a26dbbacc16031b6b4f3f0f27a48f6318c0ff400b5f93d069bf6496b71568381

Sharing

Copy URL Twitter E-mail

General

Target

a26dbbacc16031b6b4f3f0f27a48f6318c0ff400b5f93d069bf6496b71568381
Size

54KB
MD5

074e6557f3df8dcda621dcf8cb698440
SHA1

d5d6debca2d92e0f9d2118a9310a4c90d5563a1d
SHA256

a26dbbacc16031b6b4f3f0f27a48f6318c0ff400b5f93d069bf6496b71568381
SHA512

9b29ee1db7d39bc87a13429306cb3f9922bf1179765104267c9c035e89118b93cf9bad3a7dfe19bb01aaf06f19feccd42d8c14d54c57d8789e04da8b842a67d2
SSDEEP

768:QpnkR6TpGRFxkGtqQK2DsVbrHiyyjuqHBCZQQThM2wBtTVZ8SPotmfa2XkO:InaEGyGZs5Nt62MzB

Score

N/A

Malware Config

Signatures

Files

a26dbbacc16031b6b4f3f0f27a48f6318c0ff400b5f93d069bf6496b71568381
.exe windows x86

6be84b25ed346af1ddd1450a9c5267a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
GetTokenInformation
CredpEncodeSecret
CredRestoreCredentials
CredBackupCredentials

kernel32

LocalFree
LocalAlloc
GetFileSizeEx
CreateThread
DuplicateHandle
CreateFileW
SetEvent
GlobalFree
GetCommandLineW
HeapSetInformation
CreateEventW
WriteFile
OpenProcess
DeleteFileW
GetTempFileNameW
WaitForMultipleObjects
SleepEx
GetOverlappedResult
CloseHandle
GetLastError
GetTempPathW
FormatMessageW
HeapFree
GetProcessHeap
HeapAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
CancelIo
ReadFile
SetLastError

gdi32

GetObjectW
CreateFontIndirectW

user32

EnableWindow
SetFocus
SendMessageW
GetDlgItem
PostMessageW
GetDlgItemTextW
ShowWindow
SetWindowTextW
LoadStringW
CheckRadioButton
SetWindowLongW
GetWindowLongW
GetParent
SendDlgItemMessageW

msvcrt

__set_app_type
__p__fmode
__p__commode
?terminate@@YAXXZ
_amsg_exit
_controlfp
_vsnwprintf
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
swscanf
wcsncmp
memset
__setusermatherr
_except_handler4_common

comctl32

CreatePropertySheetPageW
PropertySheetW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

ntdll

TpWaitForWait
TpAllocWait
NtOpenProcessToken
NtPrivilegeCheck
NtAdjustPrivilegesToken
NtClose
RtlNtStatusToDosError
TpReleaseWait
TpSetWait

crypt32

CryptProtectData
CryptUnprotectData

rpcrt4

RpcAsyncInitializeHandle
RpcStringBindingComposeW
NdrAsyncClientCall
I_RpcExceptionFilter
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcBindingFree

shell32

CommandLineToArgvW

netutils

NetApiBufferFree

samcli

NetValidatePasswordPolicy

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fuvcqwf
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6be84b25ed346af1ddd1450a9c5267a1

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

comdlg32

ntdll

crypt32

rpcrt4

shell32

netutils

samcli

Sections

.text Size: 18KB - Virtual size: 18KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 28KB - Virtual size: 29KB

fuvcqwf Size: - Virtual size: 4KB

.text
Size: 18KB - Virtual size: 18KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 28KB - Virtual size: 29KB

fuvcqwf
Size: - Virtual size: 4KB