1195fdbdbfc074ed46c58cdb5db3a3625a31600ffcab66aec8d7b5f5c5bcc6dd

Sharing

Copy URL

Twitter E-mail

General

Target

1195fdbdbfc074ed46c58cdb5db3a3625a31600ffcab66aec8d7b5f5c5bcc6dd
Size

530KB
MD5

4eac58369a9d69bdd5871735062559b2
SHA1

3ea76be7121b75c2cf9a8430f0068ae0077edd94
SHA256

1195fdbdbfc074ed46c58cdb5db3a3625a31600ffcab66aec8d7b5f5c5bcc6dd
SHA512

b448c5772a690bccc361065748587ac311a7884c148aa92c2e3c5aec90f76128565b812a80f6dd6fe8c759e3cc7ad27269421da0d2ac32ed62d6d392e16b8c6c
SSDEEP

12288:8SV/7MbElsTnt0lPkm1oLhPAQGTDvVrS3m4Wn8CHt5YRvbHZI:8SV/7MbE6TJlYQWDvVrS3Q8CHzo

Score

N/A

Malware Config

Signatures

Files

1195fdbdbfc074ed46c58cdb5db3a3625a31600ffcab66aec8d7b5f5c5bcc6dd
.exe windows x64

37d652b75bb5ebf0196bfea6cc0159c3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleExW
FreeLibrary
TerminateProcess
ExitProcess
HeapFree
GetProcessHeap
HeapAlloc
Sleep
IsProcessorFeaturePresent
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SwitchToThread
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
LeaveCriticalSection
AddVectoredExceptionHandler
WaitForSingleObject
EnumSystemGeoID
EnterCriticalSection
SleepConditionVariableSRW
WakeConditionVariable
GetSystemInfo
VirtualProtect
MoveFileExW
WriteFile
GetModuleHandleA
GetProcAddress
TryEnterCriticalSection
GetStdHandle
GetConsoleMode
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
SetLastError
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetCommandLineW
GetModuleFileNameW
GetFullPathNameW
InitializeCriticalSection
CloseHandle
GetLastError
GetLogicalDrives
SetHandleInformation
CreateFileW
HeapReAlloc
GetCurrentProcessId
GlobalMemoryStatusEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
GetCurrentThread
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
WakeAllConditionVariable
CreateThread
OpenProcess
ReleaseSRWLockExclusive
ReadProcessMemory
GetProcessTimes
GetProcessIoCounters
GetTickCount64
LocalFree
GetDiskFreeSpaceExW
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetSystemTimeAsFileTime
AcquireSRWLockExclusive

pdh

PdhGetFormattedCounterValue
PdhLookupPerfNameByIndexW
PdhRemoveCounter
PdhOpenQueryA
PdhAddCounterW
PdhCloseQuery
PdhCollectQueryData

shell32

CommandLineToArgvW
ShellExecuteW

snmpapi

SnmpUtilMemAlloc

crypt32

CertFreeCertificateChain
CertDuplicateStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertFreeCertificateContext
CertGetCertificateChain
CertOpenStore
CertVerifyCertificateChainPolicy

secur32

FreeContextBuffer
FreeCredentialsHandle
QueryContextAttributesW
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleA
DeleteSecurityContext
DecryptMessage
EncryptMessage

ws2_32

WSAGetLastError
connect
setsockopt
WSAStartup
freeaddrinfo
getaddrinfo
WSASocketW
getpeername
send
recv
select
closesocket
ioctlsocket
WSACleanup
getsockopt
getsockname

advapi32

SystemFunction036
RegQueryValueExA

bcrypt

BCryptGenRandom

ntdll

NtQuerySystemInformation
NtQueryInformationProcess
RtlGetVersion

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

powrprof

CallNtPowerInformation

iphlpapi

FreeMibTable
GetIfTable2
GetIfEntry2

netapi32

NetQueryDisplayInformation
NetUserGetLocalGroups
NetApiBufferFree

oleaut32

SysFreeString
VariantClear
SysAllocString

psapi

GetModuleFileNameExW
EnumProcessModulesEx

msvcrt

?_set_new_mode@@YAHH@Z
_commode
_msize
?terminate@@YAXXZ
__argv
__argc
_environ
__getmainargs
__set_app_type
_XcptFilter
_errno
free
_set_fmode
_initterm_e
_initterm
wcslen
ceil
_amsg_exit
__C_specific_handler
realloc
__CxxFrameHandler3
memcpy
memcmp
memset
memmove

Sections

.text
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

37d652b75bb5ebf0196bfea6cc0159c3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pdh

shell32

snmpapi

crypt32

secur32

ws2_32

advapi32

bcrypt

ntdll

ole32

powrprof

iphlpapi

netapi32

oleaut32

psapi

msvcrt

Sections

.text Size: 331KB - Virtual size: 331KB

.rdata Size: 114KB - Virtual size: 114KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 13KB - Virtual size: 12KB

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 331KB - Virtual size: 331KB

.rdata
Size: 114KB - Virtual size: 114KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 3KB - Virtual size: 2KB