8082cc35843264990baddf506b017e6d143af56355969ebeb292864dbc9ba517

Sharing

Copy URL Twitter E-mail

General

Target

8082cc35843264990baddf506b017e6d143af56355969ebeb292864dbc9ba517
Size

116KB
MD5

41d9408d453eee3d4cb0a962ad6400d0
SHA1

4fa8812cdc909f8cb695940583e001230bf2c3ca
SHA256

8082cc35843264990baddf506b017e6d143af56355969ebeb292864dbc9ba517
SHA512

9eefc1dfc3a126395196d6cda52b14877c05439cfa18113dbbbeb0a99322f96803c90ce8a638665e1ae946ec6bd0799a894e9596ba064b2d52e66c180fffb78d
SSDEEP

3072:802gdQoD0TdkxSb2L0MI/O+ilXqkymoyj3T+VzhXBJXIs:8Bgdd+dkxZ4MI/OZXQmo638VBJXIs

Score

N/A

Malware Config

Signatures

Files

8082cc35843264990baddf506b017e6d143af56355969ebeb292864dbc9ba517
.exe windows x86

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
InitializeAcl
InitializeSecurityDescriptor
MakeAbsoluteSD
IsValidRelativeSecurityDescriptor
RegQueryValueExW
IsValidSecurityDescriptor
MakeSelfRelativeSD
FreeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
AllocateAndInitializeSid
AddAccessDeniedAce
GetAce
GetAclInformation
IsValidAcl
GetSecurityDescriptorDacl
DeleteAce
EqualSid
RegEnumValueW
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptGetUserKey
CryptAcquireContextW
CryptExportKey
CryptDecrypt
CryptImportKey
CryptEncrypt
EventUnregister
EventWrite
EventRegister

kernel32

InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
CloseHandle
CreateEventW
GetModuleFileNameW
FreeLibrary
InitializeCriticalSection
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetACP
WaitForSingleObject
CreateThread
Sleep
GetCurrentThreadId
SetEvent
GetCommandLineW
CompareStringW
InterlockedIncrement
ResetEvent
SetLastError
GetSystemDirectoryW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
GetVersionExA
GetLastError
HeapSetInformation
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringA
lstrlenW
MultiByteToWideChar

user32

CharNextW
UnregisterClassA
CharUpperW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW

msvcrt

_onexit
__wgetmainargs
_callnewh
_controlfp
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
wcsncmp
??1exception@@UAE@XZ
_lock
__dllonexit
_unlock
_errno
_wtol
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memcpy
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
memset
_purecall
__CxxFrameHandler3
wcsncpy_s
_CxxThrowException
memcpy_s
free
malloc
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
realloc
_cexit
??0exception@@QAE@ABV0@@Z
iswdigit

shlwapi

StrCmpIW

oleaut32

SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SafeArrayDestroy
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
VarBstrCmp
SysAllocStringLen
VarBstrCat

ole32

CoWaitForMultipleHandles
CoResumeClassObjects
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

netapi32

NetLocalGroupGetInfo
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetLocalGroupGetMembers
NetApiBufferFree

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

oleaut32

ole32

wtsapi32

shell32

netapi32

crypt32

Sections

.text Size: 77KB - Virtual size: 77KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 24KB - Virtual size: 27KB

.text
Size: 77KB - Virtual size: 77KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 24KB - Virtual size: 27KB