88a543816f811ea509e6a5cb70bcb7abf26baf9bf626344200e21acd89efd143

Sharing

Copy URL Twitter E-mail

General

Target

88a543816f811ea509e6a5cb70bcb7abf26baf9bf626344200e21acd89efd143
Size

3.8MB
MD5

0fb2b2b6e62496940debd3d15230c4b3
SHA1

681c6536d97c7ad4775a674d5b7670486fe0f8e4
SHA256

88a543816f811ea509e6a5cb70bcb7abf26baf9bf626344200e21acd89efd143
SHA512

3a058037ab0e071be80360c555a13ceacb88dfbe55ca1f8be1c88f8c083d7d64650a2fcc6f7447d8c68df12ad6f5420b5f6d0cdc7243ac8644d8d29ae7d49fb5
SSDEEP

49152:Mg7cTSMhCZaR9lIhwSM9xQw9KqNPGrhtn0Ymq1dKwdfU2bECbeq:t4uhvhz1DFE/q

Score

N/A

Malware Config

Signatures

Files

88a543816f811ea509e6a5cb70bcb7abf26baf9bf626344200e21acd89efd143
.exe windows x64

7e5000a82ac7e54c574657270fcd54d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

EventWrite
RegCreateKeyExW
RegQueryValueExW
StopTraceW
RegFlushKey
RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegDeleteTreeW
RegOpenKeyExW
EventUnregister
EventEnabled
EventRegister
ControlTraceW
EnableTrace
StartTraceW
RegDeleteValueW
ProcessTrace
CloseTrace
OpenTraceW
OpenProcessToken
LookupPrivilegeValueW
RegQueryValueExA
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
GetLengthSid
SetSecurityInfo
InitializeAcl
SetNamedSecurityInfoW
AddAccessAllowedAceEx
EnableTraceEx
CryptHashData
RegOpenKeyExA
CryptDestroyHash
CryptDecrypt
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
CryptDestroyKey
CryptGenKey
OpenThreadToken
AddAccessAllowedAce
ImpersonateSelf
RevertToSelf
AdjustTokenPrivileges
CryptAcquireContextW
CryptGetKeyParam
CryptReleaseContext
CryptEncrypt
CryptCreateHash

kernel32

CancelWaitableTimer
TerminateProcess
CreateWaitableTimerW
CreateThread
SetWaitableTimer
GetFullPathNameA
CreateFileMappingA
GetModuleHandleA
LoadLibraryA
GetSystemWindowsDirectoryW
GetModuleHandleExW
SetFileAttributesW
OpenThread
SetFileInformationByHandle
CreateWaitableTimerExW
HeapCreate
HeapDestroy
GetUserDefaultUILanguage
CreateFileMappingW
FindResourceExW
GetSystemDefaultUILanguage
UnmapViewOfFile
SearchPathW
ExitProcess
lstrcmpA
SystemTimeToFileTime
GetProcessId
VirtualUnlock
CopyFileW
InterlockedPushEntrySList
SetFileValidData
GetVolumeNameForVolumeMountPointW
WriteFileEx
CancelIo
GetDiskFreeSpaceW
ReadFileEx
InterlockedPopEntrySList
GetVolumePathNameW
SleepEx
GetLogicalDrives
InitializeSListHead
SetFilePointerEx
lstrcmpiA
SetThreadIdealProcessor
SetProcessWorkingSetSize
VirtualLock
GetExitCodeThread
GetProcessWorkingSetSize
VirtualAlloc
VirtualFree
GetCommandLineW
SetPriorityClass
FindFirstFileW
FindResourceW
FreeLibrary
LoadResource
CreateProcessW
GetLogicalProcessorInformation
SetThreadAffinityMask
QueryPerformanceFrequency
GetThreadPriority
CreateFileA
GetSystemTime
GetFileAttributesW
GetConsoleOutputCP
LoadLibraryExW
GetSystemFirmwareTable
lstrcmpW
OpenFileMappingW
MapViewOfFile
WTSGetActiveConsoleSessionId
ProcessIdToSessionId
GetTempPathW
FileTimeToSystemTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
GetCurrentProcessId
GetCurrentThreadId
LoadLibraryExA
GetLocalTime
EnterCriticalSection
GetFileSizeEx
FlushFileBuffers
GetTimeFormatW
LeaveCriticalSection
FormatMessageA
SetEndOfFile
SetFilePointer
SetCriticalSectionSpinCount
GetSystemInfo
IsWow64Process
GetNativeSystemInfo
lstrlenW
CompareStringA
GetStringTypeExA
CreateFileW
ReadFile
DeviceIoControl
GlobalMemoryStatusEx
MultiByteToWideChar
IsProcessorFeaturePresent
GetNumberFormatW
GetLocaleInfoW
DeleteFileW
CreateDirectoryW
ExpandEnvironmentStringsW
ReleaseMutex
OpenEventW
GetModuleFileNameW
CreateMutexW
ResumeThread
LocalFree
GetWindowsDirectoryW
CloseHandle
DeleteCriticalSection
FindNextFileW
HeapSetInformation
CreateEventW
LockResource
SetConsoleCtrlHandler
GetFileType
WriteConsoleA
ResetEvent
HeapAlloc
GetCurrentProcess
FindClose
GetProcAddress
QueryPerformanceCounter
HeapFree
WaitForSingleObject
SetLastError
GetCurrentDirectoryW
GetLastError
GetHandleInformation
GetStdHandle
SetThreadPriority
CompareStringW
WriteConsoleW
GetStringTypeExW
GetVersionExW
FormatMessageW
SizeofResource
GetSystemPowerStatus
Sleep
LoadLibraryW
WideCharToMultiByte
GetPriorityClass
InitializeCriticalSection
GetComputerNameW
SetEvent
WaitForMultipleObjectsEx
WriteFile
GetModuleHandleW
GetTickCount
GetCurrentThread
GetProcessHeap
GetSystemTimeAsFileTime
GetFileSize

msvcrt

sqrtf
atan2
atan
acos
asin
cos
sin
cosf
exp
powf
floorf
atan2f
ceil
cosh
fmod
sinh
tanh
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
sqrt
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
abort
__crtGetStringTypeW
memcpy
isupper
__crtLCMapStringA
__mb_cur_max
__pctype_func
__crtLCMapStringW
__uncaught_exception
setlocale
__CxxFrameHandler3
___lc_handle_func
___lc_codepage_func
___mb_cur_max_func
_errno
malloc
_callnewh
_CxxThrowException
fclose
fgets
_wfopen
feof
log
wcscat_s
_snwprintf_s
_vsnprintf_s
_snprintf_s
atof
wcstoul
iswdigit
_time64
strcspn
memcpy_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_purecall
_vsnwprintf
_beginthreadex
localeconv
memchr
free
_wtof
memmove
_itoa_s
sprintf_s
vswprintf_s
modf
ldiv
mbstowcs
iswpunct
qsort
time
_aligned_free
_aligned_malloc
rand
srand
_vsnprintf
fwprintf
memcmp
memset
_wcsicmp
_wcsnicmp
wcsncmp
bsearch
wcschr
wcsstr
isprint
iswascii
strchr
_finite
_clearfp
_strdup
_stricmp
isalnum
atoi
tolower
isalpha
isdigit
isxdigit
_fpclass
_isnan
toupper
isspace
islower
memmove_s
pow
floor
acosf
_vsnwprintf_s
sinf
tan
__setusermatherr

oleaut32

SysStringLen
GetErrorInfo
SysFreeString
VariantInit
VariantClear
SysAllocString

ole32

PropVariantClear
StgCreateDocfile
CoInitializeEx
CoGetClassObject
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CoInitialize
CoUninitialize
CLSIDFromString

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winmm

waveOutGetNumDevs
timeBeginPeriod
timeEndPeriod

user32

UnregisterDeviceNotification
CharLowerW
EnumDisplaySettingsW
MonitorFromPoint
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplayMonitors
GetSystemMetrics
CharLowerBuffW
MsgWaitForMultipleObjectsEx
DispatchMessageW
MoveWindow
DefWindowProcW
SetWindowLongPtrW
AdjustWindowRectEx
CreateWindowExW
ShowWindow
PeekMessageW
RegisterClassExW
TranslateMessage
GetUpdateRect
BeginPaint
LoadStringW
GetWindowLongPtrW
LoadImageW
DestroyWindow
EndPaint
PostQuitMessage
GetDesktopWindow
MsgWaitForMultipleObjects
PostMessageW
SetCursor
RegisterClassW
IsWindow
SetWindowPos
SetWindowLongW
UnregisterClassW

ntdll

RtlNtStatusToDosError
NtClose
NtReadFile
WinSqmEndSession
WinSqmStartSession
RtlReleaseSRWLockShared
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlAcquireSRWLockShared
NtSetInformationFile
NtOpenFile
NtQueryObject
WinSqmAddToStream
NtOpenEvent
NtCreateFile
NtQueryVolumeInformationFile
RtlGetVersion
RtlInitUnicodeString
NtDeviceIoControlFile
NtOpenKey
NtSetSystemInformation
WinSqmIsOptedIn
RtlGetCompressionWorkSpaceSize
RtlDecompressBuffer
RtlCompressBuffer
RtlFindNextForwardRunClear
RtlFindClearBits
RtlInitializeBitMap
RtlRandom
NtQuerySystemInformation
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

shell32

SHGetFolderPathW

gdi32

GetStockObject
DeleteObject

powrprof

CallNtPowerInformation
PowerGetActiveScheme

dxgi

CreateDXGIFactory
DXGIReportAdapterConfiguration

d3d10_1

D3D10StateBlockMaskEnableAll
D3D10CompileShader
D3D10CreateDeviceAndSwapChain1
D3D10CreateStateBlock

d3d10

D3D10CreateDeviceAndSwapChain

gdiplus

GdiplusStartup
GdipCreateBitmapFromStream
GdiplusShutdown
GdipBitmapLockBits
GdipDisposeImage
GdipBitmapUnlockBits

quartz

AMGetErrorTextW

shlwapi

StrFormatByteSizeW

rpcrt4

UuidCreate
RpcStringFreeW
UuidCreateNil
UuidToStringW
UuidToStringA
RpcStringFreeA
NdrServerCall2
RpcImpersonateClient
NdrServerCallAll
RpcRevertToSelf

setupapi

SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiGetSelectedDriverW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 395KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 920KB - Virtual size: 919KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zelwsdu
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7e5000a82ac7e54c574657270fcd54d7

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

oleaut32

ole32

version

winmm

user32

ntdll

shell32

gdi32

powrprof

dxgi

d3d10_1

d3d10

gdiplus

quartz

shlwapi

rpcrt4

setupapi

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

PAGELK Size: 8KB - Virtual size: 8KB

.data Size: 395KB - Virtual size: 450KB

.pdata Size: 67KB - Virtual size: 66KB

.rsrc Size: 920KB - Virtual size: 919KB

.reloc Size: 53KB - Virtual size: 54KB

zelwsdu Size: - Virtual size: 4KB

.text
Size: 2.4MB - Virtual size: 2.4MB

PAGELK
Size: 8KB - Virtual size: 8KB

.data
Size: 395KB - Virtual size: 450KB

.pdata
Size: 67KB - Virtual size: 66KB

.rsrc
Size: 920KB - Virtual size: 919KB

.reloc
Size: 53KB - Virtual size: 54KB

zelwsdu
Size: - Virtual size: 4KB