011c294f224d631681c29542fa0786c5d526c0a6d039537cb38fbfef12fc9470

Sharing

Copy URL Twitter E-mail

General

Target

011c294f224d631681c29542fa0786c5d526c0a6d039537cb38fbfef12fc9470
Size

649KB
MD5

8351caf0643b549e4cebf0a8ba4c6639
SHA1

d63d050f35f39caaf9a8dc4ee58dd23a29608e46
SHA256

011c294f224d631681c29542fa0786c5d526c0a6d039537cb38fbfef12fc9470
SHA512

d2ec446236e3b1f38ab7ed7c592884b486abfb920ddfd5e504f27eb76b91785306cb624d722b916ceb35a4d0ee2e993f4b05140465ee5a1f0a70066f5602a6a0
SSDEEP

12288:aBj0rm4MIlW/dV4ecK4LQlD/qji2HwrU3UtEx:o0udX49iD/qWNUUu

Score

N/A

Malware Config

Signatures

Files

011c294f224d631681c29542fa0786c5d526c0a6d039537cb38fbfef12fc9470
.exe windows x64

a52bc3ed99ad03a1c7f549e9d94fb14c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnprintf
??1type_info@@UEAA@XZ
iswspace
_wtoi
memset
__CxxFrameHandler3
memcpy
towlower
memmove
isspace
tolower
_purecall
wcsrchr
_vsnwprintf
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_wcsicmp
wcschr
_wcsnicmp
_wtoi64
_vscwprintf
wcsncmp
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_CxxThrowException

advapi32

DeregisterEventSource
ReportEventW
RegisterEventSourceW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
TraceMessage
EventRegister
EventUnregister
EventWrite
RegSetKeyValueW
RegGetValueW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegOpenKeyExW
RegDeleteValueW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
RegQueryValueExW

kernel32

WaitForSingleObject
CloseHandle
MapViewOfFile
OpenThread
SetEvent
TerminateProcess
ReleaseMutex
CreateProcessW
GetUserDefaultUILanguage
MultiByteToWideChar
GetThreadId
UnmapViewOfFile
GetWindowsDirectoryW
GetLogicalDriveStringsW
QueryDosDeviceW
GetProcAddress
FreeLibrary
GetDriveTypeW
FindFirstFileNameW
FindNextFileNameW
FindClose
CreateToolhelp32Snapshot
GetProcessId
Module32FirstW
Module32NextW
K32EnumProcessModules
K32GetModuleFileNameExW
LoadLibraryW
GlobalMemoryStatus
ReadProcessMemory
OpenEventW
GetVersionExW
IsWow64Process
GetLastError
LoadLibraryExW
DuplicateHandle
GetExitCodeThread
GetModuleHandleExW
FreeLibraryAndExitThread
DebugBreak
SystemTimeToFileTime
GetSystemTime
GetProcessTimes
GetApplicationRestartSettings
GetFileAttributesW
CreateFileW
OpenMutexW
CreateFileMappingW
GetSystemDirectoryW
GetSystemWow64DirectoryW
LocalFree
UnhandledExceptionFilter
GetCurrentProcess
CreateThread
lstrlenW
DeleteFileW
WriteProcessMemory
OutputDebugStringA
CreateEventW
VirtualAllocEx
GetCommandLineW
HeapSetInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
VirtualAlloc
VirtualFreeEx
VirtualFree
CreateMutexW
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
SearchPathW
GetFileSize
ExpandEnvironmentStringsW
WaitForMultipleObjects
SetEnvironmentVariableW

user32

LoadStringW
GetProcessWindowStation
GetThreadDesktop
GetUserObjectInformationW
IsWindow

ntdll

NtSuspendProcess
NtResumeProcess
WinSqmAddToStream
RtlAllocateHeap
RtlFreeHeap
NtQuerySystemInformation
RtlAdjustPrivilege
RtlGetCurrentTransaction
RtlSetCurrentTransaction
RtlDetermineDosPathNameType_U
NtWaitForMultipleObjects
RtlGetUnloadEventTraceEx
RtlImageNtHeaderEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
DbgPrint
RtlInitUnicodeString
NtSetSystemInformation
EtwTraceMessage
NtClose
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
RtlAllocateAndInitializeSid
NtWaitForSingleObject
NtOpenEvent
RtlNtStatusToDosError
EtwEventWriteNoRegistration
NtQueryInformationProcess
NtQueryInformationThread

wer

WerpSetCallBack
WerReportAddDump
WerReportSetParameter
WerpCreateIntegratorReportId
WerpSetIntegratorReportId
WerpFreeString
WerpGetReportFlags
WerpIsTransportAvailable
WerReportSetUIOption
WerpAddSecondaryParameter
WerReportAddFile
WerpSetReportFlags
WerpPromtUser
WerpAddTextToReport
WerReportCloseHandle
WerReportSubmit
WerpAddAppCompatData
WerReportCreate

shell32

SHGetFolderPathW
CommandLineToArgvW
SHCreateDirectoryExW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 674B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a52bc3ed99ad03a1c7f549e9d94fb14c

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

user32

ntdll

wer

shell32

version

Sections

.text Size: 136KB - Virtual size: 135KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 674B

.vmp0 Size: 500KB - Virtual size: 1.8MB

.text
Size: 136KB - Virtual size: 135KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 674B

.vmp0
Size: 500KB - Virtual size: 1.8MB