c3d527c91ca8c0771bd18a948a11bf09eb5df2d69bb18816a4913be1d7d01a66

Sharing

Copy URL

Twitter E-mail

General

Target

c3d527c91ca8c0771bd18a948a11bf09eb5df2d69bb18816a4913be1d7d01a66
Size

813KB
MD5

a0ff4cbf9e0a639804ea1ee83f75a370
SHA1

a2ea2bb5063d4876475ffd8bf7f64394b399883e
SHA256

c3d527c91ca8c0771bd18a948a11bf09eb5df2d69bb18816a4913be1d7d01a66
SHA512

0214d739a7d3d7728fc7f4533275be7b0d82594706466d0c1f8d241e47989d7c240da4a4e46ef2af4d821997e7e8534b30c2f648356698f4671aee36940c3c15
SSDEEP

24576:V07MoZVSKMNHSWEwQmsgMDLI8EDJzQlmgOUeKgPYQXg:V0woZVTMNHSWEwQmsgMPI8EDJImgOJn8

Score

N/A

Malware Config

Signatures

Files

c3d527c91ca8c0771bd18a948a11bf09eb5df2d69bb18816a4913be1d7d01a66
.exe windows x64

68e56344cab250384904953e978b70a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventWrite
ImpersonateLoggedOnUser
OpenProcessToken
DuplicateTokenEx
AdjustTokenPrivileges
EventRegister
EventUnregister
RevertToSelf
GetTokenInformation
CreateWellKnownSid
IsValidSid
SetTokenInformation
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
OpenSCManagerW
StartServiceW
ControlService
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession

kernel32

CallbackMayRunLong
OpenProcess
TrySubmitThreadpoolCallback
IsWow64Process
GetPriorityClass
GetTimeFormatW
GetExitCodeThread
GetTempPathW
CreateFileW
DuplicateHandle
GetModuleFileNameW
LocalFree
GetLogicalProcessorInformationEx
GetNumaHighestNodeNumber
SetEvent
CreateToolhelp32Snapshot
Thread32First
OpenThread
Thread32Next
Sleep
lstrcmpW
GetComputerNameW
GetCommandLineW
LoadLibraryExA
DelayLoadFailureHook
ReadProcessMemory
lstrcmpiW
CompareStringW
lstrlenW
GetLocaleInfoW
GetNumberFormatW
GetTickCount
HeapSize
MulDiv
HeapReAlloc
FormatMessageW
CloseThreadpoolCleanupGroup
SetProcessShutdownParameters
CreateEventW
CreateThreadpoolCleanupGroup
GetErrorMode
SetErrorMode
GetCurrentProcessId
ProcessIdToSessionId
SetPriorityClass
DeviceIoControl
SetLastError
LockResource
LoadResource
FindResourceExW
HeapSetInformation
CreateMutexW
FreeLibrary
GetProcAddress
LoadLibraryW
GetVersionExW
WaitForSingleObject
CreateProcessW
ExpandEnvironmentStringsW
CreateThread
CloseHandle
ReleaseMutex
CloseThreadpoolCleanupGroupMembers
GetCurrentDirectoryW
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
HeapFree
GetProcessHeap
HeapAlloc
GetLastError
QueryFullProcessImageNameW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW

gdi32

SetBkMode
GetCurrentObject
GetObjectW
CreateFontIndirectW
GetCharWidth32W
CreateCompatibleBitmap
SetBkColor
DeleteDC
CreateCompatibleDC
SetTextColor
GetDeviceCaps
Rectangle
BitBlt
LineTo
MoveToEx
SelectObject
DeleteObject
GetStockObject
CreatePen

user32

SendMessageTimeoutW
SetProcessDPIAware
RegisterWindowMessageW
MessageBoxW
CreateDialogParamW
ChangeWindowMessageFilterEx
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
LoadMenuW
RemoveMenu
DestroyMenu
CreateWindowExW
DrawTextW
InvalidateRect
UpdateWindow
GetWindowLongPtrW
GetSysColor
GetDlgCtrlID
EnableMenuItem
AppendMenuW
DialogBoxParamW
SetScrollInfo
GetScrollInfo
SetScrollPos
EndDialog
GetSystemMetrics
GetGuiResources
EnableWindow
TrackPopupMenuEx
GetWindowTextW
SetDlgItemTextW
IsHungAppWindow
SetThreadDesktop
IsWindowVisible
EndTask
AllowSetForegroundWindow
EnumDesktopsW
GetProcessWindowStation
OpenDesktopW
EnumDesktopWindows
CloseDesktop
GetWindow
InternalGetWindowText
ShowWindowAsync
SetMenuDefaultItem
GetLastActivePopup
IsWindow
SwitchToThisWindow
TileWindows
GetDesktopWindow
CascadeWindows
PeekMessageW
GetCursorPos
CheckDlgButton
IsDlgButtonChecked
GetWindowTextLengthW
SetCursor
LoadCursorW
SetRect
MsgWaitForMultipleObjects
FindWindowW
SetFocus
GetNextDlgTabItem
GetClassNameW
GetFocus
GetParent
GetMonitorInfoW
MonitorFromPoint
LoadAcceleratorsW
PostQuitMessage
MessageBeep
RedrawWindow
MoveWindow
GetClassLongPtrW
GetWindowThreadProcessId
DefWindowProcW
GetMenuItemID
GetSubMenu
IsZoomed
IsIconic
SetForegroundWindow
OpenIcon
KillTimer
DestroyWindow
PostMessageW
LoadImageW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ShowWindow
GetShellWindow
SetWindowLongPtrW
GetMenuItemInfoW
SetTimer
LoadIconW
GetThreadDesktop
GetDialogBaseUnits
GetWindowRect
PostThreadMessageW
GetForegroundWindow
SendMessageW
MapWindowPoints
GetDlgItem
SetMenu
SetWindowPos
DeleteMenu
CheckMenuItem
CheckMenuRadioItem
GetMenu
SetWindowTextW
LoadStringW
RegisterClassW
GetClassInfoW
ReleaseDC
GetDC
SystemParametersInfoW
GetKeyState
CallWindowProcW
GetSysColorBrush
FillRect
GetClientRect
GhostWindowFromHungWindow
HungWindowFromGhostWindow
SetWindowLongW
GetWindowLongW
DestroyIcon

msvcrt

?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_XcptFilter
__C_specific_handler
__wgetmainargs
_wtol
??3@YAXPEAX@Z
swscanf_s
memmove
_ui64tow_s
wcsstr
_i64tow_s
_wcsicmp
wcsrchr
_vsnwprintf
_wcsdup
??2@YAPEAX_K@Z
memset
_exit
memcpy
free
towlower

iphlpapi

GetIfEntry2
NhGetInterfaceNameFromDeviceGuid
GetAdaptersAddresses

comctl32

CreateStatusWindowW
ord17
ord345
ord334
ord336
ord338
ord328
ord329
ord331
ImageList_Remove
ImageList_ReplaceIcon
ord337
ImageList_SetIconSize
ImageList_Create

pcwum

PcwCollectData
PcwAddQueryItem
PcwCreateQuery

shlwapi

StrFormatByteSizeW
ord16
PathAddExtensionW
PathRemoveExtensionW
PathAppendW
StrStrW
ord348
ord618
ord437
ord158

shell32

ord61
ShellAboutW
ShellExecuteExW
ord245
ord75
SHParseDisplayName
SHOpenFolderAndSelectItems
CommandLineToArgvW
ord100
DuplicateIcon
Shell_NotifyIconW

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlTryEnterCriticalSection
NtSetInformationFile
NtSetInformationProcess
NtOpenProcessToken
NtOpenThreadToken
NtOpenFile
RtlTimeToElapsedTimeFields
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtQueryInformationProcess
NtQueryTimerResolution
RtlInitUnicodeString
RtlNtStatusToDosError
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtQuerySystemInformation
WinSqmAddToStream
NtQueryInformationToken
NtClose

secur32

GetUserNameExW

uxtheme

IsThemeActive
SetWindowTheme

wevtapi

EvtSubscribe
EvtClose

credui

CredUIPromptForCredentialsW

Sections

.text
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 564KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

68e56344cab250384904953e978b70a9

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

iphlpapi

comctl32

pcwum

shlwapi

shell32

ntdll

secur32

uxtheme

wevtapi

credui

Sections

.text Size: 152KB - Virtual size: 152KB

.data Size: 2KB - Virtual size: 15KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 89KB - Virtual size: 89KB

.reloc Size: 564KB - Virtual size: 2.5MB

.text
Size: 152KB - Virtual size: 152KB

.data
Size: 2KB - Virtual size: 15KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 89KB - Virtual size: 89KB

.reloc
Size: 564KB - Virtual size: 2.5MB