fd1265096b3e184431427430c563be083ab717c0553f196d6446b56586ac41f4

Sharing

Copy URL Twitter E-mail

General

Target

fd1265096b3e184431427430c563be083ab717c0553f196d6446b56586ac41f4
Size

620KB
MD5

a320acd7687a6d98bae82618c5b20120
SHA1

ce55e63db79d0e7f26661f5679722432743f32d7
SHA256

fd1265096b3e184431427430c563be083ab717c0553f196d6446b56586ac41f4
SHA512

26d9e75fb5216bb85cdc574f6153be24bfb4482c0c9e734b7985f2de731fcbdb7376b952e14e2c51908b43f60340a5d75a0d410312f88eaf6f49960617019b4a
SSDEEP

12288:myWWf8puU0F8a5WhqkJZ24/cnEa1GqWS8oO2eTxOgmcqPGqShwApLL0SBe73a:myWQks8aghDJ3cnEo7WS8oITfmvGqSh0

Score

N/A

Malware Config

Signatures

Files

fd1265096b3e184431427430c563be083ab717c0553f196d6446b56586ac41f4
.exe windows x86

5b7c6e4ad6237349266a8fee21d7b30d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

isdigit
wcscpy
_snprintf
wcscat
mbstowcs
iswspace
wcsrchr
wcsncmp
wcsncat
printf
memmove
wcsncpy
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_wgetenv
swscanf
_snwprintf
wcslen
wcschr
_wtoi
toupper
_except_handler3
strrchr

advapi32

TraceMessage
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
EnableTrace
RegEnumKeyExW
StartTraceW
QueryTraceW
RegQueryValueExW
RegisterEventSourceW
ReportEventW
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW

kernel32

LeaveCriticalSection
ReleaseMutex
GetCurrentThreadId
GetLastError
RaiseException
WaitForSingleObject
EnterCriticalSection
SetLastError
LocalFree
SetEvent
CreateThread
CreateMutexW
LocalAlloc
GetSystemTimeAsFileTime
CloseHandle
Sleep
WaitForMultipleObjects
CreateEventA
SetErrorMode
lstrlenW
lstrcpyW
FormatMessageW
TerminateProcess
lstrcmpiA
InterlockedCompareExchange
InterlockedExchange
SetThreadPriority
IsDebuggerPresent
ExitProcess
lstrcmpW
FreeLibrary
GetProcAddress
DebugBreak
OutputDebugStringW
OutputDebugStringA
LoadLibraryW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetEnvironmentVariableW
InitializeCriticalSection
SetPriorityClass
MapViewOfFile
GetSystemWow64DirectoryW
CreateProcessW
GetCurrentProcessId
DuplicateHandle
OpenProcess
SetUnhandledExceptionFilter
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
UnhandledExceptionFilter
lstrcmpiW
GetLocaleInfoW
FormatMessageA
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetSystemTime
FlushFileBuffers
GetFileAttributesW
CreateDirectoryW
ExpandEnvironmentStringsW
CreateFileW
MoveFileExW
lstrcatW
PostQueuedCompletionStatus
CompareStringW
LocalSize
LocalReAlloc
InterlockedIncrement
GetCurrentThread
CreateEventW
ResetEvent
SetCurrentDirectoryW
GetModuleFileNameW
GetCurrentProcess
VirtualQuery

rpcrt4

RpcServerUseProtseqW
RpcServerRegisterAuthInfoA
RpcServerRegisterIfEx
RpcServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIf
RpcMgmtWaitServerListen
RpcBindingInqAuthClientA
RpcImpersonateClient
I_RpcMapWin32Status
RpcRevertToSelf
RpcServerInqBindings
RpcStringFreeW
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingVectorFree
NdrServerCall2

ntdll

RtlUnicodeStringToInteger
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
NtQuerySystemInformation
RtlInitUnicodeString

user32

wsprintfW

ole32

CLSIDFromProgID
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CLSIDFromString
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

clusapi

ClusterRegCreateKey
ClusterRegQueryValue
GetClusterKey
ClusterRegOpenKey
OpenCluster
ClusterRegCloseKey

resutils

ResUtilSetPrivatePropertyList
ResUtilEnumProperties
ResUtilGetProperties
ResUtilEnumPrivateProperties
ResUtilGetPrivateProperties
ResUtilVerifyPrivatePropertyList
ResUtilVerifyPropertyTable
ResUtilSetPropertyTable
ResUtilFreeParameterBlock
ResUtilGetDwordValue
ResUtilGetPropertyFormats

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 556KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b7c6e4ad6237349266a8fee21d7b30d

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

rpcrt4

ntdll

user32

ole32

oleaut32

clusapi

resutils

Sections

.text Size: 62KB - Virtual size: 61KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 556KB - Virtual size: 2.3MB

.text
Size: 62KB - Virtual size: 61KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 556KB - Virtual size: 2.3MB