d2f278bb767f746e67d70b4e342b35746306098d0f222e292620daef7c06e68f

Sharing

Copy URL Twitter E-mail

General

Target

d2f278bb767f746e67d70b4e342b35746306098d0f222e292620daef7c06e68f
Size

275KB
MD5

0c273266142060ef9e51f26b2a39db37
SHA1

13e1f5ceb567169a1e28f7fed51d3503fd2d7107
SHA256

d2f278bb767f746e67d70b4e342b35746306098d0f222e292620daef7c06e68f
SHA512

f1a5fcfbf3bc43d532df800cf423c7ff5b1bfa385e5d1cca2268abdf00a7f67835bb0d02ea19921cd6be79773af63882162258d05a10acaa6204ac32f30dc12f
SSDEEP

6144:E2DOMjX+pd1bEz2s7ETRhEgjJqX+pd1bEz2s7ETRhEgjJSo:E2tjX+pd167QhE0qX+pd167QhE0L

Score

N/A

Malware Config

Signatures

Files

d2f278bb767f746e67d70b4e342b35746306098d0f222e292620daef7c06e68f
.exe windows x86

bb345d01bad9d1211fc97e067a2c7f77

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
GetTokenInformation
OpenProcessToken
RegCreateKeyW
RegEnumValueW
RegSetValueExA
RegQueryValueExA
RegQueryValueExW
RegCreateKeyA
RegOpenKeyExA
ConvertStringSidToSidW
EqualSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
CreateWellKnownSid
GetSidSubAuthorityCount
InitializeAcl
GetLengthSid
IsValidSid
CopySid
GetAce
SetSecurityInfo
GetKernelObjectSecurity
GetSecurityDescriptorSacl
GetSidSubAuthority

kernel32

HeapFree
GetFileAttributesW
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
SetProcessShutdownParameters
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DuplicateHandle
OpenProcess
CreateFileW
DeleteFileW
lstrcmpiW
lstrlenW
lstrcmpiA
lstrlenA
CreateProcessW
LoadLibraryExW
LocalAlloc
DeleteFileA
SetFileAttributesA
FindClose
FindNextFileA
lstrcmpA
FindFirstFileA
RemoveDirectoryA
CreateDirectoryExA
GetFileAttributesA
GetTempPathA
CopyFileW
InterlockedCompareExchange
GetExitCodeThread
GetCurrentProcess
GetModuleHandleW
HeapAlloc
LoadLibraryW
GetProcAddress
FreeLibrary
SetEvent
WaitForSingleObject
CloseHandle
CreateThread
InterlockedDecrement
InterlockedIncrement
GetLastError
GetProcessHeap
GetModuleFileNameW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
CreateEventW
HeapSetInformation
LocalFree

user32

CharNextW
LoadStringW
PostQuitMessage

msvcrt

_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
wcsrchr
_vsnprintf
_vsnwprintf
memset
wcstok
_wcsnicmp
__wgetmainargs

ole32

CoUninitialize
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
CoInitialize
CoGetCallContext
CoTaskMemFree
CoTaskMemAlloc
CoImpersonateClient
CoRevertToSelf
CoCreateInstance
CoRegisterClassObject
CoRevokeClassObject

oleaut32

SysAllocString
SysStringLen
SysFreeString

psapi

GetModuleBaseNameW

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

urlmon

Extract
CoInternetCreateSecurityManager
ord107
CoInternetSetFeatureEnabled

wintrust

CryptCATAdminAcquireContext
CryptCATAdminAddCatalog
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bb345d01bad9d1211fc97e067a2c7f77

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

psapi

rpcrt4

urlmon

wintrust

Sections

.text Size: 43KB - Virtual size: 43KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 194KB - Virtual size: 193KB

.reloc Size: 25KB - Virtual size: 30KB

.text
Size: 43KB - Virtual size: 43KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 194KB - Virtual size: 193KB

.reloc
Size: 25KB - Virtual size: 30KB