139cc287bf87ff7951959f9d096b81

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseActCtx
VerifyVersionInfoA
GetProcessPriorityBoost
GetEnvironmentStringsW
GetDiskFreeSpaceExA
EraseTape
TryEnterCriticalSection
OpenJobObjectA
WriteConsoleA
SetProcessWorkingSetSize
BaseFlushAppcompatCache
GetPrivateProfileStringW
SetSystemTime
GetProfileSectionW
WriteProfileSectionW
_hread
IsDebuggerPresent
GlobalUnlock
WaitNamedPipeW
GetModuleHandleA
HeapSummary
RegisterWaitForInputIdle
_lread
FlushFileBuffers
GetStartupInfoW
LZStart
GlobalCompact
LoadLibraryExW
InterlockedExchangeAdd
RequestDeviceWakeup
_lcreat
GetComputerNameA
IsDBCSLeadByte
LZClose
EnumSystemLanguageGroupsW
SetThreadContext
AddLocalAlternateComputerNameA
FindFirstChangeNotificationW
VirtualAlloc
GetFileInformationByHandle
CreateFileW
GetCurrencyFormatW
GetThreadTimes
GetDateFormatW
RemoveLocalAlternateComputerNameA
ReadConsoleInputExW
DeleteTimerQueue
GetConsoleCommandHistoryLengthA
CreateDirectoryExW
GetShortPathNameW
GetUserDefaultUILanguage
LoadLibraryA
InterlockedExchange
BaseCleanupAppcompatCacheSupport
GetProcessTimes
SetConsoleNlsMode
SetConsoleIcon
FindResourceW
PurgeComm
WriteConsoleInputW
VirtualQuery
GetPrivateProfileSectionNamesA
FindClose
VirtualFreeEx
GetOEMCP
SearchPathA
GlobalFree
SetConsoleCursor
VirtualQueryEx
FindFirstVolumeMountPointW
CompareStringW
GetCommState
EnumDateFormatsW
SetThreadLocale
RegisterConsoleOS2
GetModuleHandleExA
BackupWrite
HeapAlloc

ntdll

RtlGetNtProductType
RtlCopySid
ZwModifyBootEntry
DbgSetDebugFilterState
RtlFindLeastSignificantBit
RtlConvertToAutoInheritSecurityObject
RtlMultiAppendUnicodeStringBuffer
RtlDeleteRegistryValue
NtQueryFullAttributesFile
CsrFreeCaptureBuffer
RtlSetSecurityObject
isspace
_alldvrm
ZwQueryFullAttributesFile
NtAlertResumeThread
NtSignalAndWaitForSingleObject
ZwRequestWaitReplyPort
ZwSetLdtEntries
RtlEnumProcessHeaps
NtSecureConnectPort
NtCreateDirectoryObject
RtlApplyRXactNoFlush
RtlAddAce
ZwSetSystemEnvironmentValue
DbgPrompt
ZwPrivilegeCheck
ZwSetBootOptions
RtlCompareMemoryUlong
RtlFreeHandle
ZwGetContextThread
ZwCreateIoCompletion
RtlSetBits
RtlTimeToElapsedTimeFields
RtlPrefixUnicodeString
LdrAccessResource
RtlQueryProcessHeapInformation
RtlLargeIntegerShiftLeft
ZwQueryDirectoryObject
RtlApplyRXact
RtlCreateQueryDebugBuffer
RtlInitializeResource
ZwSetSystemInformation

rpcns4

RpcNsMgmtBindingUnexportA
RpcNsEntryObjectInqBeginA
RpcNsBindingUnexportPnPA
RpcNsProfileEltRemoveA
RpcNsMgmtEntryDeleteW
RpcNsBindingUnexportW
RpcNsGroupMbrInqNextW
RpcNsProfileEltAddW
RpcNsProfileEltInqNextW
RpcNsEntryExpandNameA
RpcNsBindingExportW
RpcNsGroupMbrAddW
RpcNsProfileEltInqBeginA
RpcNsProfileDeleteW
RpcNsBindingExportPnPA
RpcNsBindingImportNext
RpcNsMgmtEntryCreateA
I_RpcNsGetBuffer
RpcNsProfileEltAddA
RpcNsEntryObjectInqDone
RpcNsBindingLookupNext
RpcNsBindingImportDone
RpcNsBindingUnexportPnPW
I_RpcNsNegotiateTransferSyntax
I_RpcNsSendReceive
RpcNsProfileEltInqBeginW

certcli

CASetCAFlags
CAGetCACertificate
CAAccessCheck
CAOIDDelete
CACreateLocalAutoEnrollmentObject
CAEnumNextCertType
CAAccessCheckEx
CACertTypeGetSecurity
CADeleteCertType
CADeleteCA
CAGetCertTypeFlags
CAUpdateCertType
CACountCertTypes
CASetCertTypeKeySpec
CACertTypeAccessCheckEx
CACertTypeQuery
CAGetCertTypeKeySpec
CAGetDN
CAGetCertTypeExtensions
CASetCertTypeFlags
CAUpdateCA
CAGetCertTypeExtensionsEx
CAGetCASecurity
CACertTypeSetSecurity
CACreateCertType
CACloneCertType
CASetCertTypeProperty
CAGetCertTypeExpiration
DllInstall
CAFreeCertTypeProperty
CASetCASecurity
CAEnumCertTypesForCA
CAInstallDefaultCertType
CACreateNewCA
CAGetCertTypeFlagsEx
CASetCertTypeExtension
GetProxyDllInfo
CAGetCertTypePropertyEx
CAFreeCertTypeExtensions
CACloseCA
DllGetClassObject
CAOIDAdd
CAAddCACertificateType
CAFindByName

oleaut32

VarUI2FromDec
VarWeekdayName
VarCyFromUI1
VarR4FromUI8
VarBoolFromI4
OleCreatePropertyFrame
LoadTypeLibEx
GetVarConversionLocaleSetting
VarDecCmpR8
VarUI4FromR4
CreateTypeLib2
SetOaNoCache
VarBstrCmp
VarUI1FromR4
VarAbs
GetActiveObject
SafeArrayCreate
SafeArrayDestroyDescriptor
VarImp
VarOr
DispGetParam
VarI4FromUI2
VarI1FromUI2
VarI8FromBool
VarBoolFromR4
VarBstrFromDisp
OleLoadPictureEx
VarR8FromI8
VarUI4FromDec
VarDateFromUI4
LPSAFEARRAY_UserFree
VarParseNumFromStr
VarUI4FromUI2
VarR4FromUI4
OleLoadPicture

mmcbase

??4SC@mmcerror@@QAEAAV01@ABV01@@Z
?GetEventBuffer@@YGAAVCEventBuffer@@XZ
?MMCErrorBox@@YGHPBGVSC@mmcerror@@I@Z
?GetComObjectEventSource@@YGAAV?$CEventSource@VCComObjectObserver@@VCVoid@@V2@V2@V2@@@XZ
?HrFromSc@@YGJABVSC@mmcerror@@@Z
?InternalLastRefReleased@CMMCStrongReferences@@AAE_NXZ
??BSC@mmcerror@@QBE_NXZ
?Release@CMMCStrongReferences@@SGKXZ
?s_hInst@SC@mmcerror@@0PAUHINSTANCE__@@A
?Clear@SC@mmcerror@@QAEXXZ
?SetHinst@SC@mmcerror@@SGXPAUHINSTANCE__@@@Z
?FromWin32@SC@mmcerror@@QAEAAV12@J@Z
?TraceAndClear@SC@mmcerror@@QAEXXZ
?GetErrorMessage@SC@mmcerror@@QBEXIPAG@Z
?GetCode@SC@mmcerror@@QBEJXZ
??0CEventBuffer@@QAE@XZ
?MMCErrorBox@@YGHPBGI@Z
?ScEmitOrPostpone@CEventBuffer@@QAE?AVSC@mmcerror@@PAUIDispatch@@JPAVCComVariant@ATL@@H@Z
??4CMMCStrongReferences@@QAEAAV0@ABV0@@Z
??8SC@mmcerror@@QBE_NJ@Z
?FormatErrorString@@YGXPBGVSC@mmcerror@@IPAGH@Z
?Throw@SC@mmcerror@@QAEXXZ
?GetHinst@SC@mmcerror@@SGPAUHINSTANCE__@@XZ
??7SC@mmcerror@@QBEHXZ
?s_dwMainThreadID@SC@mmcerror@@0KA
?MMCErrorBox@@YGHIVSC@mmcerror@@I@Z
?IsLocked@CEventBuffer@@QAE_NXZ
?MMCErrorBox@@YGHVSC@mmcerror@@I@Z
??9SC@mmcerror@@QBE_NABV01@@Z
?FatalError@SC@mmcerror@@QBEXXZ
??4SC@mmcerror@@QAEAAV01@J@Z
?SetMainThreadID@SC@mmcerror@@SGXK@Z
?FormatErrorIds@@YGXIVSC@mmcerror@@IPAG@Z
?ToHr@SC@mmcerror@@QBEJXZ

shlwapi

StrIsIntlEqualA
SHRegGetUSValueW
SHDeleteKeyW
StrCmpW
UrlIsNoHistoryA
StrRetToStrA
SHCopyKeyW
PathRenameExtensionA
PathAddExtensionW
IntlStrEqWorkerA
StrNCatW
SHDeleteEmptyKeyW
SHRegDeleteUSValueA
PathStripPathA
PathRemoveExtensionW
PathMatchSpecW
PathFindSuffixArrayW
StrToIntW
PathGetCharTypeW
StrCatW
PathIsSystemFolderW
PathIsDirectoryW
wvnsprintfW
StrCSpnIA
StrRStrIA
StrCmpIW
UrlCombineW
StrTrimA
StrCatBuffW
UrlIsW
UrlCreateFromPathA

d3dim700

PaletteAssociateNotify
SurfaceFlipNotify
Direct3D_HALCleanUp
Direct3DCreateDevice
SetLOD
D3DFree
GetLOD
PaletteUpdateNotify
CreateTexture
GetPriority
FlushD3DDevices
SetPriority
D3DRealloc
Direct3DCreate
D3DBreakVBLock
DestroyTexture
D3DMalloc
D3DTextureUpdate

iepeers

DllEnumClassObjects
DllGetClassObject

Sections

.text
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 321KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33139cc287bf87ff7951959f9d096b81

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

rpcns4

certcli

oleaut32

mmcbase

shlwapi

d3dim700

iepeers

Sections

.text Size: 357KB - Virtual size: 357KB

.rdata Size: 182KB - Virtual size: 182KB

.data Size: 321KB - Virtual size: 1.8MB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 357KB - Virtual size: 357KB

.rdata
Size: 182KB - Virtual size: 182KB

.data
Size: 321KB - Virtual size: 1.8MB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 1024B