81a4fc812806761a852e0ed929be61a4737b32b332ae1ed5feb450dc59e3c133

Sharing

Copy URL Twitter E-mail

General

Target

81a4fc812806761a852e0ed929be61a4737b32b332ae1ed5feb450dc59e3c133
Size

537KB
MD5

0c7cf9d7cfd1500f896a90177b906af0
SHA1

74fbf3471ea2dd52125f2824647fa3f0fd89440f
SHA256

81a4fc812806761a852e0ed929be61a4737b32b332ae1ed5feb450dc59e3c133
SHA512

67a03f13b3da7227b533e151c3398ea754780ba7a8cb5c690f00839a713d499ac7e462f25a94644626d97c5cc5014661e9c085b18b5fc6f60b30363d78c9ce9e
SSDEEP

12288:RRZcTJ8P35RmBtdntu+wyEZAzDN3iKTL:RPC8P354BrntllEZA06

Score

N/A

Malware Config

Signatures

Files

81a4fc812806761a852e0ed929be61a4737b32b332ae1ed5feb450dc59e3c133
.exe windows x86

a89bdddd0903c709e829f240ccb80022

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
ConvertStringSidToSidW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
EqualSid
RegOpenKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
SetServiceStatus
DestroyPrivateObjectSecurity
RegisterServiceCtrlHandlerW
GetLengthSid
IsValidSid
DuplicateToken
LogonUserW
AccessCheckAndAuditAlarmW
MapGenericMask
MakeSelfRelativeSD
RegSetValueExW
GetSecurityDescriptorLength
GetSecurityDescriptorControl
IsValidSecurityDescriptor
RegCreateKeyExW
CreatePrivateObjectSecurity
OpenProcessToken
RegQueryValueExW
GetTokenInformation
OpenThreadToken
SetPrivateObjectSecurity
GetPrivateObjectSecurity
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegisterEventSourceW
PerfSetCounterRefValue
PerfCreateInstance
PerfStartProvider
PerfSetCounterSetInfo
PerfStopProvider
RegDeleteKeyExW
RevertToSelf
ImpersonateLoggedOnUser
EnumDependentServicesW
ControlService
RegNotifyChangeKeyValue
OpenSCManagerW
OpenServiceW
QueryServiceStatus
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
SetSecurityDescriptorDacl
CloseServiceHandle
RegEnumKeyW
LookupAccountSidW
LookupAccountNameW
CopySid
LookupPrivilegeValueW
AdjustTokenPrivileges
ReportEventW
DeregisterEventSource

kernel32

OpenEventW
GetTimeFormatW
GetStringTypeExW
OutputDebugStringW
GetModuleFileNameW
GetSystemDirectoryW
GetFileInformationByHandle
GetTempPathW
GetTempFileNameW
CreateFileW
GetFileType
InitializeCriticalSectionAndSpinCount
CompareStringW
ExpandEnvironmentStringsW
GetLocaleInfoW
GetDateFormatW
GetVersionExW
WideCharToMultiByte
MultiByteToWideChar
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
OutputDebugStringA
GetStartupInfoW
MulDiv
lstrcmpiW
lstrlenW
GetLastError
GetProcAddress
SetLastError
HeapCreate
GetProcessHeap
lstrlenA
HeapDestroy
InitializeCriticalSection
CreateSemaphoreW
FileTimeToLocalFileTime
lstrcmpW
ResetEvent
GetSystemTimeAdjustment
GetModuleHandleW
CreateWaitableTimerW
InterlockedIncrement
CreateThread
GetComputerNameW
HeapSetInformation
GetVersion
GetFileSize
VirtualFree
LocalAlloc
PostQueuedCompletionStatus
ReadFile
WriteFile
InterlockedExchange
CopyFileW
Sleep
CreateEventW
GetFileAttributesW
WaitForSingleObject
SetUnhandledExceptionFilter
WaitForMultipleObjects
CreateDirectoryW
RemoveDirectoryW
GetSystemTimeAsFileTime
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
SetEvent
FileTimeToSystemTime
FindFirstFileW
DeleteCriticalSection
FindNextFileW
FindClose
LocalFree
UnmapViewOfFile
GetExitCodeThread
GetCurrentThread
HeapFree
GetCurrentProcess
HeapAlloc
ReleaseSemaphore
GetFullPathNameW
SetWaitableTimer
CancelWaitableTimer
InterlockedCompareExchange
InterlockedDecrement
SetThreadExecutionState
CreateIoCompletionPort
FormatMessageW
GetQueuedCompletionStatus
InterlockedExchangeAdd
GetLocalTime
MoveFileW
SetFilePointer
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
SetFileTime
GetFileSizeEx
GetFileTime
GetSystemTime
SetErrorMode
FreeLibrary
LoadLibraryW
CloseHandle

msvcrt

free
memset
_vsnwprintf
_wcsicmp
_wsplitpath_s
_wcsnicmp
realloc
iswalpha
_controlfp
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
malloc
_callnewh
?terminate@@YAXXZ
_purecall
qsort
_ltow
wcsstr
_itow
wcsncmp
wcsspn
??0exception@@QAE@XZ
__CxxFrameHandler3
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
memcpy_s
memcpy
wcsrchr
wcschr
swscanf
_wcsnset

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shlwapi

SHCopyKeyW
PathUnExpandEnvStringsW
ord487

rpcrt4

I_RpcBindingIsClientLocal
RpcBindingServerFromClient
RpcBindingToStringBindingW
NdrServerCall2
I_RpcExceptionFilter
RpcMgmtWaitServerListen
RpcImpersonateClient
RpcRevertToSelf
RpcServerRegisterAuthInfoW
RpcServerUnregisterIf
RpcServerListen
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcMgmtStopServerListening
RpcServerUnregisterIfEx
RpcBindingInqAuthClientW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
NdrClientCall2
RpcBindingSetOption
RpcBindingFree
RpcStringBindingParseW
RpcBindingSetAuthInfoExW

tapi32

lineShutdown
lineSetStatusMessages
lineGetLineDevStatus
lineInitializeExW
lineHandoffW
lineSetAppPriorityW
lineGetCountryW
lineGetCallInfoW
lineOpenW
lineTranslateAddressW
lineDeallocateCall
lineNegotiateAPIVersion
lineGetDevCapsW
lineClose

gdi32

SetMapMode
SetWindowExtEx
SetViewportExtEx
SetWindowOrgEx
LPtoDP
GetDeviceCaps
SetBkMode
CreateFontIndirectW
SelectObject
GetTextMetricsW
DeleteObject
DeleteEnhMetaFile
EndDoc
EnableEUDC
RestoreDC
PlayEnhMetaFile
GetEnhMetaFileHeader
SetEnhMetaFileBits
SaveDC
SelectClipRgn
CreateRectRgnIndirect
DeleteDC
EndPage
StartPage
StartDocW
CreateDCW
SetTextColor

winspool.drv

EnumPrintersW
FindNextPrinterChangeNotification
OpenPrinterW
ClosePrinter
FindFirstPrinterChangeNotification
SetPrinterW
GetPrinterW
FindClosePrinterChangeNotification
DocumentPropertiesW

user32

LoadStringW
SendMessageW
FindWindowW
DrawTextW

ole32

CoInitialize
CLSIDFromString
StringFromGUID2
OleRun
CoCreateInstance
IIDFromString
CoInitializeEx
CoUninitialize
StringFromIID
CoTaskMemFree
FreePropVariantArray
StgOpenStorageEx

oleaut32

SysAllocString
SysAllocStringByteLen
GetErrorInfo
VariantClear
VariantChangeType
VariantInit
SysFreeString
SysStringLen
SysStringByteLen

shell32

SHGetFolderPathAndSubDirW
SHSetLocalizedName
SHGetFolderPathW

crypt32

CryptProtectData
CryptHashMessage
CryptUnprotectData

credui

CredUIParseUserNameW

fxstiff

FXSTIFFInitialize
MemoryMapTiffFile
GetMsTagFileTime
GetMsTagDwordLong
TiffExtractFirstPage
TiffClose
TiffOpen
TiffAddMsTags
MmrAddBranding
MergeTiffFiles
TiffPostProcessFast
TiffRecoverGoodPages
GetMsTagString

ntdll

RtlValidRelativeSecurityDescriptor

Sections

.text
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

yxtajrk
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a89bdddd0903c709e829f240ccb80022

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

version

shlwapi

rpcrt4

tapi32

gdi32

winspool.drv

user32

ole32

oleaut32

shell32

crypt32

credui

fxstiff

ntdll

Sections

.text Size: 460KB - Virtual size: 460KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 61KB - Virtual size: 62KB

yxtajrk Size: - Virtual size: 4KB

.text
Size: 460KB - Virtual size: 460KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 61KB - Virtual size: 62KB

yxtajrk
Size: - Virtual size: 4KB