663ea16b751df3ea4dca01b37d2454035215e9e105a2ff44d4496f5fc1404105

Sharing

Copy URL Twitter E-mail

General

Target

663ea16b751df3ea4dca01b37d2454035215e9e105a2ff44d4496f5fc1404105
Size

936KB
MD5

80cc8bc8a2e4d82ff6d72782229fc24c
SHA1

522f1d6bb2efe7a467c0fff96d7aced2b56f82dd
SHA256

663ea16b751df3ea4dca01b37d2454035215e9e105a2ff44d4496f5fc1404105
SHA512

5fcd338a1d347e19aac5e708d9f8a339dc5c4b03c86278bb07464db9cd05ee615913a406d35063fd794ab2d0e88f6e36369787a509285db1ffbccfea9e66bac4
SSDEEP

1536:9NuOg9Rwq0+kM5UyZJQa48FE7qAcOGBma:9y9Or+kQJlF7AcDBma

Score

N/A

Malware Config

Signatures

Files

663ea16b751df3ea4dca01b37d2454035215e9e105a2ff44d4496f5fc1404105
.exe windows x86

43c16cd06a6b63741b28242fbb408e61

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AddAccessAllowedAceEx
AddAccessDeniedAceEx
AddAuditAccessAceEx
ConvertSidToStringSidW
CreateProcessAsUserW
CryptDestroyHash
GetAce
GetLengthSid
GetSecurityDescriptorLength
InitializeAcl
InitializeSecurityDescriptor
IsValidAcl
IsValidSecurityDescriptor
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetKeySecurity
RegisterServiceCtrlHandlerExW
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
SystemFunction010

kernel32

VirtualAlloc
CloseHandle
CompareStringA
CopyFileExA
CreateEventW
CreateFileW
DeviceIoControl
EnumResourceLanguagesA
ExpandEnvironmentStringsW
FileTimeToDosDateTime
GetCurrentProcess
GetExitCodeProcess
GetFileInformationByHandle
GetModuleHandleW
GetProcAddress
GetProfileIntW
GetSystemDirectoryW
GetVersionExW
GlobalFix
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedExchange
LocalFree
ResumeThread
SearchPathW
SetEvent
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
WaitForSingleObject
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
EncodePointer
GetLastError
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
WriteFile
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
HeapSize
RtlUnwind
MultiByteToWideChar
GetStringTypeW
HeapAlloc
HeapReAlloc

rpcrt4

I_RpcGetExtendedError
NdrConformantStringMarshall
RpcStringFreeW
UuidCreate
UuidFromStringW
UuidToStringW

user32

GetAncestor
SetClassWord
CopyRect

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 704KB - Virtual size: 703KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 170KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

43c16cd06a6b63741b28242fbb408e61

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

rpcrt4

user32

Sections

.text Size: 58KB - Virtual size: 57KB

.rdata Size: 704KB - Virtual size: 703KB

.data Size: 170KB - Virtual size: 178KB

.text
Size: 58KB - Virtual size: 57KB

.rdata
Size: 704KB - Virtual size: 703KB

.data
Size: 170KB - Virtual size: 178KB