950195e31264d2538482b16e5decf12df53b00864a06c8e1a1f14a6d1f0b8c36

Sharing

Copy URL

Twitter E-mail

General

Target

950195e31264d2538482b16e5decf12df53b00864a06c8e1a1f14a6d1f0b8c36
Size

232KB
MD5

93c93485ff6ed0a3b87051c6e7261dd0
SHA1

7cfd24d4a8d059fd80d10840e87f40dddb2e8027
SHA256

950195e31264d2538482b16e5decf12df53b00864a06c8e1a1f14a6d1f0b8c36
SHA512

ec9d53014434520b9fc6df9cce4488238761f8ca9ae709dc8825439c3eec27244094a10f2d72ba45729198f4cd7ad5ca18ead450777b3fcd3b724db9310c4bb4
SSDEEP

6144:Ka7h5wjMm4t+c/OqvW0UiYslKPeJFegEv+2Vo31:57TwwmkWzuHKqeg+nq

Score

N/A

Malware Config

Signatures

Files

950195e31264d2538482b16e5decf12df53b00864a06c8e1a1f14a6d1f0b8c36
.exe windows x86

eb55c6ba12ed710efb6047cdd2ba4ae4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
CloseTrace
RegOpenKeyExW
OpenProcessToken
RegCreateKeyExW
DuplicateToken
RegSetValueExW
RegQueryValueExW
CreateWellKnownSid
GetTokenInformation
CheckTokenMembership
StartTraceW
EnableTrace
ControlTraceW

kernel32

GetModuleHandleW
CreateThread
FreeLibrary
GetVolumePathNameW
GetVolumePathNamesForVolumeNameW
ExpandEnvironmentStringsW
GetDiskFreeSpaceExW
InitializeConditionVariable
InitializeCriticalSectionAndSpinCount
lstrlenW
LeaveCriticalSection
EnterCriticalSection
GetDriveTypeW
MoveFileExW
CreateFileW
DeviceIoControl
WakeAllConditionVariable
GetFileMUIPath
GetLogicalDriveStringsW
GetTempPathW
CreateEventW
DeleteCriticalSection
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
InterlockedIncrement
InterlockedDecrement
TerminateProcess
GetCurrentProcess
SetErrorMode
GetFileAttributesW
DeleteFileW
CreateDirectoryW
GetLastError
GetCommandLineW
LocalFree
CloseHandle
LoadLibraryExW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetVolumeNameForVolumeMountPointW
FormatMessageW
FindClose
FindNextFileW
FindFirstFileW

user32

LoadIconW
EnableWindow
ShowWindow
SetWindowTextW
PostMessageW
SetWindowLongW
GetDlgItem
IsWindow
GetWindowLongW
GetSystemMetrics
SendMessageW
DestroyIcon
DialogBoxParamW
GetLastActivePopup
MessageBoxW
EndDialog
SetFocus
RegisterWindowMessageW
ChangeWindowMessageFilterEx
LoadStringW

msvcrt

??3@YAXPAX@Z
_vsnwprintf
??_V@YAXPAX@Z
memcpy
wcsrchr
memmove
wcsstr
iswspace
_vscwprintf
??_U@YAPAXI@Z
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
_snwscanf_s
_wcsupr
strncmp
wcsnlen
_wcslwr
wcscat_s
swprintf_s
wcscpy_s
_ultow_s
wcstoul
_wcsnicmp
memset
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_wcsicmp
??2@YAPAXI@Z
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
wcschr
_acmdln

shell32

SHGetFileInfoW
SHParseDisplayName
SHGetDesktopFolder
ord155
CommandLineToArgvW

ole32

CoTaskMemFree
CoInitializeEx
CoUninitialize
CoWaitForMultipleHandles
CoCreateGuid
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

DispCallFunc
LoadRegTypeLi
VariantClear
SysAllocString
SysStringLen
SysFreeString
SysAllocStringLen

comctl32

ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ord345
ord344

spp

SxTracerDebuggerBreak
SxTracerShouldTrackFailure
SxTracerGetThreadContextRetail

shlwapi

StrRetToBufW
SHCreateStreamOnFileW
SHCreateStreamOnFileEx

ntdll

RtlInitUnicodeString
WinSqmAddToStream
RtlFreeHeap
NtQuerySystemInformation
RtlGetLastNtStatus
RtlNtStatusToDosError
EtwTraceMessage
LdrGetDllHandle
NtQueryInformationFile
NtResetEvent
RtlGetVersion
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
NtAllocateUuids
NtSetInformationFile
RtlAllocateHeap
NtClose
NtWaitForSingleObject
NtDeviceIoControlFile
NtCreateEvent
NtOpenFile
RtlStringFromGUID
RtlFreeUnicodeString
RtlGUIDFromString
NtOpenKey
NtEnumerateKey
NtQueryKey
NtQueryAttributesFile
NtUnloadKey
NtLoadKey
NtAdjustPrivilegesToken
NtOpenProcessToken
NtOpenThreadToken
RtlFreeSid
RtlSetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
NtSetSecurityObject
NtCreateKey
NtDeleteValueKey
NtQueryValueKey
NtSetValueKey
NtDeleteKey
LdrGetProcedureAddress
RtlInitAnsiString

reagent

WinReGetConfig

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

eb55c6ba12ed710efb6047cdd2ba4ae4

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shell32

ole32

oleaut32

comctl32

spp

shlwapi

ntdll

reagent

Sections

.text Size: 127KB - Virtual size: 126KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 66KB - Virtual size: 65KB

.reloc Size: 36KB - Virtual size: 37KB

.text
Size: 127KB - Virtual size: 126KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 66KB - Virtual size: 65KB

.reloc
Size: 36KB - Virtual size: 37KB