85fb862f7b0c64a7d7b48d7ceefbbe6dc9f658768fa001449a3874622625af86

Sharing

Copy URL Twitter E-mail

General

Target

85fb862f7b0c64a7d7b48d7ceefbbe6dc9f658768fa001449a3874622625af86
Size

54KB
MD5

465bb6e45d29d6793a952fde71af9700
SHA1

bd609bfc6792d2b2c9584b537dc104abedcfa099
SHA256

85fb862f7b0c64a7d7b48d7ceefbbe6dc9f658768fa001449a3874622625af86
SHA512

987d045c6b274cbec3aa4151c958a1f8b1d4ef44ae943a3ade4dc5e157edf5849de1d844dcfbd1169cc8a02b11905b5ade0d497398b6e69dbd69b34e8a1dcea1
SSDEEP

768:xpnkR6TpGRFxkGtqQK2ysVbrhsoYKuoYFlpmavi2flublGxU6iXf/Who3NSkw:XnaEGyG8sXYKurLpDa4lalYUnXHH3

Score

N/A

Malware Config

Signatures

Files

85fb862f7b0c64a7d7b48d7ceefbbe6dc9f658768fa001449a3874622625af86
.exe windows x86

6be84b25ed346af1ddd1450a9c5267a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
GetTokenInformation
CredpEncodeSecret
CredRestoreCredentials
CredBackupCredentials

kernel32

LocalFree
LocalAlloc
GetFileSizeEx
CreateThread
DuplicateHandle
CreateFileW
SetEvent
GlobalFree
GetCommandLineW
HeapSetInformation
CreateEventW
WriteFile
OpenProcess
DeleteFileW
GetTempFileNameW
WaitForMultipleObjects
SleepEx
GetOverlappedResult
CloseHandle
GetLastError
GetTempPathW
FormatMessageW
HeapFree
GetProcessHeap
HeapAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
CancelIo
ReadFile
SetLastError

gdi32

GetObjectW
CreateFontIndirectW

user32

EnableWindow
SetFocus
SendMessageW
GetDlgItem
PostMessageW
GetDlgItemTextW
ShowWindow
SetWindowTextW
LoadStringW
CheckRadioButton
SetWindowLongW
GetWindowLongW
GetParent
SendDlgItemMessageW

msvcrt

__set_app_type
__p__fmode
__p__commode
?terminate@@YAXXZ
_amsg_exit
_controlfp
_vsnwprintf
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
swscanf
wcsncmp
memset
__setusermatherr
_except_handler4_common

comctl32

CreatePropertySheetPageW
PropertySheetW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

ntdll

TpWaitForWait
TpAllocWait
NtOpenProcessToken
NtPrivilegeCheck
NtAdjustPrivilegesToken
NtClose
RtlNtStatusToDosError
TpReleaseWait
TpSetWait

crypt32

CryptProtectData
CryptUnprotectData

rpcrt4

RpcAsyncInitializeHandle
RpcStringBindingComposeW
NdrAsyncClientCall
I_RpcExceptionFilter
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcBindingFree

shell32

CommandLineToArgvW

netutils

NetApiBufferFree

samcli

NetValidatePasswordPolicy

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6be84b25ed346af1ddd1450a9c5267a1

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

comdlg32

ntdll

crypt32

rpcrt4

shell32

netutils

samcli

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 28KB - Virtual size: 29KB

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 28KB - Virtual size: 29KB