bfd79c28849c92d333409e82de8cf770ba751c789a987fdcd3d57af46fb29661

Sharing

Copy URL

Twitter E-mail

General

Target

bfd79c28849c92d333409e82de8cf770ba751c789a987fdcd3d57af46fb29661
Size

261KB
MD5

a0c78e6e40be30f0e5359de692237b80
SHA1

518910c5c490174e0f43d1befa0d6767dea9ad47
SHA256

bfd79c28849c92d333409e82de8cf770ba751c789a987fdcd3d57af46fb29661
SHA512

418a0b9afefa16238d5b3ae0c8123581a594ed31af71fafda348623fe54584dc8484ad1806eae58db971122b11c4c2df8df28639d74df48451d856ca72c9c7ec
SSDEEP

6144:lkCeTVXl0oOaCxCBbzSY9FQe2eFte7erUs:n8VXOoFnx9FeeFteAUs

Score

N/A

Malware Config

Signatures

Files

bfd79c28849c92d333409e82de8cf770ba751c789a987fdcd3d57af46fb29661
.exe windows x86

65ecb434ff4cd23f5d776237f3cd179b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcmdln
_lock
_unlock
_exit
exit
__set_app_type
wcscat_s
__wgetmainargs
__dllonexit
_onexit
__setusermatherr
__p__commode
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
malloc
free
_purecall
??1type_info@@UAE@XZ
?terminate@@YAXXZ
wcsncmp
_controlfp
wcschr
??0exception@@QAE@XZ
memmove_s
_except_handler4_common
memcpy
_initterm
srand
wcsrchr
_wsplitpath_s
_wcsnicmp
calloc
fclose
fputws
??0exception@@QAE@ABV0@@Z
fopen_s
fflush
_wcsicmp
_wtol
_vsnwprintf
iswdigit
_cexit
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
__p__fmode
memcmp
?what@exception@@UBEPBDXZ
_amsg_exit
memcpy_s
memset

ntdll

EtwTraceMessage
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
NtSetInformationProcess
EtwUnregisterTraceGuids
EtwEventWrite
EtwEventUnregister
EtwEventRegister
EtwEventActivityIdControl
EtwEventEnabled
RtlNtStatusToDosError

api-ms-win-core-heap-l1-2-0

HeapFree
HeapSize
HeapReAlloc
HeapCreate
GetProcessHeap
HeapSetInformation
HeapAlloc
HeapDestroy

oleaut32

SysAllocStringLen
VariantClear
SysStringLen
SysAllocStringByteLen
SysFreeString
SysStringByteLen
SysAllocString
SysReAllocString

api-ms-win-core-interlocked-l1-2-0

InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-synch-l1-2-0

WaitForMultipleObjectsEx
CancelWaitableTimer
WaitForSingleObject
Sleep
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetWaitableTimer
EnterCriticalSection
InitializeCriticalSection
CreateEventW
SetEvent
CreateWaitableTimerExW

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

StringFromGUID2
IIDFromString
StringFromCLSID
CLSIDFromString
CoCreateInstance
CoInitializeSecurity
CoRevertToSelf
CoDisableCallCancellation
CoInitializeEx
CoEnableCallCancellation
CoUninitialize
CoCancelCall
CoImpersonateClient
CoDisconnectObject
CoTaskMemFree
CoMarshalInterface
CreateStreamOnHGlobal

api-ms-win-core-processthreads-l1-1-1

CreateThread
SetThreadPriority
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetStartupInfoW
GetCurrentThread
OpenThreadToken
SetProcessShutdownParameters
GetThreadPriority
ResumeThread
GetCurrentThreadId
CreateProcessW
GetExitCodeProcess

api-ms-win-core-libraryloader-l1-1-1

GetModuleHandleA
LoadLibraryExW
FreeLibrary
GetModuleHandleW
LoadStringW
GetModuleHandleExW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegQueryValueExW

api-ms-win-security-base-l1-2-0

IsValidSid
GetLengthSid
GetSecurityDescriptorSacl
GetSidSubAuthority
CreateWellKnownSid
SetSecurityDescriptorGroup
CopySid
SetSecurityDescriptorOwner
CheckTokenMembership
GetAclInformation
GetSecurityDescriptorControl
InitializeAcl
GetSecurityDescriptorGroup
MakeAbsoluteSD
SetSecurityDescriptorDacl
AddAce
InitializeSecurityDescriptor
InitializeSid
GetSidLengthRequired
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-debug-l1-1-1

OutputDebugStringA
DebugBreak

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-2-0

GetFileSizeEx
ReadFile
GetFileAttributesW
CreateFileW
CreateDirectoryW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW
SearchPathW
GetCurrentDirectoryW

rpcrt4

RpcStringFreeW
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcAsyncCompleteCall
RpcBindingSetAuthInfoExW
RpcBindingFree
I_RpcExceptionFilter
RpcAsyncInitializeHandle
NdrAsyncClientCall

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

bcrypt

BCryptCreateHash
BCryptDestroyHash
BCryptHashData
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsPrefixW
PathFileExistsW

api-ms-win-core-threadpool-legacy-l1-1-0

DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

kernel32

LocalAlloc
LocalFree

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Sections

.text
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

65ecb434ff4cd23f5d776237f3cd179b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-heap-l1-2-0

oleaut32

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

rpcrt4

api-ms-win-security-lsalookup-l2-1-0

bcrypt

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

kernel32

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-delayload-l1-1-1

Sections

.text Size: 150KB - Virtual size: 150KB

.data Size: 63KB - Virtual size: 62KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 37KB - Virtual size: 38KB

.text
Size: 150KB - Virtual size: 150KB

.data
Size: 63KB - Virtual size: 62KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 37KB - Virtual size: 38KB