001c199385fe94fc67c4380f8403a7f744616ad1ca7bae6b6f17d4d9b1fa8c5a

Sharing

Copy URL Twitter E-mail

General

Target

001c199385fe94fc67c4380f8403a7f744616ad1ca7bae6b6f17d4d9b1fa8c5a
Size

740KB
MD5

04787a1356f6bdce4a511bd6d19d1dc0
SHA1

08938846777d3ca72ad5a469cb00971518e3701f
SHA256

001c199385fe94fc67c4380f8403a7f744616ad1ca7bae6b6f17d4d9b1fa8c5a
SHA512

d06f572c9da5bb3e6d9de127a2e27bd4ae75fe06757917bc6167ac1549c7c401f4f126c0f798a4a47e4502fc46cbdc2c77d4476e8001038038c0f9bdb600bd8d
SSDEEP

12288:JVmSR8cO3sjlDnAksG5mN+5dssJqtTFDG97ZGPoavj672khFMJWtkfcwzFsImhns:JQSR8cO2NsG5mNg29tTF69GLvj1c5tiD

Score

N/A

Malware Config

Signatures

Files

001c199385fe94fc67c4380f8403a7f744616ad1ca7bae6b6f17d4d9b1fa8c5a
.exe windows x86

de554119dc8e7cc89c7cae0fbabf4ce2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
GetCurrentThread
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
CreateSemaphoreW
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
LCMapStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
LocalFree
CreateDirectoryW
WideCharToMultiByte
DeleteFileW
RemoveDirectoryW
WaitForMultipleObjects
LoadLibraryW
WaitForSingleObject
GetExitCodeProcess
DuplicateHandle
ReleaseMutex
GetEnvironmentVariableW
lstrcmpiW
VirtualQuery
GetTempPathW
GetLocalTime
OutputDebugStringA
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcmpW
lstrlenW
SetFilePointer
CreateMutexW
InitializeCriticalSection
TryEnterCriticalSection
SetEvent
ResetEvent
MultiByteToWideChar
GetFileAttributesExW
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
MoveFileExW
GetFileTime
ReadFile
DeviceIoControl
SetProcessWorkingSetSize
OpenProcess
CreateProcessW
ReadProcessMemory
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CreateThread
DebugActiveProcess
GetThreadContext
DebugActiveProcessStop
VirtualQueryEx
GetProcessId
GetSystemInfo
ContinueDebugEvent
WaitForDebugEvent
GetProcAddress
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
GetCommandLineW
EncodePointer
LeaveCriticalSection
EnterCriticalSection
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
RtlCaptureContext
ReleaseSemaphore
OutputDebugStringW
DeleteCriticalSection
DecodePointer
HeapSize
GetLastError
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
HeapAlloc
IsDebuggerPresent
GetUserDefaultLangID
GetSystemDefaultLangID
GetComputerNameExW
GetOverlappedResult
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
UnregisterWait
GetProcessTimes
UnregisterWaitEx
RegisterWaitForSingleObject
VirtualProtect
VirtualAlloc
HeapReAlloc

user32

SetClipboardData
EmptyClipboard
OpenClipboard
EnumWindows
CloseClipboard
wsprintfW
CharUpperW
wvsprintfW
DispatchMessageW
GetMessageW
PeekMessageW
IsWindowVisible
GetWindowThreadProcessId
MessageBoxW
GetProcessWindowStation
PostThreadMessageW
SetThreadDesktop
CreateWindowStationW
CloseWindowStation
CharLowerW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
CloseDesktop

advapi32

SetTokenInformation
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
InitializeSecurityDescriptor
MakeAbsoluteSD
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetAce
MakeSelfRelativeSD
GetSecurityDescriptorLength
EqualSid
SetNamedSecurityInfoW
ConvertStringSidToSidW
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
ConvertSidToStringSidW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent

ole32

CoCreateGuid
StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetWkstaGetInfo
NetApiBufferFree

rpcrt4

UuidCreate

shlwapi

PathRemoveExtensionW
PathRemoveFileSpecW
PathStripPathW
PathCanonicalizeW
PathIsRelativeW
PathAppendW
SHQueryValueExW

userenv

UnloadUserProfile

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

de554119dc8e7cc89c7cae0fbabf4ce2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

shell32

netapi32

rpcrt4

shlwapi

userenv

version

Sections

.text Size: 154KB - Virtual size: 154KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 6KB - Virtual size: 18KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 9KB - Virtual size: 8KB

.vmp0 Size: 508KB - Virtual size: 1.6MB

.text
Size: 154KB - Virtual size: 154KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 6KB - Virtual size: 18KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 9KB - Virtual size: 8KB

.vmp0
Size: 508KB - Virtual size: 1.6MB