cf16a12fbd56a202370d501acf62a17cfd2b68f8c12be44d0236e2fbf3f56df3

Sharing

Copy URL Twitter E-mail

General

Target

cf16a12fbd56a202370d501acf62a17cfd2b68f8c12be44d0236e2fbf3f56df3
Size

223KB
MD5

623bf010841ff330e8a0dc77b003e6f8
SHA1

d8b286c116684530b4e4f8bc3b396998bf59213c
SHA256

cf16a12fbd56a202370d501acf62a17cfd2b68f8c12be44d0236e2fbf3f56df3
SHA512

9e83898ffa274ee345984999dfb1dbceb8ff8078548a0ad0420c2003acbdbfb10addcf204987b11ba163b60327bdf6d970ca3f1d042577983e0bb08439dce1c9
SSDEEP

3072:9HvcTKpxpnYwUWJoyxsF4S06KeCb7oieOcLUpZ7UDRAgXVD5lLXU9YoCj40PU:9PcepA738oN3IZyTHF8

Score

N/A

Malware Config

Signatures

Files

cf16a12fbd56a202370d501acf62a17cfd2b68f8c12be44d0236e2fbf3f56df3
.exe windows x86

d327a5bbdc3768d02449448f2a9b6d3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceEvent
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
CreateProcessAsUserW
CreateRestrictedToken
LogonUserW
GetUserNameW
OpenProcessToken
RegCloseKey
ReadEventLogW
RegQueryValueExW
RegOpenKeyExW
CloseEventLog
GetNumberOfEventLogRecords
GetOldestEventLogRecord
OpenEventLogW
CloseServiceHandle
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
AllocateAndInitializeSid
FreeSid
GetLengthSid
CopySid
CheckTokenMembership
RegEnumKeyExW
RegEnumValueW

kernel32

LocalAlloc
GetProcAddress
LocalFree
FreeLibrary
GetFileInformationByHandle
FileTimeToDosDateTime
DeviceIoControl
GetSystemPowerStatus
MultiByteToWideChar
WideCharToMultiByte
CreateProcessW
SetFileAttributesW
GetModuleHandleW
CreateTimerQueueTimer
SetFilePointerEx
WriteFile
GetSystemDirectoryW
GetTempPathW
WaitForSingleObject
SetEvent
CreateEventW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
OutputDebugStringA
InterlockedCompareExchange
HeapFree
HeapAlloc
CompareFileTime
Sleep
ExpandEnvironmentStringsW
LoadLibraryExW
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedExchange
FindFirstFileW
FindNextFileW
FindClose
CopyFileW
CreateDirectoryW
DeleteFileW
LoadLibraryW
FormatMessageW
SetErrorMode
CloseHandle
GetLastError
SetLastError
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetTickCount
GetCommandLineW
InterlockedIncrement
InterlockedDecrement
GetExitCodeProcess
GetCurrentProcess
GetSystemTime
TerminateProcess
DeleteTimerQueueTimer
CreateFileW
GetFileAttributesW

msvcrt

?terminate@@YAXXZ
iswctype
memmove
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
malloc
free
__mb_cur_max
_vsnprintf
isleadbyte
_errno
__CxxFrameHandler
??0exception@@QAE@XZ
swscanf
_purecall
_getch
__RTDynamicCast
fclose
iswspace
_controlfp
fgetws
towlower
_wfopen
wcsrchr
__doserrno
_wopen
_close
_lseek
_wremove
_wtempnam
memcpy
wprintf
isxdigit
localeconv
iswprint
wcstoul
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
vwprintf
wcschr
_unlock
__dllonexit
_lock
_onexit
wctomb
wcstombs
realloc
__badioinfo
__pioinfo
_read
_fileno
_write
ungetc
_wcsicmp
printf
calloc
isdigit
feof
mbtowc
wcsstr
memset
_vsnwprintf

ole32

CoInitializeEx
StringFromGUID2
CoUninitialize
CoCreateInstance

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

rpcrt4

UuidFromStringW

userenv

LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
DestroyEnvironmentBlock

mpclient

MpManagerStatusQuery
MpConfigIteratorClose
MpConfigIteratorEnum
MpConfigIteratorOpen
MpConfigDelValue
MpManagerEnable
MpQuarantineRequest
MpThreatEnumerate
MpThreatOpen
MpUtilsExportFunctions
MpUpdateStartEx
MpDynamicSignatureOpen
MpDynamicSignatureEnumerate
MpRemoveDynamicSignatureFile
MpAddDynamicSignatureFile
MpManagerVersionQuery
MpManagerOpen
MpScanStart
MpCleanOpen
MpCleanStart
MpConfigOpen
MpConfigClose
MpScanResult
MpConfigGetValue
MpHandleClose
MpConfigUninitialize
MpConfigInitialize
MpFreeMemory
MpClientUtilExportFunctions
MpConfigSetValue
MpAllocMemory
MpConfigGetValueAlloc

cabinet

ord11
ord14
ord13
ord10

setupapi

SetupCloseInfFile
SetupCloseFileQueue
SetupTermDefaultQueueCallback
SetupPromptReboot
SetupInitDefaultQueueCallbackEx
SetupCommitFileQueueW
SetupInstallFilesFromInfSectionW
SetupOpenFileQueue
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupOpenAppendInfFileW
SetupOpenInfFileW
SetupDefaultQueueCallbackW

wintrust

CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATAdminAddCatalog
CryptCATAdminReleaseCatalogContext

Sections

.text
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d327a5bbdc3768d02449448f2a9b6d3d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

oleaut32

rpcrt4

userenv

mpclient

cabinet

setupapi

wintrust

Sections

.text Size: 190KB - Virtual size: 190KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 190KB - Virtual size: 190KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB