74ab660445cbbc72de11908bdab9ade6de7a33abf40b325f67dbe719603d651c

Sharing

Copy URL

Twitter E-mail

General

Target

74ab660445cbbc72de11908bdab9ade6de7a33abf40b325f67dbe719603d651c
Size

817KB
MD5

69e728b4846e3eadf59c1ca99f399ca0
SHA1

8f937a199806006d957750053e49ca6cb5d45786
SHA256

74ab660445cbbc72de11908bdab9ade6de7a33abf40b325f67dbe719603d651c
SHA512

31ae880ed44137f89a8178a7e4a457b116a3c5d33bcf393dce7e6b0a8daa1eb266e3ba49c7a13b864439d627f4addea91b5ee11667bbbc063ade1b0adfc47c49
SSDEEP

24576:wcw7/65AAO8HInQGIcULxkEUA3bEfeNHOrknXsLQnW:wcw7/dAWnQvvkF8ieNHGkncLQnW

Score

N/A

Malware Config

Signatures

Files

74ab660445cbbc72de11908bdab9ade6de7a33abf40b325f67dbe719603d651c
.exe windows x64

10a3eb5d4eb2b454de32c5b3d99e2903

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExpandEnvironmentStringsW
GetFullPathNameW
RegisterWaitForSingleObject
CreateEventW
UnregisterWaitEx
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetComputerNameExW
CompareStringW
GetLocaleInfoW
EnumUILanguagesW
CreateFileW
HeapSetInformation
FreeLibrary
GetProcAddress
LoadLibraryW
LocalFree
EnterCriticalSection
LocalAlloc
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetLastError
WideCharToMultiByte
GetLastError
MultiByteToWideChar
CloseHandle
GetCurrentThread
GetVersionExW
GetSystemDirectoryW
LoadLibraryExW

msvcrt

_itow
_ultow
iswalnum
_CxxThrowException
__CxxFrameHandler3
??1type_info@@UEAA@XZ
memcpy
memset
fwprintf
_iob
_wcsicmp
__wgetmainargs
__C_specific_handler
_XcptFilter
wcsstr
wcstoul
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
_exit
_cexit
exit
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_wcsnicmp
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
wcschr
_wtoi
_scwprintf
_wtoi64
iswspace
wcsncmp
_vsnwprintf
_purecall
memcmp

ntdll

EtwLogTraceEvent
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwEventRegister
EtwEventUnregister
EtwEventWrite
EtwEventEnabled

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysAllocString
SysStringLen
VariantInit
VarCmp
VariantClear
SysFreeString

httpapi

HttpSetServiceConfiguration
HttpTerminate
HttpDeleteServiceConfiguration
HttpQueryServiceConfiguration
HttpInitialize

wsmsvc

?AllocBstr@WSManMemory@@SAPEAGPEBGHAEBVCallSite@TestSystem@@@Z
?Free@WSManMemory@@SAXPEAXAEBVCallSite@TestSystem@@@Z
?Alloc@WSManMemory@@SAPEAX_KAEBVCallSite@TestSystem@@W4Mode@3@@Z

advapi32

FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
SetThreadToken
RevertToSelf
CopySid
GetLengthSid
IsWellKnownSid
CredDeleteW
CredFree
CredWriteW
CredReadW
RegConnectRegistryW
LogonUserW
RegCreateKeyExW
RegEnumKeyExW
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
MapGenericMask
GetAce
GetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTokenInformation
OpenThreadToken
OpenProcessToken

crypt32

CertFreeCertificateContext
CryptBinaryToStringW
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptAcquireCertificatePrivateKey
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CertCloseStore
CertGetNameStringW
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW

netutils

NetApiBufferFree

wkscli

NetGetJoinInformation

rpcrt4

UuidCreate

ws2_32

WSAStartup
getnameinfo
freeaddrinfo
WSACleanup
getaddrinfo

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 560KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

10a3eb5d4eb2b454de32c5b3d99e2903

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

ole32

oleaut32

httpapi

wsmsvc

advapi32

crypt32

netutils

wkscli

rpcrt4

ws2_32

Sections

.text Size: 235KB - Virtual size: 234KB

.data Size: 8KB - Virtual size: 10KB

.pdata Size: 11KB - Virtual size: 10KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 560KB - Virtual size: 2.4MB

.text
Size: 235KB - Virtual size: 234KB

.data
Size: 8KB - Virtual size: 10KB

.pdata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 560KB - Virtual size: 2.4MB