4bec5c7fdfe859953ecf54804a46c9fdece3c7030f7298199da670cc9dd1af1f

Sharing

Copy URL Twitter E-mail

General

Target

4bec5c7fdfe859953ecf54804a46c9fdece3c7030f7298199da670cc9dd1af1f
Size

1.2MB
MD5

5683a98b983a331606290b09b7b33dc0
SHA1

18e50054fc18a4f6cdb5c43c2a6a3d2127383cd1
SHA256

4bec5c7fdfe859953ecf54804a46c9fdece3c7030f7298199da670cc9dd1af1f
SHA512

8fc88ff1fe69bd4cfece3ffdc1887683034c8594d22d8a7000291c80965d04fc893cc369a84aaf88b5166f26fd4383ea69dc3cb4e38a77f0b01079d76d49c2f4
SSDEEP

24576:OE9imn16uPBxPTjGjS4suE5tl/pBHzZcX5FUMliDSt9c1xguJ:OE9PEMGp4lTHz9DDAW1PJ

Score

N/A

Malware Config

Signatures

Files

4bec5c7fdfe859953ecf54804a46c9fdece3c7030f7298199da670cc9dd1af1f
.exe windows x64

e45ee5a5caca285ab90d6f0ce6312ed0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
GetUserNameW
RegQueryValueExW
CryptReleaseContext
OpenProcessToken
GetTokenInformation
GetLengthSid
EventActivityIdControl
CreateWellKnownSid
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
EventUnregister
EventRegister
EventWrite
RegDeleteKeyValueW
RegEnumKeyW
CryptDestroyHash
CryptDestroyKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptSetKeyParam
CryptEncrypt
CryptDecrypt
CryptGenRandom
CryptGetHashParam
CryptGetUserKey
CryptImportKey
CryptGenKey
CryptExportKey
RegGetValueW

kernel32

CreateFileW
GetFileSizeEx
ReadFile
FormatMessageW
FindFirstFileW
FindClose
GetTickCount
Sleep
MoveFileExW
DeleteFileW
WaitForMultipleObjects
GetComputerNameW
WideCharToMultiByte
ExpandEnvironmentStringsW
lstrlenA
GlobalFree
LoadLibraryExW
SizeofResource
MultiByteToWideChar
lstrcmpiW
GetProcAddress
GetCommandLineW
lstrcmpW
MulDiv
GlobalLock
GlobalHandle
SetLastError
LocalAlloc
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
ResetEvent
QueueUserWorkItem
RegisterApplicationRestart
RaiseException
GlobalUnlock
FlushInstructionCache
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
GetFullPathNameW
LocalFree
CompareStringW
GetModuleFileNameW
FreeLibrary
SetWaitableTimer
CreateWaitableTimerW
LoadLibraryW
HeapFree
ReleaseMutex
lstrlenW
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetModuleHandleW
GetProcessHeap
HeapAlloc
WriteFile
GetFileSize
GetSystemTime
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
OutputDebugStringW
DeleteTimerQueueEx
CreateSemaphoreW
ReleaseSemaphore
OpenMutexW
GetTempPathW
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedPushEntrySList
VirtualAlloc
InterlockedPopEntrySList
VirtualFree
GetVersionExA
FindResourceW
CloseHandle
SetEvent
WaitForSingleObject
CreateThread
CreateMutexW
GetLastError
CreateEventW
CreateDirectoryW
LoadResource
LockResource
HeapSetInformation
GlobalAlloc

gdi32

BitBlt
CreateFontIndirectW
SetBkColor
SetTextColor
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps

user32

CloseClipboard
GetCaretPos
LoadMenuW
GetSubMenu
TrackPopupMenu
SetClipboardData
EmptyClipboard
OpenClipboard
GetWindowRect
UnregisterHotKey
RegisterHotKey
SystemParametersInfoW
FrameRect
GetSystemMetrics
DialogBoxIndirectParamW
PostQuitMessage
OpenIcon
DestroyMenu
GetDialogBaseUnits
MessageBeep
AllowSetForegroundWindow
FlashWindowEx
IsIconic
GetSysColorBrush
GetDCEx
SetCursor
PtInRect
IsWindowEnabled
LoadImageW
GetWindowInfo
GetActiveWindow
SetDlgItemTextW
SetWindowContextHelpId
SetTimer
EndDialog
PostMessageW
SetForegroundWindow
SendDlgItemMessageW
UpdateWindow
EnableWindow
CharUpperW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
IsWindow
GetClassNameW
GetSysColor
CharNextW
SetWindowPos
DestroyAcceleratorTable
RedrawWindow
GetClassInfoExW
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
InvalidateRect
InvalidateRgn
CallWindowProcW
GetDC
ReleaseDC
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
GetWindowLongW
SetWindowLongW
DefWindowProcW
LoadCursorW
RegisterClassExW
CreateDialogIndirectParamW
IsDialogMessageW
MapDialogRect
MapWindowPoints
UnregisterClassA
KillTimer
TranslateAcceleratorW
GetMessageW
CopyAcceleratorTableW
LoadAcceleratorsW
LoadIconW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
CreateWindowExW
ShowWindow
SendMessageW
GetDlgItem
LoadStringW
DrawFocusRect

msvcrt

memcpy
srand
time
_purecall
swscanf_s
_errno
realloc
__CxxFrameHandler3
??1type_info@@UEAA@XZ
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_wtol
iswdigit
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
_itow
towupper
wcstok
wcsncmp
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
_callnewh
_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
__C_specific_handler
memset
_wtoi
_vsnprintf
_time64
wcsncpy_s
malloc
swprintf_s
free
calloc
memcpy_s
_vsnwprintf
memmove_s
memcmp

ws2_32

WSAStartup
WSAGetLastError
socket
connect
closesocket
WSACleanup
WSAIoctl
WSASocketW
FreeAddrInfoW
GetAddrInfoW

ntdll

WinSqmAddToStream
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv4AddressToStringW
NtQueryInformationToken
NtOpenProcessToken
NtClose
NtOpenThreadToken

secur32

GetUserNameExW

ole32

OleInitialize
CLSIDFromString
CoTaskMemFree
CoTaskMemRealloc
GetHGlobalFromStream
CreateBindCtx
CoCreateInstanceEx
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
OleUninitialize
CoUninitialize
CoInitialize
CoCreateInstance
CoGetObject
CoCreateGuid
CoInitializeEx
StringFromIID

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SysReAllocString
SafeArrayCreateVector
VarBstrCat
SysStringByteLen
DispCallFunc
SafeArrayDestroy
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarBstrCmp
SysAllocStringLen
SysStringLen
VariantClear
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit

shlwapi

PathFindExtensionW
PathFindFileNameW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

comctl32

PropertySheetW
CreatePropertySheetPageW
ord345
ord413
ImageList_LoadImageW
ord410
ord344
InitCommonControlsEx

shell32

ord258
SHGetSpecialFolderPathW
ShellExecuteW
ord261
CommandLineToArgvW

urlmon

MkParseDisplayNameEx

uxtheme

CloseThemeData
GetThemeColor
IsAppThemed
GetThemeFont
OpenThemeData

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

ndfapi

NdfCreateIncident
NdfExecuteDiagnosis
NdfCloseIncident

rpcrt4

RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcStringFreeW
I_RpcExceptionFilter
RpcBindingFromStringBindingW
NdrClientCall3

Sections

.text
Size: 403KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 210KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e45ee5a5caca285ab90d6f0ce6312ed0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ws2_32

ntdll

secur32

ole32

oleaut32

shlwapi

comdlg32

comctl32

shell32

urlmon

uxtheme

crypt32

ndfapi

rpcrt4

Sections

.text Size: 403KB - Virtual size: 403KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 210KB - Virtual size: 209KB

.reloc Size: 568KB - Virtual size: 2.5MB

.text
Size: 403KB - Virtual size: 403KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 210KB - Virtual size: 209KB

.reloc
Size: 568KB - Virtual size: 2.5MB