fc78644481080d27e3ccf2782ec0a73d23d0eefd2a121abd8e99d80d13686de1

Sharing

Copy URL Twitter E-mail

General

Target

fc78644481080d27e3ccf2782ec0a73d23d0eefd2a121abd8e99d80d13686de1
Size

63KB
MD5

58393f91c6d4ba7c05ba66567e1a7220
SHA1

ade75b05132ce89d097c2531db8c85b62fe13b47
SHA256

fc78644481080d27e3ccf2782ec0a73d23d0eefd2a121abd8e99d80d13686de1
SHA512

aeb4ef7efcb176957d9b42eba044261c3ef523ba4a0522aee100a7886673060d4d3942f26df986467d5564c16ca4efe6daa348a348860db01f7c63b25a820dc2
SSDEEP

768:DshDQSMvyMeo2oliqSwuaAQCiE2MCRLJ0zQeZ73Z6LU3YqHMA9yTpSI9Cc1L:DGDQJeChdAFisCNJ0seLoo8

Score

N/A

Malware Config

Signatures

Files

fc78644481080d27e3ccf2782ec0a73d23d0eefd2a121abd8e99d80d13686de1
.exe windows x86

fb92ef247e1be6be67cfa6625459427e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EncryptFileW
DecryptFileW
AddUsersToEncryptedFile
RemoveUsersFromEncryptedFile
AddUsersToEncryptedFileEx
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
LookupAccountSidW
FreeEncryptedFileKeyInfo
FreeEncryptionCertificateHashList
QueryRecoveryAgentsOnEncryptedFile
QueryUsersOnEncryptedFile
EncryptedFileKeyInfo
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetUserKey
FlushEfsCache
SetUserFileEncryptionKey

kernel32

GetFullPathNameW
GetComputerNameW
ReadConsoleW
SetConsoleMode
VirtualFree
VirtualAlloc
CloseHandle
SetEndOfFile
SetFilePointer
CreateFileW
DeviceIoControl
GetVolumeNameForVolumeMountPointW
VerifyVersionInfoW
VerSetConditionMask
FindClose
FindNextFileW
WideCharToMultiByte
FindFirstFileW
GetFileAttributesW
QueryDosDeviceW
FindVolumeClose
FindNextVolumeW
GetVolumeInformationW
FindFirstVolumeW
SetErrorMode
RemoveDirectoryW
SetLastError
GetTempFileNameW
CreateDirectoryW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeW
GetVolumePathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapSetInformation
DelayLoadFailureHook
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
LocalFree
WriteConsoleW
FlushFileBuffers
lstrlenW
WriteFile
HeapFree
GetProcessHeap
HeapAlloc
FormatMessageW
GetFileType
GetStdHandle
GetConsoleMode
GetModuleHandleW
GetLastError
GetProcAddress
lstrcmpW

msvcrt

__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
__set_app_type
?terminate@@YAXXZ
_controlfp
_get_osfhandle
_vsnwprintf
_except_handler4_common
_exit
_cexit
__wgetmainargs
_putws
_wcsnicmp
memcpy
getchar
printf
memset
_iob
fgetws
towupper
wcschr
_wcsicmp

ntdll

RtlNtStatusToDosError

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

user32

MessageBoxW

ntdsapi

DsCrackNamesW
DsBindW
DsUnBindW
DsFreeNameResultW

crypt32

CertCloseStore
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW
CertAddCertificateContextToStore
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CryptQueryObject
PFXExportCertStoreEx
CertEnumCertificatesInStore
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey
BCryptCloseAlgorithmProvider

netapi32

DsRoleFreeMemory
DsRoleGetPrimaryDomainInformation

efsutil

EfsUtilCreateSelfSignedCertificate
EfsUtilGetSmartcardProviderName
EfsUtilGetCurrentUserInformation

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bejycif
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb92ef247e1be6be67cfa6625459427e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

rpcrt4

user32

ntdsapi

crypt32

bcrypt

netapi32

efsutil

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 9KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 29KB - Virtual size: 30KB

bejycif Size: - Virtual size: 4KB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 9KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 29KB - Virtual size: 30KB

bejycif
Size: - Virtual size: 4KB