f3b86f39739328b49a06694f18da8ef938eb56e849b371846ec262c545969702

Sharing

Copy URL Twitter E-mail

General

Target

f3b86f39739328b49a06694f18da8ef938eb56e849b371846ec262c545969702
Size

49KB
MD5

0ce685ebbffa7f50033e654625be2100
SHA1

a85872fb45d9e7d8dfdf2d737a0deca67d78d641
SHA256

f3b86f39739328b49a06694f18da8ef938eb56e849b371846ec262c545969702
SHA512

29d697bedb2a5867e0e2effc501602f305ba116d2ae976b7d492435c67c39b34ec15e9fd50d1137c14d0676a803d99eecb4287b1c8aa9a8e42d4f4d0f178b618
SSDEEP

1536:6865gBU0d+fXUWrobUpMeGZp654YGPD/cpH:6865cU0diU3bUOeGZp6OrO

Score

N/A

Malware Config

Signatures

Files

f3b86f39739328b49a06694f18da8ef938eb56e849b371846ec262c545969702
.exe windows x86

cd34303891171fb5835b5bd38eea5ec5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__commode
__p__fmode
__setusermatherr
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
memcpy
memset
strcpy_s
_vsnprintf_s

ntdll

NtCreatePort
NtConnectPort
NtListenPort
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
NtSetSecurityObject
NtOpenEvent
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlSetProcessIsCritical
NtSetInformationProcess
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
NtSetInformationFile
RtlCreateSecurityDescriptor
RtlLengthSid
RtlSetOwnerSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlAllocateAndInitializeSid
RtlAddMandatoryAce
RtlSetSaclSecurityDescriptor
RtlMakeSelfRelativeSD
RtlUnhandledExceptionFilter
DbgPrintEx
NtRequestWaitReplyPort

rpcrt4

I_RpcMapWin32Status
RpcServerRegisterIf2
RpcServerListen
RpcServerUseProtseqEpW
NdrServerCall2

sspisrv

SspiSrvInitialize
SspiSrvClientCallback

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetErrorMode
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedCompareExchange
InterlockedExchange

api-ms-win-core-libraryloader-l1-1-0

GetProcAddress
LoadLibraryExW
GetModuleHandleA

api-ms-win-core-localregistry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-misc-l1-1-0

LocalAlloc
LocalFree
Sleep

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
SetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
ExitThread
CreateThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

SetEvent
OpenEventW
CreateEventW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-1-0

GetTokenInformation

Exports

Exports

LsaGetInterface
LsaRegisterExtension

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pmdqurd
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cd34303891171fb5835b5bd38eea5ec5

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

rpcrt4

sspisrv

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 972B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 29KB

pmdqurd Size: - Virtual size: 4KB

.text
Size: 16KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 972B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 29KB

pmdqurd
Size: - Virtual size: 4KB