9c311849364acb88ad7e6b3f577e9189c682448f5599222deb9609e4b0a81935

Sharing

Copy URL Twitter E-mail

General

Target

9c311849364acb88ad7e6b3f577e9189c682448f5599222deb9609e4b0a81935
Size

149KB
MD5

83cd71213eb10bfe044b875649f94b3e
SHA1

73aa161120b4c7bed5d2ed923cc1ee88cfeb8965
SHA256

9c311849364acb88ad7e6b3f577e9189c682448f5599222deb9609e4b0a81935
SHA512

05d73d0a539a863756361ed441f4558de9e21761875cee6adafb0b4cf6889f4f05ce460e30ace963e2760e431cfdb830414b3c7f11621c74f6067691b0b1f017
SSDEEP

3072:2kB1vUZfhcaqExFltGhNLJ+R7Y5IMTL9jPxkTxfaLGsdbqCRx:2618ZfshN1cUfTUTkHdz

Score

N/A

Malware Config

Signatures

Files

9c311849364acb88ad7e6b3f577e9189c682448f5599222deb9609e4b0a81935
.exe windows x86

6390cce81012bdffd3ad199754551426

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
LookupAccountNameW
FreeSid
LookupAccountSidW
AllocateAndInitializeSid
LsaFreeMemory
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
ConvertStringSidToSidW
InitializeAcl
BuildSecurityDescriptorW
BuildTrusteeWithNameW
AddAccessAllowedAce
GetLengthSid
AddAce
GetSecurityDescriptorDacl
IsWellKnownSid
ConvertSidToStringSidW
GetSidSubAuthority
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
LsaLookupNames
SetThreadToken
OpenThreadToken
GetTokenInformation
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LogonUserW
LsaRetrievePrivateData
LsaStorePrivateData
LsaRemoveAccountRights
LsaEnumerateAccountRights
LsaAddAccountRights
IsValidSecurityDescriptor
GetSecurityDescriptorLength
OpenProcessToken
CreatePrivateObjectSecurityEx
DestroyPrivateObjectSecurity
BuildTrusteeWithSidW
RegConnectRegistryW

kernel32

LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
HeapSetInformation
GetModuleFileNameW
MoveFileExW
OpenEventW
SetEvent
GetWindowsDirectoryA
GetLastError
CreateFileA
CreateFileW
GetFileSize
CloseHandle
SetFilePointer
GetLocalTime
WriteFile
lstrlenW
lstrlenA
GetVersionExA
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
IsDebuggerPresent
GetCurrentThread
GetThreadContext
DebugBreak
CreateDirectoryW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
SetFileAttributesW
DeleteFileW
GetModuleHandleW
FindResourceW
LoadResource
InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
RegOpenKeyExW
RegFlushKey
RegDeleteValueW
RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
LoadLibraryW
FindClose
FindNextFileW
FindFirstFileW
LocalFree
LocalAlloc
LocalSize
LocalReAlloc
GetComputerNameW
CompareStringW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
FormatMessageW
LockResource

msvcrt

__CxxFrameHandler3
wcsrchr
_wcsnicmp
free
_vsnwprintf
malloc
_waccess
_local_unwind4
_wstrtime
_wcsicmp
realloc
_wstrdate
memcpy
_onexit
_lock
__dllonexit
_unlock
_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
_strtime
_stricmp
clock
wcsstr
memset
wcstombs
wcschr

user32

CharPrevA
CharNextA
IsCharAlphaW
CharPrevW
CharNextW
LoadStringW
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetDesktopWindow
SetThreadDesktop
OpenDesktopW
SetProcessWindowStation
OpenWindowStationW
GetThreadDesktop
GetProcessWindowStation
DialogBoxParamW
EndDialog
SetDlgItemTextW
CloseWindowStation
CloseDesktop
IsCharAlphaNumericW

ole32

CoTaskMemRealloc
CLSIDFromString
CoUninitialize
CoInitializeEx
CoCreateInstance
CoGetObjectContext
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

version

VerQueryValueW

Exports

Exports

?GetRegNodeDispenser@@YGJPAPAUIRegNodeDispenser@@@Z

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tuixndy
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6390cce81012bdffd3ad199754551426

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 111KB

.data Size: 512B - Virtual size: 31KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 35KB

tuixndy Size: - Virtual size: 4KB

.text
Size: 112KB - Virtual size: 111KB

.data
Size: 512B - Virtual size: 31KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 35KB

tuixndy
Size: - Virtual size: 4KB