1c7598bdb06eaf4c96a6e4ce23b2f1df3c68baf0841f30d95e3e4b9020ef605c

Sharing

Copy URL Twitter E-mail

General

Target

1c7598bdb06eaf4c96a6e4ce23b2f1df3c68baf0841f30d95e3e4b9020ef605c
Size

103KB
MD5

08a7715acbf4c8dfb1a29ed5e3fdcd0c
SHA1

fd62e08cec49cdfb350d6fad16194e0a8d94e8b8
SHA256

1c7598bdb06eaf4c96a6e4ce23b2f1df3c68baf0841f30d95e3e4b9020ef605c
SHA512

366c2f26c79f34b21483914caff2fc20e4137383ab52a4a9de520e88c0a7bb20496d778fc5eae187f4d504427f4c44bc4392ddda49c5a804379db98b23de5017
SSDEEP

1536:fh1ijKcLVGu4+pFemub0bnOWV4Vj/6QVghF4tCBtaRgIDcAGQfC:51iHnFeXb05yVjpVghF4tCfabcf

Score

N/A

Malware Config

Signatures

Files

1c7598bdb06eaf4c96a6e4ce23b2f1df3c68baf0841f30d95e3e4b9020ef605c
.exe windows x86

32ff99e8c35286fe4b60d7de7b48a7b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__setusermatherr
_c_exit
_itoa
toupper
towlower
wcsncat
wcschr
_wcsnicmp
free
strncpy
strtoul
strchr
__getmainargs
__initenv
exit
_cexit
??3@YAXPAX@Z
_initterm
sprintf
_exit
_XcptFilter
malloc
wcscmp
strrchr
memmove
_stricmp
wcsrchr
isdigit
_except_handler3
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
wcscat
memchr
_strcmpi
wcsncpy
_wcsicmp
wcscpy
wcslen
_snwprintf
??2@YAPAXI@Z
_snprintf
calloc

advapi32

DuplicateTokenEx
LookupAccountSidW
CryptAcquireContextW
CreateProcessAsUserW
CryptReleaseContext
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
LsaFreeMemory
ImpersonateLoggedOnUser
RevertToSelf
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
RegOpenKeyW
OpenProcessToken
LookupPrivilegeValueW
GetAce
CryptGenRandom
RegCreateKeyExW
RegSetKeySecurity
GetSecurityDescriptorLength
MakeSelfRelativeSD
ReportEventW
GetSidSubAuthority
RegOpenKeyExA
RegQueryValueExA
RegLoadKeyA
RegSetValueExW
RegCreateKeyA
AdjustTokenPrivileges
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LogonUserW
RegOpenKeyExW
RegQueryValueExW
RegisterEventSourceW
DeregisterEventSource
OpenThreadToken
AllocateAndInitializeSid
LookupAccountNameW
GetTokenInformation
EqualSid
RegCloseKey
FreeSid

kernel32

GetConsoleMode
CreateFileA
AllocConsole
FreeConsole
GetModuleFileNameA
lstrcpyW
TerminateProcess
SetEnvironmentVariableA
SetEnvironmentVariableW
GetExitCodeProcess
SetConsoleCtrlHandler
DuplicateHandle
GetCurrentProcess
GetCurrentThread
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
FormatMessageW
CreateEventW
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateNamedPipeW
HeapFree
HeapAlloc
GetProcessHeap
VirtualFree
VirtualAlloc
OpenProcess
ExpandEnvironmentStringsA
GetConsoleScreenBufferInfo
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
WaitForMultipleObjects
GetLastError
GetTickCount
GlobalFree
GlobalAlloc
SetLastError
SetHandleInformation
GetStdHandle
WideCharToMultiByte
GetConsoleCP
LoadLibraryW
GetSystemDirectoryW
lstrlenW
ReadFile
WriteFile
GetComputerNameW
GetLocalTime
CancelIo
lstrcpyA
lstrcatA
LocalFree
LocalAlloc
FormatMessageA
GetACP
GetOverlappedResult
ExitProcess
SetErrorMode
MultiByteToWideChar
GenerateConsoleCtrlEvent
SetConsoleScreenBufferSize
SetConsoleWindowInfo
LoadLibraryExW
CreateFileW
IsDBCSLeadByte
WriteConsoleInputA
ExpandEnvironmentStringsW
WriteConsoleW
ReadConsoleOutputA
ReadConsoleOutputW
WriteConsoleInputW

ntdll

RtlEqualUnicodeString
DbgPrint
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlInitUnicodeString

user32

VkKeyScanW
GetProcessWindowStation
wsprintfW
CharToOemA
LoadStringW
MapVirtualKeyW
CloseDesktop
OpenDesktopW
CloseWindowStation
SetUserObjectSecurity

oleaut32

VarDateFromUdate
VarBstrFromDate
SysFreeString

psapi

EnumProcesses

security

ImpersonateSecurityContext
RevertSecurityContext
AcceptSecurityContext
QuerySecurityPackageInfoW
DeleteSecurityContext
FreeCredentialsHandle
FreeContextBuffer
AcquireCredentialsHandleW

netapi32

NetGetAnyDCName
NetUserGetInfo
NetApiBufferFree

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCancelConnection2W
WNetAddConnection2W
WNetCloseEnum

ws2_32

WSASocketW
ioctlsocket
setsockopt
WSAStartup
closesocket
WSACleanup
getpeername
WSASetLastError
getservbyport
ntohs
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
shutdown
WSAGetLastError
inet_addr

shell32

SHGetFolderPathW

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xkwjlnq
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

32ff99e8c35286fe4b60d7de7b48a7b0

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

ntdll

user32

oleaut32

psapi

security

netapi32

mpr

ws2_32

shell32

Sections

.text Size: 56KB - Virtual size: 56KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 45KB - Virtual size: 46KB

xkwjlnq Size: - Virtual size: 4KB

.text
Size: 56KB - Virtual size: 56KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 45KB - Virtual size: 46KB

xkwjlnq
Size: - Virtual size: 4KB