462ee701c4f06165ccb9329771669702c644b659aeec862327909fb603e27764

Sharing

Copy URL Twitter E-mail

General

Target

462ee701c4f06165ccb9329771669702c644b659aeec862327909fb603e27764
Size

323KB
MD5

086789bc337dda0ddaab29887e89c2d0
SHA1

f5e97464b3303f7836048938dc829c0b07ad23d6
SHA256

462ee701c4f06165ccb9329771669702c644b659aeec862327909fb603e27764
SHA512

104196e14f4d4336e4610cfb42dab1f0ddfe7a4684ab7418a680f821a23bcc2fd0a86f4aefaedf3533013a6455bee34754e1da9b4f921fc9162f7b7753947a31
SSDEEP

6144:gILU50cDi8Ar3vLkf049n/m+GGv9uLrmSVqjy00BDxta+7SY2f263:g9GSOCunmKDBSn

Score

N/A

Malware Config

Signatures

Files

462ee701c4f06165ccb9329771669702c644b659aeec862327909fb603e27764
.exe windows x86

577ccb129f3ff548d539c307d8d0a191

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EventRegister
EventUnregister
EventWrite
RegGetValueW
CryptCreateHash
CryptHashData
CryptReleaseContext
CryptDestroyKey
CryptAcquireContextW
CryptDestroyHash
CryptVerifySignatureW
CryptImportKey

kernel32

CreateProcessW
TerminateProcess
WaitForSingleObject
TerminateThread
ResumeThread
WaitForMultipleObjects
QueryDosDeviceW
QueryFullProcessImageNameW
LoadLibraryW
ResetEvent
K32GetProcessImageFileNameW
CreateFileW
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
GetLastError
LocalFree
ProcessIdToSessionId
OpenProcess
K32EnumProcessModules
K32GetModuleBaseNameW
lstrcmpiW
K32EnumProcesses
CreateEventW
SetEvent
GetModuleHandleW
HeapSetInformation
PowerSetRequest
GetTickCount
Sleep
RaiseException
lstrlenW
SetLastError
GetVersion
GetSystemInfo
VirtualProtect
VirtualFree
VirtualAlloc
ReadFile
GetOverlappedResult
WriteFile
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemWindowsDirectoryW
GetProcAddress
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
GetWindowsDirectoryW
LoadLibraryExW
PowerCreateRequest
FreeLibrary
CreateThread
CloseHandle
LocalAlloc
GetCurrentProcessId

user32

MapVirtualKeyExW
LoadStringW
UnregisterDeviceNotification
PostMessageW
FindWindowW
SetWinEventHook
GetMessageW
IsWindowVisible
IsWindow
EnumWindows
TranslateMessage
DispatchMessageW
RegisterClassW
CreateWindowExW
RegisterDeviceNotificationW
ShowWindow
GetWindowTextW
SendMessageTimeoutW
GetForegroundWindow
SetForegroundWindow
GetWindowThreadProcessId
UnhookWinEvent
DefWindowProcW
GetKeyboardLayout
PostQuitMessage

msvcrt

_exit
_cexit
__wgetmainargs
malloc
_callnewh
free
memcpy
wcschr
??0exception@@QAE@XZ
_wcsnicmp
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memcpy_s
memmove_s
_vsnwprintf
memset
__CxxFrameHandler3
_wcsicmp
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_purecall
_unlock
_controlfp
__dllonexit
_lock
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
_XcptFilter

crypt32

CertVerifyCertificateChainPolicy
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CryptHashPublicKeyInfo
CertFreeCertificateChain
CertGetCertificateChain
CryptDecodeObjectEx
CertAddEncodedCertificateToStore
CryptDecodeObject
CertFreeCertificateContext

ntdll

NtOpenProcess
NtQueryVirtualMemory

oleaut32

SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen

qwave

QOSCloseHandle
QOSCreateHandle
QOSStartTrackingClient
QOSStopTrackingClient

secur32

GetUserNameExW

setupapi

SetupDiOpenDeviceInterfaceW
SetupDiEnumDeviceInterfaces
SetupDiGetDevicePropertyW
SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW

shell32

SHGetFolderPathW

shlwapi

PathFindFileNameW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winsta

WinStationFreeUserCertificates
WinStationServerPing
WinStationUnRegisterNotificationEvent
WinStationRegisterNotificationEvent
WinStationGetUserCertificates

wintrust

CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATClose
CryptCATAdminReleaseContext
CryptCATOpen
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATGetMemberInfo
WinVerifyTrust

ws2_32

htonl
htons

wtsapi32

WTSRegisterSessionNotification
WTSLogoffSession
WTSQuerySessionInformationW
WTSVirtualChannelClose
WTSVirtualChannelQuery
WTSFreeMemory
WTSVirtualChannelOpen

sqmapi

SqmSet
SqmAddToStreamDWord
SqmAddToStreamString
SqmGetSession

Sections

.text
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

577ccb129f3ff548d539c307d8d0a191

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

crypt32

ntdll

oleaut32

qwave

secur32

setupapi

shell32

shlwapi

version

winsta

wintrust

ws2_32

wtsapi32

sqmapi

Sections

.text Size: 222KB - Virtual size: 222KB

.data Size: 46KB - Virtual size: 46KB

.rsrc Size: 26KB - Virtual size: 26KB

.reloc Size: 26KB - Virtual size: 29KB

.text
Size: 222KB - Virtual size: 222KB

.data
Size: 46KB - Virtual size: 46KB

.rsrc
Size: 26KB - Virtual size: 26KB

.reloc
Size: 26KB - Virtual size: 29KB