61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a

Sharing

Copy URL Twitter E-mail

General

Target

61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a
Size

50KB
MD5

0e21ebc6d9a6cc23115851f82772abf0
SHA1

f85120a29b3f500b6e55234aaabcbeeba8c4b44e
SHA256

61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a
SHA512

a9927e936abcca448f78d641d9ecdc157680ca175a0ec95636e890c484ae5eb6959243280019eb77cbf3c7def3fde3b68b78cbc1d336b92983c455eb9a9cd9ef
SSDEEP

768:C3Q6RkIXG906uKRS99MWSzuqfgS8agHZVVjjefk6PUzK:e+IXF6nSW8vXwf

Score

N/A

Malware Config

Signatures

Files

61ed0bed6bb53181860d16a9e2aa85f824476e7f3abe8392f7e110b536f3311a
.exe windows x86

a9346d48337f3ab8d85747011b190296

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winsta

WinStationEnumerateW
WinStationEnumerateProcesses
WinStationGetAllProcesses
WinStationFreeMemory
WinStationFreeGAPMemory
WinStationOpenServerW
WinStationQueryInformationW

utildll

GetUnknownString

user32

OemToCharBuffW
CharToOemW
LoadStringW

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcess
GetModuleHandleW
SetThreadUILanguage
WideCharToMultiByte
GetConsoleOutputCP
GetLastError
SetFileApisToOEM
HeapSetInformation
CloseHandle
GetCurrentProcessId
VerSetConditionMask
VerifyVersionInfoW
FreeLibrary
LoadLibraryW
FormatMessageW
WriteConsoleW
MultiByteToWideChar
GetStdHandle
SetLastError
GetFileType
GetACP
LocalAlloc
GetOEMCP
LocalFree
GetCommandLineW
FindFirstFileW
GetFileAttributesW
FindClose
FindNextFileW
GetTickCount
GetSystemTimeAsFileTime
Sleep

ntdll

RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
CopySid
EqualSid
GetLengthSid
LookupAccountSidW
OpenProcessToken

msvcrt

_wsetlocale
wcscpy_s
_wcsicmp
free
malloc
wcstol
iswdigit
wcschr
vfwprintf
fwprintf
vswprintf_s
_ultoa
wcscat_s
_wcsnicmp
wprintf
printf
memmove
wcstoul
_wcsdup
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
?terminate@@YAXXZ
_controlfp
_except_handler4_common
setlocale
_iob
fprintf
_wcslwr
swprintf_s
memcpy
memset

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wrcouju
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a9346d48337f3ab8d85747011b190296

Headers

DLL Characteristics

File Characteristics

Imports

winsta

utildll

user32

kernel32

ntdll

advapi32

msvcrt

Sections

.text Size: 14KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 6KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 29KB - Virtual size: 30KB

wrcouju Size: - Virtual size: 4KB

.text
Size: 14KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 6KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 29KB - Virtual size: 30KB

wrcouju
Size: - Virtual size: 4KB