c8a3ff0d6684a98df59469f6935d37985039cdf0f6a8714d453127c21f0dca06

Sharing

Copy URL

Twitter E-mail

General

Target

c8a3ff0d6684a98df59469f6935d37985039cdf0f6a8714d453127c21f0dca06
Size

718KB
MD5

91c26cd41bb41f6f763b670b019e4fa9
SHA1

e60442d4802b926e5281d48c4856a4edb9121a05
SHA256

c8a3ff0d6684a98df59469f6935d37985039cdf0f6a8714d453127c21f0dca06
SHA512

a1ed8b724f64c5b708f5700e55c9d0fe916f4e186413d72a6600236c1a5bc8393567f3d14af4fc21da33284bde7c090fe94dcceb426a43f90fede8f97fb86cbe
SSDEEP

12288:5f9L48nttifU93DXSDi270xygqkLvgAW0qp1aGeYD0YHSSTnyE/52fIX0mH:t9LrtifA7SW270xygqk7lWf7aw007zV9

Score

N/A

Malware Config

Signatures

Files

c8a3ff0d6684a98df59469f6935d37985039cdf0f6a8714d453127c21f0dca06
.exe windows x86

f12331b061314da6e1ea2a9bf10e0a6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

GetExplicitEntriesFromAclW
WmiExecuteMethodW
CreatePrivateObjectSecurityEx
QueryServiceConfigA
CryptContextAddRef
QueryServiceStatus
RevertToSelf
GetSidLengthRequired
AllocateAndInitializeSid
AddAccessAllowedAceEx
GetOldestEventLogRecord
OpenEventLogW
SetFileSecurityW
BuildSecurityDescriptorW
GetNamedSecurityInfoA
BuildTrusteeWithObjectsAndSidW
GetSidIdentifierAuthority
RegSetKeySecurity
RegCreateKeyExW
CommandLineFromMsiDescriptor
GetCurrentHwProfileW

kernel32

SetErrorMode
GetStdHandle
GlobalLock
CreateIoCompletionPort
WriteTapemark
OutputDebugStringW
GetLastError
ExpandEnvironmentStringsA
LocalFree
CreateTapePartition
TlsAlloc
LoadLibraryW
RtlZeroMemory
DeviceIoControl
MapViewOfFileEx
GetVersion
VirtualAlloc
SetVolumeMountPointW
GetSystemTimeAsFileTime
GetFileSizeEx
SizeofResource
GetStringTypeA
EnterCriticalSection
MulDiv
CreateHardLinkW
DefineDosDeviceW
ReadConsoleOutputA
DisconnectNamedPipe

cfgmgr32

CM_Get_DevNode_Registry_PropertyW
CM_Enumerate_Classes_Ex
CM_Get_Child
CM_Locate_DevNode_ExW
CM_Get_Device_IDW
CMP_WaitNoPendingInstallEvents
CM_Get_Device_ID_ExW
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Next_Res_Des_Ex
CM_Get_Hardware_Profile_Info_ExW
CM_Open_DevNode_Key_Ex
CM_Connect_MachineW
CM_Get_First_Log_Conf_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_HW_Prof_Flags_ExW
CM_Get_DevNode_Status_Ex
CM_Free_Log_Conf_Handle
CM_Disconnect_Machine
CM_Get_Device_ID_Size
CM_Get_Device_Interface_List_Size_ExW
CM_Get_DevNode_Status
CM_Free_Res_Des_Handle
CM_Get_Device_Interface_List_ExW
CM_Get_Parent
CM_Locate_DevNodeW
CM_Get_Parent_Ex
CM_Get_Device_ID_List_ExW

rasapi32

RasGetSubEntryPropertiesW
RasGetCustomAuthDataW
RasSetEntryPropertiesW
RasSetCustomAuthDataW
RasGetEapUserIdentityW
RasGetEntryDialParamsW
RasEnumConnectionsA
RasSetCredentialsW
RasSetEapUserDataA
RasGetEntryPropertiesW
RasGetProjectionInfoW
RasGetConnectStatusW
RasSetSubEntryPropertiesW
RasFreeEapUserIdentityW
RasGetEntryHrasconnW
RasEnumEntriesW
RasGetHport
RasHangUpW
RasDeleteEntryW
RasGetCredentialsW
RasConnectionNotificationW
RasEnumConnectionsW
RasValidateEntryNameW
RasGetAutodialAddressW
RasSetAutodialAddressW
RasEnumDevicesW

msvcrt

??2@YAPAXI@Z
_makepath
_mktemp
wcsncmp
_open
floor
_wtempnam
wcscspn
_fileno
_fullpath
_swab
strpbrk
_mkdir
fputc
mktime
strncat
??3@YAXPAX@Z
_wchdir
wcslen
isspace
wcstombs
fread
rand
_mbsncpy
_tolower
_pctype
_CIpow
_dup2
vfprintf
_mbsinc
_unlock
fprintf
__pioinfo
_time64

imm32

ImmSetCompositionWindow
ImmUnlockIMC
ImmGetCompositionStringW
ImmDisableIME
ImmGetIMEFileNameW
ImmSetOpenStatus
ImmGetDefaultIMEWnd
ImmConfigureIMEW
ImmSetCompositionFontW
ImmSetConversionStatus
ImmEnumRegisterWordW
ImmGetProperty
ImmRequestMessageW
ImmGetIMEFileNameA
ImmSetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmDestroyContext
ImmGetImeMenuItemsW
ImmLockIMCC
ImmAssociateContext

crypt32

CryptDecodeMessage

winspool.drv

AddPrintProcessorW
DeleteFormW
GetJobA
ReadPrinter
SetJobW
AddPrinterConnectionW
EndPagePrinter
GetPrinterDataW
EnumFormsW
DevicePropertySheets
GetPrinterDriverDirectoryW
FreePrinterNotifyInfo
FindClosePrinterChangeNotification
EnumFormsA
EnumPrintProcessorsW
DocumentPropertySheets
GetPrinterDataExW
ConfigurePortW
OpenPrinterW
ClosePrinter
DocumentPropertiesA
StartDocPrinterW
DeviceCapabilitiesA
AddPrinterDriverW
EnumPrinterDataW

Sections

.data
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 36KB - Virtual size: 354KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 584KB - Virtual size: 903KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 310B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f12331b061314da6e1ea2a9bf10e0a6c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

cfgmgr32

rasapi32

msvcrt

imm32

crypt32

winspool.drv

Sections

.data Size: 1024B - Virtual size: 1000B

.rdata Size: 2KB - Virtual size: 1KB

.text Size: 36KB - Virtual size: 354KB

.rdata Size: 584KB - Virtual size: 903KB

.rsrc Size: 93KB - Virtual size: 93KB

.reloc Size: 512B - Virtual size: 310B

.data
Size: 1024B - Virtual size: 1000B

.rdata
Size: 2KB - Virtual size: 1KB

.text
Size: 36KB - Virtual size: 354KB

.rdata
Size: 584KB - Virtual size: 903KB

.rsrc
Size: 93KB - Virtual size: 93KB

.reloc
Size: 512B - Virtual size: 310B