c2990141f8578d5c85143cfee7cce055d0fcb44db52358714225d42730fcab90

Sharing

Copy URL Twitter E-mail

General

Target

c2990141f8578d5c85143cfee7cce055d0fcb44db52358714225d42730fcab90
Size

191KB
MD5

1301ed9f72426b2ea538138167a560c0
SHA1

71ca96b5a3154f74456eb37c5d811d30edb5fdf6
SHA256

c2990141f8578d5c85143cfee7cce055d0fcb44db52358714225d42730fcab90
SHA512

a33a6ee32d66334f32b12ad15324eac31a407716f81271bac46ca4babd3d5f87c4bcc4838f4bf47cd0caa9cb6a99ff24665d9643e45ad8f8514629b4495b027f
SSDEEP

3072:tFaU7odbD5JOTgE121s1MgPdSgUyl+geSwm7FScufrtYdABHdVnlnSm2/:tFaUMdbDn6ytH1SwmpSZYdS9JlnSmc

Score

N/A

Malware Config

Signatures

Files

c2990141f8578d5c85143cfee7cce055d0fcb44db52358714225d42730fcab90
.exe windows x86

5954da1a30a6179205b53db4eb2c75c8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetNamedPipeHandleState
GetExitCodeProcess
GetVersionExW
LocalAlloc
GetCurrentProcess
GetPrivateProfileIntW
WideCharToMultiByte
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
TransactNamedPipe
LCMapStringW
GetStringTypeW
CreateFileW
WaitNamedPipeW
InterlockedExchange
PostQueuedCompletionStatus
GetQueuedCompletionStatus
WriteFile
CreateNamedPipeW
CreateIoCompletionPort
ReadFile
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
GetLastError
LoadLibraryW
CopyFileW
GetTempPathW
GetTickCount
GetModuleHandleW
GetStartupInfoW
LocalFree
GetModuleFileNameW
Sleep
CreateThread
DeleteCriticalSection
WaitForSingleObject
InterlockedIncrement
QueueUserWorkItem
InitializeCriticalSection
DeleteFileW
WaitForMultipleObjects
InterlockedDecrement
UnregisterWaitEx
LeaveCriticalSection
EnterCriticalSection
GetCommandLineW
LoadLibraryA
GetProcAddress
FreeLibrary
CreateProcessW
CreateToolhelp32Snapshot
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentProcessId
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
CloseHandle
GetCurrentThreadId
MultiByteToWideChar
HeapCreate
HeapSetInformation
RtlUnwind
RaiseException
DecodePointer
EncodePointer
HeapAlloc
HeapReAlloc
HeapFree
SetUnhandledExceptionFilter
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
WriteConsoleW

user32

TranslateMessage
PostThreadMessageW
GetMessageW
DefWindowProcW
DispatchMessageW
LoadStringW
RegisterClassW
CreateWindowExW

shell32

CommandLineToArgvW
ShellExecuteW
ShellExecuteExW

advapi32

SetEntriesInAclW
StartServiceCtrlDispatcherW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
StartServiceW
CreateServiceW
ChangeServiceConfig2W
OpenSCManagerW
OpenServiceW
DeleteService
RegCreateKeyExW
RegSetValueExW
CloseServiceHandle
SetServiceStatus
ControlService
QueryServiceStatus
QueryServiceObjectSecurity
GetSecurityDescriptorDacl
CreateWellKnownSid
LookupAccountSidW
BuildExplicitAccessWithNameW
SetServiceObjectSecurity
CreateProcessAsUserW
DuplicateToken
DuplicateTokenEx
OpenProcessToken
EqualSid
IsValidSid
CheckTokenMembership
GetSidSubAuthority
AllocateAndInitializeSid
GetLengthSid
FreeSid
SetTokenInformation
RegisterServiceCtrlHandlerW

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveExtensionW
PathIsRelativeW
PathAddExtensionW
PathRemoveFileSpecW
PathAppendW

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

crypt32

CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore

wintrust

WinVerifyTrust

Exports

Exports

GetHostInterface

Sections

.text
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5954da1a30a6179205b53db4eb2c75c8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

advapi32

shlwapi

userenv

crypt32

wintrust

Exports

Exports

Sections

.text Size: 86KB - Virtual size: 86KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 17KB - Virtual size: 16KB

.reloc Size: 10KB - Virtual size: 12KB

.text
Size: 86KB - Virtual size: 86KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 17KB - Virtual size: 16KB

.reloc
Size: 10KB - Virtual size: 12KB