9ec62220bb5f2301be9775f3a15a8ec44b2efad44bca91c87ab71f0433db1f2e

Sharing

Copy URL Twitter E-mail

General

Target

9ec62220bb5f2301be9775f3a15a8ec44b2efad44bca91c87ab71f0433db1f2e
Size

20KB
MD5

4b1985878ebc78a5b102002393457acc
SHA1

18a9d6624a47286ba229a1d61c9af6296f6303e0
SHA256

9ec62220bb5f2301be9775f3a15a8ec44b2efad44bca91c87ab71f0433db1f2e
SHA512

c006aa4e8aa108aa5ccf99416da202ecef9f41f96ec5717d3c988b36a4969f00fc3b45d4574d79c49256b0485b8dfe5c91990796bb05d69622fb9edb5c394051
SSDEEP

384:PJn3+c7Fmgz0KdQ0u4VbEzs6Du16FLPmAewL0lJXKBHlrsW9EWOdx4:Bnfj0T07Vbz6W6hmAxLHHlTAdx

Score

N/A

Malware Config

Signatures

Files

9ec62220bb5f2301be9775f3a15a8ec44b2efad44bca91c87ab71f0433db1f2e
.dll windows x86

74683be721c8e43c00f53a9b08df07c3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AllocateAndInitializeSid
FreeSid
GetLengthSid
GetAclInformation
GetAce
EqualSid
InitializeSecurityDescriptor
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegGetKeySecurity
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CreateServiceA
ChangeServiceConfigA
RevertToSelf
OpenSCManagerA
QueryServiceStatus
StartServiceA
CloseServiceHandle
OpenServiceA
GetSecurityDescriptorDacl

kernel32

WaitForSingleObject
InterlockedExchangeAdd
InterlockedCompareExchange
CreateEventA
GetSystemInfo
InitializeCriticalSectionAndSpinCount
PulseEvent
InterlockedIncrement
InterlockedExchange
GetCurrentProcessId
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
DelayLoadFailureHook
GetLastError
GetCurrentThreadId
DuplicateHandle
GetCurrentThread
GetCurrentProcess
CloseHandle
QueueUserAPC
DeleteCriticalSection
GlobalFree
InitializeCriticalSection
DisableThreadLibraryCalls
LoadLibraryA
GetModuleFileNameA
FreeLibraryAndExitThread
Sleep
SwitchToThread
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
GlobalAlloc
ResumeThread
CreateThread
GetProcAddress

ntdll

NtQueryVirtualMemory
RtlUnwind
NtFsControlFile
NtWaitForSingleObject
NtCreateNamedPipeFile
NtOpenFile
NtQueryDirectoryFile
swprintf
RtlGetNtProductType
_alloca_probe
NtCreateFile
RtlNtStatusToDosError
RtlImpersonateSelf
RtlAdjustPrivilege
RtlInitUnicodeString
NtLoadDriver
NtDeviceIoControlFile
NtClose
NtDelayExecution

Exports

Exports

WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.text
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.code9
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

74683be721c8e43c00f53a9b08df07c3

Headers

File Characteristics

Imports

advapi32

kernel32

ntdll

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 4KB

.code9 Size: 512B - Virtual size: 4KB

.text
Size: 15KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 4KB

.code9
Size: 512B - Virtual size: 4KB