b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf

Sharing

Copy URL Twitter E-mail

General

Target

b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf
Size

205KB
MD5

4b0d0a09cae6640b7e5d37e2e1b9999f
SHA1

b0e666654acc99cff5906c6e36162af072df7147
SHA256

b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf
SHA512

649d5943390bd7f298a40e9e154ce94de1f328d0f9b1139091c1446c36035d4991701b52b279692d3c41ca9bd5ed4feaf2f0ae8720bbd4304f913c4c598834c3
SSDEEP

3072:3f7K+1triC6uzGx77abgW9Frz08q2VbXAtD8xZeJMlmAv4/qoymEP26Zn3tXdV5J:3zPtrigz1TlXAdimXqoPZ6Zn3J5iLtO

Score

N/A

Malware Config

Signatures

Files

b935d731d178e4fd9b966e6f58e12d05afca3f938a619fe475514fbe0915d6cf
.exe windows x64

57cd6a9f000d94366527da7dc3e969a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

PostMessageA
RegisterDeviceNotificationA
UnregisterDeviceNotification
SystemParametersInfoA
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
PostThreadMessageA

advapi32

StartServiceCtrlDispatcherA
RegQueryValueExA
RegisterEventSourceA
ReportEventA
ImpersonateLoggedOnUser
RevertToSelf
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
CreateProcessAsUserA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DeleteService
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegSetValueExW
RegDeleteValueA
RegGetValueA
RegOpenKeyExA
RegDeleteKeyA
RegOpenCurrentUser

wtsapi32

WTSQueryUserToken
WTSEnumerateProcessesA
WTSQuerySessionInformationA
WTSFreeMemory

psapi

GetModuleBaseNameA
EnumProcessModules

userenv

UnloadUserProfile
LoadUserProfileA

powrprof

PowerGetActiveScheme
PowerSetActiveScheme
PowerWriteACValueIndex
PowerWriteDCValueIndex
PowerEnumerate
PowerSettingAccessCheck
PowerReadACValueIndex
PowerReadDCValueIndex

kernel32

SetEndOfFile
GetProcessHeap
CreateFileW
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
WriteFile
HeapReAlloc
GetTimeZoneInformation
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
VirtualAlloc
VirtualProtect
RaiseException
LoadLibraryW
LoadLibraryA
FreeLibrary
SetConsoleCtrlHandler
WriteConsoleW
SetStdHandle
InitializeCriticalSectionAndSpinCount
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeFormatA
lstrcmpiA
WaitForSingleObject
MapViewOfFile
CreateFileMappingA
OpenProcess
GetLastError
GetModuleFileNameA
WTSGetActiveConsoleSessionId
OutputDebugStringA
GetLocalTime
CloseHandle
Sleep
GetVersionExA
GetSystemDirectoryA
CreateProcessA
CreateMutexA
OpenMutexA
ReleaseMutex
CreateEventA
OpenEventA
WaitForMultipleObjects
SetEvent
ResetEvent
CreateThread
SetThreadPriority
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
ReadFile
FlushFileBuffers
CreateFileA
LocalFree
GetCommandLineA
GetVersionExW
HeapAlloc
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetCPInfo
GetACP
GetOEMCP
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsSetValue
FlsGetValue
GetCurrentThreadId
GetCurrentThread
FlsAlloc
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
FatalAppExitA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetProcAddress
GetModuleHandleW
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetDateFormatA

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�7
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57cd6a9f000d94366527da7dc3e969a1

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

wtsapi32

psapi

userenv

powrprof

kernel32

Sections

.text Size: 146KB - Virtual size: 146KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 6KB - Virtual size: 14KB

.pdata Size: 8KB - Virtual size: 7KB

�7 Size: 1KB - Virtual size: 1KB

.text
Size: 146KB - Virtual size: 146KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 6KB - Virtual size: 14KB

.pdata
Size: 8KB - Virtual size: 7KB

�7
Size: 1KB - Virtual size: 1KB