77bf1d1979aa8296d47598dd7ad0751a0e627e3d5b6689bf0877933ff11c0877

Sharing

Copy URL

Twitter E-mail

General

Target

77bf1d1979aa8296d47598dd7ad0751a0e627e3d5b6689bf0877933ff11c0877
Size

54KB
MD5

8404e01ffc566af5584468e8487a9550
SHA1

abe8ee3a94a875b59229478131f3c822e5ac3088
SHA256

77bf1d1979aa8296d47598dd7ad0751a0e627e3d5b6689bf0877933ff11c0877
SHA512

38539667c18998d3bd409a130dc5cedd28de8e8eb2aecc346f6d1ff81f7c8c258ef7e2669e9e120532e1b6cbb516854d65c2b60f428ccef63d5ff990cd200f49
SSDEEP

768:NpnkR6TpGRFxkGtqQK2VzsVbrNGarRUWJ+TUjpWr3JG4frfuS+4nN:7naEGyGXzsaKeA+SEJ9p+4N

Score

N/A

Malware Config

Signatures

Files

77bf1d1979aa8296d47598dd7ad0751a0e627e3d5b6689bf0877933ff11c0877
.exe windows x86

6be84b25ed346af1ddd1450a9c5267a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
GetTokenInformation
CredpEncodeSecret
CredRestoreCredentials
CredBackupCredentials

kernel32

LocalFree
LocalAlloc
GetFileSizeEx
CreateThread
DuplicateHandle
CreateFileW
SetEvent
GlobalFree
GetCommandLineW
HeapSetInformation
CreateEventW
WriteFile
OpenProcess
DeleteFileW
GetTempFileNameW
WaitForMultipleObjects
SleepEx
GetOverlappedResult
CloseHandle
GetLastError
GetTempPathW
FormatMessageW
HeapFree
GetProcessHeap
HeapAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
CancelIo
ReadFile
SetLastError

gdi32

GetObjectW
CreateFontIndirectW

user32

EnableWindow
SetFocus
SendMessageW
GetDlgItem
PostMessageW
GetDlgItemTextW
ShowWindow
SetWindowTextW
LoadStringW
CheckRadioButton
SetWindowLongW
GetWindowLongW
GetParent
SendDlgItemMessageW

msvcrt

__set_app_type
__p__fmode
__p__commode
?terminate@@YAXXZ
_amsg_exit
_controlfp
_vsnwprintf
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
swscanf
wcsncmp
memset
__setusermatherr
_except_handler4_common

comctl32

CreatePropertySheetPageW
PropertySheetW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

ntdll

TpWaitForWait
TpAllocWait
NtOpenProcessToken
NtPrivilegeCheck
NtAdjustPrivilegesToken
NtClose
RtlNtStatusToDosError
TpReleaseWait
TpSetWait

crypt32

CryptProtectData
CryptUnprotectData

rpcrt4

RpcAsyncInitializeHandle
RpcStringBindingComposeW
NdrAsyncClientCall
I_RpcExceptionFilter
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcBindingFree

shell32

CommandLineToArgvW

netutils

NetApiBufferFree

samcli

NetValidatePasswordPolicy

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6be84b25ed346af1ddd1450a9c5267a1

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

comdlg32

ntdll

crypt32

rpcrt4

shell32

netutils

samcli

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 28KB - Virtual size: 29KB

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 28KB - Virtual size: 29KB