e9d0fe646fe22897e5d2f04a105eeb8095c169abaf1be823364b17502abf9d73

Sharing

Copy URL Twitter E-mail

General

Target

e9d0fe646fe22897e5d2f04a105eeb8095c169abaf1be823364b17502abf9d73
Size

329KB
MD5

84e395f010d5d2d2c620c1690f08faf0
SHA1

46247bd29869d6257d20b658b411e59f4521fe14
SHA256

e9d0fe646fe22897e5d2f04a105eeb8095c169abaf1be823364b17502abf9d73
SHA512

bdf713062a712949cb6f58a56df0897c22c7287b947739d820df964510e1c582437f46db32182e88db0e02ab45f46f2384876dad4d98a532b59bbe0e3b2892e7
SSDEEP

6144:iDDxiqo7qS8DOwkpbxL5pi60mhXT6BV9c9cpMtW+h8ABKOinn2s26ped:kU+S86/lV06VXaVAtGABK52S

Score

N/A

Malware Config

Signatures

Files

e9d0fe646fe22897e5d2f04a105eeb8095c169abaf1be823364b17502abf9d73
.exe windows x86

878fd343096fc1a76ca36905b37e4b1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfW
CharLowerBuffW

advapi32

OpenProcessToken
RegisterTraceGuidsW
CryptCreateHash
RegNotifyChangeKeyValue
RegCloseKey
QueryServiceStatus
GetTraceLoggerHandle
RegSetValueExW
OpenServiceW
RegOpenKeyW
CryptDestroyHash
CryptHashData
ReportEventW
OpenSCManagerW
CryptAcquireContextW
CloseServiceHandle
TraceEvent
RegQueryInfoKeyW
RegisterEventSourceW
QueryServiceConfigW
SetThreadToken
LookupAccountSidW
RegQueryValueExW
CryptSetProvParam
CryptGetHashParam
DeregisterEventSource
SystemFunction006
AllocateAndInitializeSid
RegConnectRegistryW
RegDeleteValueW
OpenThreadToken
RevertToSelf
RegOpenKeyExW
CryptGetProvParam
FreeSid
RegCreateKeyExW
GetTokenInformation
CryptReleaseContext
CredFree
SystemFunction007
RegEnumKeyExW
CredUnmarshalCredentialW

msasn1

ASN1BERDecBitString
ASN1BEREncOpenType
ASN1BERDecGeneralizedTime
ASN1_CloseEncoder
ASN1_CloseDecoder
ASN1BERDecNotEndOfContents
ASN1intx_setuint32
ASN1BEREncBitString
ASN1objectidentifier_free
ASN1EncSetError
ASN1ztcharstring_free
ASN1_FreeDecoded
ASN1_FreeEncoded
ASN1octetstring_free
ASN1_CreateDecoder
ASN1bitstring_free
ASN1BEREncSX
ASN1_CreateModule
ASN1BERDecExplicitTag
ASN1_Decode
ASN1intx_free
ASN1BEREncObjectIdentifier
ASN1BERDecBool
ASN1CEREncGeneralizedTime
ASN1BERDecZeroCharString
ASN1BERDecObjectIdentifier
ASN1BERDecOpenType2
ASN1intxisuint32
ASN1BEREncOctetString
ASN1BEREncExplicitTag
ASN1BERDecU32Val
ASN1DecAlloc
ASN1charstring_free
ASN1DecSetError
ASN1BERDecCharString
ASN1BERDecEndOfContents
ASN1BERDecPeekTag
ASN1intx2uint32
ASN1BEREncCharString
ASN1BEREncEndOfContents
ASN1intx2int32
ASN1BERDecSkip
ASN1BERDecSXVal
ASN1BERDecOctetString
ASN1_Encode
ASN1Free
ASN1BERDecS32Val
ASN1_CreateEncoder
ASN1BEREncBool
ASN1BEREncU32
ASN1BEREncS32

cryptdll

CDFindCommonCSystemWithKey
CDLocateCSystem
MD5Init
CDLocateCheckSum
CDBuildIntegrityVect
CDGenerateRandomBits
MD5Final
MD5Update

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
CredMarshalTargetInfo
FreeContextBuffer
CredUnmarshalTargetInfo

msvcrt

_wcsnicmp
sscanf
qsort
wcscmp
wcsrchr
wcsspn
_stricmp
strchr
wcstoul
swprintf
malloc
wcscpy
wcscat
wcslen
_adjust_fdiv
free
_strcmpi
_ultoa
_initterm
_vsnprintf
_strnicmp
_wcsicmp
strrchr
_except_handler3
sprintf

ntdll

RtlEqualDomainName
RtlUniform
RtlInitializeSid
RtlTimeToTimeFields
RtlFreeSid
RtlConvertSharedToExclusive
RtlInsertElementGenericTable
NtQueryInformationToken
NtCreateEvent
RtlSetDaclSecurityDescriptor
NtQuerySystemInformation
RtlOemStringToUnicodeString
RtlCreateTimerQueue
RtlVerifyVersionInfo
NtDuplicateObject
RtlInitUnicodeString
RtlInitAnsiString
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlLookupElementGenericTable
DbgPrint
RtlCompareUnicodeString
RtlDeleteTimerQueue
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlInitializeCriticalSection
RtlLookupElementGenericTableAvl
NtOpenThreadToken
RtlDowncaseUnicodeString
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlCopyUnicodeString
NtOpenEvent
RtlRunDecodeUnicodeString
RtlAllocateAndInitializeSid
RtlSubAuthorityCountSid
RtlFreeAnsiString
NtAllocateLocallyUniqueId
RtlEnterCriticalSection
RtlCreateTimer
RtlLengthRequiredSid
RtlInsertElementGenericTableAvl
RtlSystemTimeToLocalTime
RtlDeleteElementGenericTable
RtlCopyLuid
NtQuerySystemTime
RtlInitializeGenericTable
RtlLengthSid
RtlEraseUnicodeString
RtlUpcaseUnicodeString
VerSetConditionMask
RtlValidSid
RtlAppendUnicodeStringToString
RtlCompareMemory
RtlPrefixUnicodeString
RtlCreateSecurityDescriptor
NtClose
RtlAcquireResourceShared
RtlEqualSid
RtlSubAuthoritySid
RtlRegisterWait
RtlCreateAcl
RtlGetElementGenericTable
RtlConvertSidToUnicodeString
RtlAnsiStringToUnicodeString
NtAllocateVirtualMemory
RtlUnicodeStringToAnsiString
RtlDeregisterWait
RtlInitializeResource
NtOpenProcessToken
RtlIntegerToUnicodeString
RtlInitializeGenericTableAvl
RtlCopySid
NtWaitForSingleObject
RtlNtStatusToDosError
NtSetSecurityObject
RtlTimeFieldsToTime

kernel32

DebugBreak
DisableThreadLibraryCalls
OpenEventW
InterlockedCompareExchange
RaiseException
OpenFileMappingW
LoadLibraryA
UnmapViewOfFile
FormatMessageW
GetCurrentThread
MapViewOfFileEx
TerminateProcess
GetProcAddress
GetCurrentProcess
GetCurrentProcessId
CreateEventW
WriteFile
InterlockedExchangeAdd
GetEnvironmentVariableW
SetUnhandledExceptionFilter
CreateFileMappingW
LocalAlloc
GetComputerNameW
InitializeCriticalSection
CloseHandle
GetModuleFileNameA
CreateFileA
QueryPerformanceCounter
LeaveCriticalSection
lstrcpyW
SetEvent
InterlockedDecrement
Sleep
lstrcmpW
InterlockedIncrement
lstrlenW
WideCharToMultiByte
ExpandEnvironmentStringsW
UnregisterWait
LocalFree
GetCurrentThreadId
CreateFileW
MultiByteToWideChar
GetSystemTimeAsFileTime
VirtualAlloc
UnhandledExceptionFilter
GetModuleFileNameW
RegisterWaitForSingleObjectEx
GetModuleHandleW
FileTimeToSystemTime
InterlockedExchange
GetLastError
GetProfileStringA
OutputDebugStringA
FreeLibrary
LoadLibraryW
GetComputerNameExW
GetSystemInfo
DeleteCriticalSection
lstrcmpiA
GetACP
EnterCriticalSection
GetTickCount
GetLocalTime
lstrlenA

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

878fd343096fc1a76ca36905b37e4b1a

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

msasn1

cryptdll

secur32

msvcrt

ntdll

kernel32

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB