36c81078e58b4e8f1edd608c0b6382e4085f96bd79e91a1dd290318a99a2a398

Sharing

Copy URL Twitter E-mail

General

Target

36c81078e58b4e8f1edd608c0b6382e4085f96bd79e91a1dd290318a99a2a398
Size

677KB
MD5

0f355683fc8187668f9d5e2f229f3ae0
SHA1

ff6113b48ccd618e975ebdbb3dc58b323d91a001
SHA256

36c81078e58b4e8f1edd608c0b6382e4085f96bd79e91a1dd290318a99a2a398
SHA512

6d185df8588c573b1ab927ba1e3c6b1b808644c300f8f0d5cd3f059d02356be2fe700d26d7734e0743488cf692a4f0efec5610785c07feaa31b18edd85c96514
SSDEEP

12288:Z6CFefl4StG/qjVUxant9Jq+UFVNOMvK90/RK6zF1+ytu6oPn3hXgIo:Z62Ol4QG/oZKOKC0k6zF1+ytu6UhwB

Score

N/A

Malware Config

Signatures

Files

36c81078e58b4e8f1edd608c0b6382e4085f96bd79e91a1dd290318a99a2a398
.exe windows x64

6c49acb7eeae719985abb338cdec213a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
IsValidRelativeSecurityDescriptor
MakeAbsoluteSD
InitializeSecurityDescriptor
InitializeAcl
MakeSelfRelativeSD
IsValidSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
FreeSid
GetSecurityDescriptorDacl
IsValidAcl
GetAclInformation
GetAce
AddAccessDeniedAce
EqualSid
DeleteAce
RegEnumValueW
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
CryptGetUserKey
CryptGenKey
CryptExportKey
CryptImportKey
CryptDecrypt
CryptEncrypt
EventWrite
EventRegister
EventUnregister

kernel32

LeaveCriticalSection
GetModuleFileNameW
MultiByteToWideChar
lstrlenW
RaiseException
GetLastError
GetProcAddress
EnterCriticalSection
GetModuleHandleW
lstrcmpiW
DeleteCriticalSection
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
CreateThread
WaitForSingleObject
GetACP
HeapSetInformation
CompareStringW
GetCurrentThreadId
SetEvent
GetCommandLineW
Sleep
ResetEvent
SizeofResource
GetSystemDirectoryW
LoadLibraryExA
DelayLoadFailureHook
OutputDebugStringA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
GetVersionExA
LoadLibraryW
SetLastError
InitializeCriticalSection
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
CreateEventW

user32

UnregisterClassA
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
CharUpperW
PostThreadMessageW
CharNextW

msvcrt

__wgetmainargs
memcmp
_CxxThrowException
??0exception@@QEAA@AEBV0@@Z
wcsncmp
iswdigit
_callnewh
_exit
__CxxFrameHandler3
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
_errno
realloc
?terminate@@YAXXZ
__set_app_type
_fmode
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
__C_specific_handler
memset
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
memcpy_s
_purecall
malloc
free
wcsncpy_s
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_wtol
_cexit
_XcptFilter
memcpy

shlwapi

StrCmpIW

oleaut32

UnRegisterTypeLi
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
RegisterTypeLi
SysAllocString
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
SysFreeString
VarUI4FromStr
LoadTypeLi
VarBstrCmp
SysStringLen
SysAllocStringLen
VarBstrCat

ole32

CoWaitForMultipleHandles
CoSuspendClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
StringFromGUID2
CoResumeClassObjects
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW

shell32

SHGetSpecialFolderPathW
ShellExecuteW

netapi32

NetApiBufferFree
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupGetMembers
NetLocalGroupDelMembers
NetLocalGroupAddMembers
NetLocalGroupGetInfo

crypt32

CryptBinaryToStringW
CryptStringToBinaryW

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 556KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6c49acb7eeae719985abb338cdec213a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

oleaut32

ole32

wtsapi32

shell32

netapi32

crypt32

Sections

.text Size: 100KB - Virtual size: 100KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 556KB - Virtual size: 2.4MB

.text
Size: 100KB - Virtual size: 100KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 556KB - Virtual size: 2.4MB