27270418ec8f6561fc249d0e70e29e990193666c4ac008f5c0be232634169c6b

Sharing

Copy URL Twitter E-mail

General

Target

27270418ec8f6561fc249d0e70e29e990193666c4ac008f5c0be232634169c6b
Size

700KB
MD5

026a73ee59158d70afd48323c64e80f0
SHA1

af9828ec0571edac27cfd633dc6b4277aa8a2d12
SHA256

27270418ec8f6561fc249d0e70e29e990193666c4ac008f5c0be232634169c6b
SHA512

590c4e724899a30c5a198efdef620e0ceb0142f696b036cbd78ecd2083ad6c72c197b738c6998d0dab1b911c8344bc26d8ea574ea5001f05815800b03d4bb9fa
SSDEEP

12288:yTU9VHAAOXU9lesZd4UZBzmXmoBIWPVDJPxcTsrun1qj2DEQBf/BxnwXv:CiHAAYc6XmoOK1PxtGqjWES70

Score

N/A

Malware Config

Signatures

Files

27270418ec8f6561fc249d0e70e29e990193666c4ac008f5c0be232634169c6b
.exe windows x64

c4ed04c567043de2279ca06cb6bc0456

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
CreateWellKnownSid
BuildExplicitAccessWithNameW
RegCreateKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SetNamedSecurityInfoW
LookupAccountSidW
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid

kernel32

GetDriveTypeW
GetVolumePathNameW
DeleteFileW
GetLocalTime
GetVersionExW
OutputDebugStringW
RaiseException
lstrlenW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetVolumeInformationW
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
ExpandEnvironmentStringsA
GetProcAddress
LocalFree
CloseHandle
GetUserDefaultUILanguage
HeapSetInformation
HeapSize
GetLastError
lstrcmpW
GetTimeZoneInformation
MulDiv
GetTimeFormatW
FormatMessageW
GetLocaleInfoW
RegisterApplicationRestart
LoadLibraryA
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
GetComputerNameW
HeapFree
HeapAlloc
CreateMutexW
GetDateFormatW
GetCommandLineW
ExitProcess
GetFullPathNameW

gdi32

SelectObject
DeleteObject
GetDeviceCaps
StartPage
GetTextMetricsW
GetTextExtentPoint32W
EndPage
StartDocW
EndDoc
CreateFontW

user32

SetWindowTextW
SetWindowLongPtrW
FindWindowExW
LoadStringW
SendDlgItemMessageW
GetDlgItem
GetWindowTextW
InvalidateRect
LoadIconW
EnumWindows
GetWindowLongPtrW
GetParent
SetForegroundWindow
DrawTextW
PostMessageW
GetWindowTextLengthW
DestroyWindow
SendMessageW

msvcrt

_fmode
exit
_cexit
_ismbblead
_exit
_XcptFilter
__C_specific_handler
__getmainargs
_initterm
_vsnwprintf
_beginthread
_endthread
??3@YAXPEAX@Z
__set_app_type
?terminate@@YAXXZ
_local_unwind
_amsg_exit
__setusermatherr
wcstok
_commode
??2@YAPEAX_K@Z
memcpy_s
??_V@YAXPEAX@Z
memset
_acmdln
??_U@YAPEAX_K@Z
memcpy

comctl32

ord345
PropertySheetW

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlNtStatusToDosError
RtlLookupFunctionEntry

ole32

CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity

oleaut32

SafeArrayGetLBound
SafeArrayAccessData
SafeArrayGetUBound
SysAllocString
SysFreeString
SysStringLen
VariantClear
SafeArrayGetElement
VariantCopy
VariantInit
SysAllocStringLen
SafeArrayUnaccessData
SysStringByteLen

comdlg32

PrintDlgW
GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

shell32

CommandLineToArgvW
SHGetKnownFolderIDList
SHCreateItemFromIDList
ord155

secur32

GetUserNameExW

activeds

ord9

imm32

ImmAssociateContext

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 588KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c4ed04c567043de2279ca06cb6bc0456

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

ntdll

ole32

oleaut32

comdlg32

shell32

secur32

activeds

imm32

bcrypt

Sections

.text Size: 80KB - Virtual size: 79KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 588KB - Virtual size: 2.0MB

.text
Size: 80KB - Virtual size: 79KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 588KB - Virtual size: 2.0MB