926da6aac13af8e4910bd5a53993dd253f090d71f235319fe59ff9a4a18e6627

Sharing

Copy URL Twitter E-mail

General

Target

926da6aac13af8e4910bd5a53993dd253f090d71f235319fe59ff9a4a18e6627
Size

1.3MB
MD5

79252f20bee0fe47b66d7908a2391430
SHA1

a7ab174d46e941bb32c936c79ac97fe1d37e03d6
SHA256

926da6aac13af8e4910bd5a53993dd253f090d71f235319fe59ff9a4a18e6627
SHA512

ea55bd057e1df277077796f30909beec522429d390714c6922da2bcd97d876482e42d800039085ac8decddda2997b8fe0320ffb7e0512afb4712e5dc7c228a38
SSDEEP

24576:n0TgGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVMI:nQMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM

Score

N/A

Malware Config

Signatures

Files

926da6aac13af8e4910bd5a53993dd253f090d71f235319fe59ff9a4a18e6627
.exe windows x64

d9aac61ea67e550b22297adcf35af3d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

IsWindowEnabled
SendMessageTimeoutW
FindWindowExW
IsWindowVisible
AllowSetForegroundWindow
GetWindowThreadProcessId

msvcrt

rand_s
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_XcptFilter
wcsncmp
iswspace
_vsnwprintf
memcpy
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
memset

kernel32

SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
GetVersionExA
VirtualProtect
LoadLibraryExA
GetSystemInfo
GetLastError
RaiseException
FreeLibrary
VirtualQuery
VirtualAlloc
QueryPerformanceCounter
RtlVirtualUnwind
UnhandledExceptionFilter
ExpandEnvironmentStringsW
GetCommandLineW
SetErrorMode
CreateProcessW
SetDllDirectoryW
GetCurrentProcess
GetModuleHandleW
InitializeCriticalSection
TerminateProcess
GetProcAddress
LocalAlloc
HeapSetInformation
DeleteCriticalSection
CloseHandle
LocalFree
RtlLookupFunctionEntry

api-ms-win-downlevel-advapi32-l1-1-0

EventWrite
RegQueryValueExW
EventUnregister
RegGetValueW
RegOpenKeyExW
EventRegister
RegCloseKey

api-ms-win-downlevel-shell32-l1-1-0

SetCurrentProcessExplicitAppUserModelID
CommandLineToArgvW

iertutil

ord701
ord9
ord139
ord32

api-ms-win-downlevel-shlwapi-l1-1-0

StrStrIW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 758KB - Virtual size: 757KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 556KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d9aac61ea67e550b22297adcf35af3d6

Headers

DLL Characteristics

File Characteristics

Imports

user32

msvcrt

kernel32

api-ms-win-downlevel-advapi32-l1-1-0

api-ms-win-downlevel-shell32-l1-1-0

iertutil

api-ms-win-downlevel-shlwapi-l1-1-0

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 2KB - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 864B

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 48B

.rsrc Size: 758KB - Virtual size: 757KB

.reloc Size: 556KB - Virtual size: 1.9MB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 2KB - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 864B

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 48B

.rsrc
Size: 758KB - Virtual size: 757KB

.reloc
Size: 556KB - Virtual size: 1.9MB