4f3098ae36366354bc97ec28e9a6df526cf113b53809be05366389723f32842c

Sharing

Copy URL Twitter E-mail

General

Target

4f3098ae36366354bc97ec28e9a6df526cf113b53809be05366389723f32842c
Size

1.1MB
MD5

b34166ad81e51fed2483cc35769ba632
SHA1

6f542296e1ad8c53a256990455aa5cbf9a510596
SHA256

4f3098ae36366354bc97ec28e9a6df526cf113b53809be05366389723f32842c
SHA512

4395f031db191867c5eae9588a1ad90cfab7b3555d603cc5fc00c8cabc39211e89a6a2b988d09bfe60c59ec37577acf5057de2341fe3e3161ae7171450541ff5
SSDEEP

24576:+QUwYaaauKkvaDKKvjmkxlg5Qi9MR9/Ai:+QtYaaauPxkxlgyi9MTA

Score

N/A

Malware Config

Signatures

Files

4f3098ae36366354bc97ec28e9a6df526cf113b53809be05366389723f32842c
.exe windows x86

24bbe0bfaf1028355da5ace282104fb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
LookupAccountSidW
ConvertSidToStringSidW
GetLengthSid
FreeSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
LookupAccountNameW
GetSidSubAuthorityCount
EqualDomainSid
IsValidSid
CreateWellKnownSid
AccessCheck
AdjustTokenPrivileges
LookupPrivilegeValueW
PrivilegeCheck
CheckTokenMembership
DuplicateToken
EqualSid
ConvertStringSidToSidW
AddAccessAllowedAceEx
AddAccessDeniedAceEx
GetAclInformation
GetAce
AddAce
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
CopySid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenThreadToken
OpenProcessToken
GetTokenInformation

kernel32

InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetLastError
EncodePointer
GetComputerNameW
GetComputerNameExW
GetVolumeInformationW
GetVolumePathNamesForVolumeNameW
GetModuleHandleW
GetTimeZoneInformation
SetErrorMode
GetDiskFreeSpaceW
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
Sleep
EnterCriticalSection
LeaveCriticalSection
DefineDosDeviceW
ReadFile
CreateDirectoryW
SetFileAttributesW
GetEnvironmentVariableW
GetSystemWindowsDirectoryW
LoadLibraryW
GetProcAddress
CreateThread
FindFirstVolumeW
FindNextVolumeW
FindFirstFileW
FindNextFileW
ExpandEnvironmentStringsW
FindClose
FindVolumeClose
SetLastError
GetVersionExW
LoadLibraryExW
FormatMessageW
FreeLibrary
GetCurrentThread
MultiByteToWideChar
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WriteFile
DeleteFileW
MoveFileExW
GetFileAttributesW
GetProcessHeap
HeapAlloc
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
WaitForSingleObject
CloseHandle
SetWaitableTimer
CancelWaitableTimer
GetCurrentThreadId
SetEvent
CreateEventW
CreateWaitableTimerW
OpenThread
CompareStringW
GetCommandLineW
HeapSetInformation
LocalAlloc
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetSystemDirectoryW
LocalFree
ResetEvent
DeviceIoControl
CreateFileW
GetDriveTypeW
HeapFree
GetSystemTimeAsFileTime
GetTickCount64
FlushFileBuffers
GetOverlappedResult
SetThreadPriority
WaitForMultipleObjects
ResumeThread
DeleteVolumeMountPointW
RaiseException
lstrlenW
QueryDosDeviceW
SetVolumeMountPointW

user32

RegisterDeviceNotificationW
LoadStringW
UnregisterDeviceNotification

msvcrt

memset
_snwscanf_s
_wcsupr
strncmp
wcsnlen
_ultow_s
wcscpy_s
wcscat_s
swprintf_s
__CxxFrameHandler3
_purecall
_vsnwprintf
_CxxThrowException
_wcsicmp
free
_controlfp
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
wcschr
_vscwprintf
realloc
memmove
wcsncmp
_errno
_beginthreadex
memcpy
malloc
_wcsnicmp
wcsstr
qsort
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
wcstoul
wcsrchr
iswspace
__set_app_type
towupper
iswdigit
_vsnprintf
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_wcslwr
memcpy_s
memmove_s
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_callnewh
??0exception@@QAE@XZ

atl

ord16
ord23
ord17
ord20
ord30
ord32
ord58

ole32

CoRevertToSelf
CoImpersonateClient
CoDisconnectContext
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CLSIDFromString
CoFreeUnusedLibraries
CoGetObjectContext
StringFromCLSID
CoSetProxyBlanket
CoTaskMemRealloc

shlwapi

SHDeleteKeyW

oleaut32

VariantClear
SysAllocStringLen
SysAllocString
SysFreeString
VariantChangeType
GetErrorInfo
VariantCopy
VariantInit
LoadRegTypeLi
SysStringLen

rpcrt4

I_RpcBindingInqLocalClientPID
UuidToStringW
RpcStringFreeW

ntdll

NtThawTransactions
NtFreezeTransactions
NtQueryVolumeInformationFile
RtlNtStatusToDosErrorNoTeb
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlNtStatusToDosError
NtUnloadKey
NtLoadKey
NtAdjustPrivilegesToken
NtOpenProcessToken
NtOpenThreadToken
EtwTraceMessage
RtlFreeSid
RtlSetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
NtSetSecurityObject
NtCreateKey
NtDeleteValueKey
NtQueryValueKey
NtSetValueKey
NtFreezeRegistry
NtThawRegistry
NtQuerySystemInformation
RtlFreeHeap
RtlAllocateHeap
NtOpenFile
RtlGUIDFromString
RtlFreeUnicodeString
RtlStringFromGUID
NtWaitForSingleObject
NtDeviceIoControlFile
NtCreateEvent
NtAllocateUuids
LdrGetProcedureAddress
RtlInitAnsiString
LdrGetDllHandle
NtResetEvent
RtlGetVersion
NtOpenKey
NtEnumerateKey
NtQueryKey
NtQueryAttributesFile
NtDeleteKey

vssapi

?CreateVssSnapshotSetDescription@@YGJU_GUID@@JPAPAVIVssSnapshotSetDescription@@@Z
?LoadVssSnapshotSetDescription@@YGJPBGPAPAVIVssSnapshotSetDescription@@U_GUID@@@Z
VssFreeSnapshotPropertiesInternal
CreateWriter
CreateWriterEx

netapi32

NetApiBufferFree
NetShareEnum
NetLocalGroupGetMembers
NetShareGetInfo
NetShareDel
NetShareAdd

clusapi

OpenCluster
ClusterResourceControl
GetClusterResourceState
CloseClusterResource
CloseCluster
OpenClusterResource
GetNodeClusterState

xolehlp

ord9
ord8

resutils

ResUtilEnumResourcesEx
ResUtilGetResourceName

setupapi

SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
CM_Get_Parent

vsstrace

ord7
ord9
ord4
ord10
ord11
ord8
ord2
ord1
ord3
ord5
ord6

authz

AuthzReportSecurityEventFromParams
AuthzUnregisterSecurityEventSource
AuthzRegisterSecurityEventSource

virtdisk

GetStorageDependencyInformation

Sections

.text
Size: 901KB - Virtual size: 900KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

PACK
Size: 164KB - Virtual size: 424KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

24bbe0bfaf1028355da5ace282104fb1

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

atl

ole32

shlwapi

oleaut32

rpcrt4

ntdll

vssapi

netapi32

clusapi

xolehlp

resutils

setupapi

vsstrace

authz

virtdisk

Sections

.text Size: 901KB - Virtual size: 900KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 75KB - Virtual size: 74KB

PACK Size: 164KB - Virtual size: 424KB

.text
Size: 901KB - Virtual size: 900KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 75KB - Virtual size: 74KB

PACK
Size: 164KB - Virtual size: 424KB