0670c4fb71b177c5ff454980268ba0baaf7cbdb9ee5f56a0826cd5f684439cb5

Sharing

Copy URL Twitter E-mail

General

Target

0670c4fb71b177c5ff454980268ba0baaf7cbdb9ee5f56a0826cd5f684439cb5
Size

108KB
MD5

13d268c72481d455f9e5defa302a1630
SHA1

1677c86f8541d7302a60c82de0d6287dd2a746e6
SHA256

0670c4fb71b177c5ff454980268ba0baaf7cbdb9ee5f56a0826cd5f684439cb5
SHA512

ef3c0ca2f1ad4e4e73f459bd3cbabd349ddaa07c5b72ad9ffb811b2ce32a17f426c61c147e68121eea544b537cbf01af185dae91ffd0808a9d92a316d09d3185
SSDEEP

3072:Fs0FR+aRCY89xnVVSE1oPstUBzGQXOkrX:FDRtRC99vXWoQXOkrX

Score

N/A

Malware Config

Signatures

Files

0670c4fb71b177c5ff454980268ba0baaf7cbdb9ee5f56a0826cd5f684439cb5
.exe windows x86

5c867c91d02422a8e19a49c38847b608

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ifsutil

?IsArcSystemPartition@IFS_SYSTEM@@SGEPBVWSTRING@@PAE@Z
?CloseDriveHandle@DP_DRIVE@@QAEXXZ
?Initialize@VOL_LIODPDRV@@IAEEPBVWSTRING@@0PAVSUPERAREA@@PAVMESSAGE@@E@Z
?DiskCopyMainLoop@@YGHPBVWSTRING@@000EPAVMESSAGE@@1@Z
?AddEdge@DIGRAPH@@QAEEKK@Z
?Look@INTSTACK@@QBE?AVBIG_INT@@K@Z
?QueryPageSize@IFS_SYSTEM@@SGKXZ
?Remove@NUMBER_SET@@QAEEPBV1@@Z
?Write@IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?QueryDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?Initialize@READ_CACHE@@QAEEPAVIO_DP_DRIVE@@K@Z
?QuerySectors@DP_DRIVE@@UBE?AVBIG_INT@@XZ
?ChkDsk@VOL_LIODPDRV@@QAEEW4FIX_LEVEL@@PAVMESSAGE@@KKGPAKPBVWSTRING@@@Z
?AddNext@NUMBER_SET@@QAEEVBIG_INT@@@Z
?GetSortedFirst@TLINK@@QAEPAXXZ
?SetAutochkTimeOut@VOL_LIODPDRV@@SGEK@Z
??0LOG_IO_DP_DRIVE@@QAE@XZ
??1SUPERAREA@@UAE@XZ
?InvalidateVolume@IO_DP_DRIVE@@QAEEXZ
??1VOL_LIODPDRV@@UAE@XZ
?QuerySectorSize@DP_DRIVE@@UBEKXZ
??1INTSTACK@@UAE@XZ
?Set@BIG_INT@@QAEXEPBE@Z
?DeleteEntry@AUTOREG@@SGEPBVWSTRING@@0@Z
??0SECRUN@@QAE@XZ
??0READ_CACHE@@QAE@XZ
??1LOG_IO_DP_DRIVE@@UAE@XZ

icm32

CMCreateMultiProfileTransform
CMCheckColors
CMCheckColorsInGamut
CMConvertColorNameToIndex
CMCheckRGBs
CMGetNamedProfileInfo
CMTranslateRGBsExt
CMConvertIndexToColorName
CMTranslateRGBs
CMIsProfileValid
CMCreateProfile
CMCreateTransformW
CMCreateProfileW
CMCreateTransform
CMCreateTransformExtW
CMCreateTransformExt
CMGetInfo
CMDeleteTransform
CMTranslateRGB
CMTranslateColors
CMCreateDeviceLinkProfile

user32

FlashWindow
CharPrevW
WINNLSGetIMEHotkey
CreateIconFromResourceEx
DrawCaption
GetForegroundWindow
GetWindowPlacement
GetProcessWindowStation
DdeUnaccessData
GetClientRect
CascadeWindows
ShowStartGlass
FindWindowW
TabbedTextOutA
GetClipboardOwner
SetDlgItemInt
CreateIconIndirect
FindWindowA
CharToOemBuffW
EnumDesktopsW
GetThreadDesktop
MessageBoxExA
SetClipboardViewer
GetDesktopWindow
DdeNameService
OpenIcon

clb

ClbSetColumnWidths
ClbAddData
ClbWndProc
CustomControlInfoW
ClbStyleW

msdmo

DMOEnum
DMOUnregister
DMOGetName
MoCreateMediaType
MoCopyMediaType
MoFreeMediaType
DMOStrToGuidW
MoDuplicateMediaType
DMORegister
DMOGuidToStrW
MoInitMediaType
DMOStrToGuidA
DMOGuidToStrA
DMOGetTypes
MoDeleteMediaType

kernel32

GetCompressedFileSizeA
lstrlenA
CreateFileA
TerminateProcess
GetStartupInfoW
GetConsoleTitleA
WriteFile
GetConsoleWindow
GetSystemTime
CloseHandle
GetConsoleTitleW
GetFileAttributesW
VirtualAlloc

msvcrt

_wsystem
__RTtypeid
??0bad_cast@@QAE@ABQBD@Z
_wpgmptr
_outpw
_adj_fdiv_m64
__lc_collate_cp
wcscpy
longjmp
_XcptFilter
wcstok
strncmp
_ismbcl0
_strerror
_wctime64
_lrotl
_wtoi
_HUGE
setlocale
_ismbcalpha
__winitenv
_chkesp
fputs

ws2help

WahInsertHandleContext
WahCompleteRequest
WahOpenNotificationHandleHelper
WahNotifyAllProcesses
WahRemoveHandleContext
WahCreateSocketHandle
WahCloseApcHelper
WahCreateNotificationHandle
WahCloseHandleHelper
WahCreateHandleContextTable
WahQueueUserApc
WahOpenCurrentThread
WahCloseThread
WahEnableNonIFSHandleSupport
WahOpenApcHelper
WahCloseSocketHandle
WahEnumerateHandleContexts
WahOpenHandleHelper
WahDestroyHandleContextTable
WahCloseNotificationHandleHelper
WahWaitForNotification
WahDisableNonIFSHandleSupport
WahReferenceContextByHandle

ntdsapi

DsListDomainsInSiteW
DsReplicaUpdateRefsW
DsReplicaModifyW
DsFreeSpnArrayA
DsReplicaConsistencyCheck
DsReplicaSyncA
DsListServersInSiteA
DsQuoteRdnValueW
DsRemoveDsServerA
DsCrackNamesA
DsMapSchemaGuidsA
DsFreeDomainControllerInfoA
DsMakePasswordCredentialsW
DsListSitesA
DsListDomainsInSiteA
DsBindWithCredA
DsFreeSchemaGuidMapW
DsUnBindA
DsServerRegisterSpnW
DsReplicaFreeInfo
DsBindW
DsReplicaAddA
DsReplicaDelW
DsClientMakeSpnForTargetServerA
DsUnquoteRdnValueA
DsGetSpnW
DsLogEntry
DsFreeNameResultA
DsMakeSpnW
DsRemoveDsServerW
DsBindA
DsInheritSecurityIdentityW
DsCrackSpnW
DsInheritSecurityIdentityA
DsListSitesW
DsListRolesW

ole32

CoFreeAllLibraries
CoMarshalInterThreadInterfaceInStream
StgCreatePropStg
HBRUSH_UserUnmarshal
CoCreateObjectInContext
CoFileTimeToDosDateTime
CoGetInterfaceAndReleaseStream
CreateDataAdviseHolder
CLIPFORMAT_UserMarshal
CoGetContextToken
CoUnmarshalInterface
CoGetMalloc
CoFreeUnusedLibrariesEx
CoCancelCall
StgCreateDocfile
CreateAntiMoniker
HDC_UserMarshal
StgConvertVariantToProperty
SNB_UserMarshal
HENHMETAFILE_UserSize
HACCEL_UserSize
CoUnloadingWOW
CoInstall
CoTreatAsClass
CoRevokeClassObject
HWND_UserSize
HICON_UserMarshal
OleRegEnumVerbs
HkOleRegisterObject
HMETAFILE_UserMarshal
StgIsStorageFile
OleDestroyMenuDescriptor

shlwapi

PathStripPathW
StrTrimA
StrCmpIW
PathFindExtensionW
StrStrA
StrCSpnW
PathFindExtensionA
PathGetDriveNumberA
PathFindFileNameA
PathRemoveExtensionA
PathRemoveBlanksW
PathStripToRootW
StrTrimW
PathRemoveBlanksA
StrCmpW
PathSkipRootW
StrStrW
PathStripToRootA
StrStrIW
StrStrIA
PathSkipRootA
PathFindFileNameW

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c867c91d02422a8e19a49c38847b608

Headers

File Characteristics

Imports

ifsutil

icm32

user32

clb

msdmo

kernel32

msvcrt

ws2help

ntdsapi

ole32

shlwapi

Sections

.text Size: 61KB - Virtual size: 60KB

.data Size: 36KB - Virtual size: 35KB

.rsrc Size: 2KB - Virtual size: 1KB

.rdata Size: 8KB - Virtual size: 8KB

.text
Size: 61KB - Virtual size: 60KB

.data
Size: 36KB - Virtual size: 35KB

.rsrc
Size: 2KB - Virtual size: 1KB

.rdata
Size: 8KB - Virtual size: 8KB