865e52eb0c86f72e804018a2aa48d0e885468dc4457bb0a1825f1eeabb2c42b7

Sharing

Copy URL

Twitter E-mail

General

Target

865e52eb0c86f72e804018a2aa48d0e885468dc4457bb0a1825f1eeabb2c42b7
Size

405KB
MD5

085f13948bd7f5ce4261851a26705830
SHA1

612576c1d569f6ec7a9b2cb2ffd971b7aa3a18b8
SHA256

865e52eb0c86f72e804018a2aa48d0e885468dc4457bb0a1825f1eeabb2c42b7
SHA512

98930c90425b6230655cbfe86ab4034bc833804799066451a45af28b58d2a0b0fde26c77e3e0f95ec84b262e9976e37225cc34a323a26a11ce142d05760939a0
SSDEEP

6144:pAQp0n77cDlR8SZaSsMTHxjVtUg2XQ+hgeC8gJMwYreg:iQiHw3Ds6jbUc+h1C9K

Score

N/A

Malware Config

Signatures

Files

865e52eb0c86f72e804018a2aa48d0e885468dc4457bb0a1825f1eeabb2c42b7
.exe windows x86

de7c4d64260ade06c8cc7fdb94e06e8b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExW
RegSetValueExW
LsaOpenPolicy
LsaClose
LsaRemoveAccountRights
LsaAddAccountRights
RegCreateKeyExW
LsaNtStatusToWinError
ConvertStringSidToSidW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
CheckTokenMembership
FreeSid
RegCloseKey
LookupAccountNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
LsaStorePrivateData
RegDeleteKeyW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
GetTokenInformation
OpenThreadToken
LogonUserW
DuplicateTokenEx
AllocateAndInitializeSid
RegConnectRegistryW
RegDeleteValueW

kernel32

GetComputerNameExW
DeleteFileW
CreateFileW
GetSystemDirectoryW
GetVersionExW
CopyFileW
GetCommandLineW
FindNextFileW
FindFirstFileW
GetPrivateProfileStringW
GetTickCount
CreateMutexW
MulDiv
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentThread
GetTempFileNameW
GetTempPathW
WideCharToMultiByte
FreeLibrary
GetDiskFreeSpaceExW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
InterlockedIncrement
InterlockedDecrement
lstrlenW
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
GetVersionExA
GetStartupInfoW
RtlUnwind
HeapReAlloc
WritePrivateProfileSectionW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
lstrlenA
VirtualQuery
LCMapStringA
LCMapStringW
VirtualProtect
VirtualAlloc
GetSystemInfo
IsBadWritePtr
HeapSize
GetLocaleInfoA
GetCPInfo
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
ReadFile
CreateFileA
SetFilePointer
SetEndOfFile
WritePrivateProfileStringW
Sleep
OutputDebugStringA
GetModuleFileNameW
SetLastError
LocalAlloc
GetLocalTime
lstrcmpA
GetFileSize
lstrcpynW
RaiseException
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
MultiByteToWideChar
GetVersion
GetFileAttributesW
GetProcAddress
CreateFileMappingW
GetLastError
MapViewOfFile
GetCurrentProcessId
UnmapViewOfFile
CloseHandle
GetModuleHandleW
GetModuleHandleA
LoadLibraryW
GetDateFormatW
GetTimeFormatW
RemoveDirectoryW
CreateEventW
GetPrivateProfileSectionW
GetWindowsDirectoryW
GetSystemWindowsDirectoryW
GetComputerNameW
OpenMutexW
WaitForSingleObject
ReleaseMutex
LocalFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LoadLibraryA
CreateDirectoryW
GetShortPathNameW
GetExitCodeProcess
CreateProcessW
CompareStringA
CompareStringW
SetEnvironmentVariableA

gdi32

SetTextColor
GetTextMetricsW
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
SelectObject

user32

DrawFocusRect
HideCaret
ShowScrollBar
GetScrollInfo
LoadImageW
MapWindowPoints
PtInRect
GetDlgCtrlID
CreateWindowExW
GetFocus
SetTimer
KillTimer
DrawTextW
GetSysColor
UpdateWindow
GetWindowRect
GetClientRect
EndDialog
LoadStringW
DispatchMessageW
TranslateMessage
PostMessageW
LoadCursorW
SetCursor
SetWindowTextW
EnableWindow
IsWindow
MsgWaitForMultipleObjects
PeekMessageW
SetDlgItemTextW
GetDC
GetDlgItem
GetParent
SendDlgItemMessageW
ReleaseDC
LoadIconW
CharNextW
GetKeyboardType
GetSystemMetrics
GetActiveWindow
CallWindowProcW
GetWindowLongW
GetForegroundWindow
MessageBoxW
DefWindowProcW
ExitWindowsEx
DialogBoxParamW
SetWindowLongW
SendMessageW
EnumWindows
GetWindow
SetForegroundWindow
SetFocus
RegisterWindowMessageW
GetWindowThreadProcessId

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
VariantClear

winspool.drv

ord204
AddPrinterConnectionW
ClosePrinter
SetPrinterW
OpenPrinterW
ord203
EnumPrintersW
DeletePrinterConnectionW

netapi32

NetApiBufferFree
NetWkstaGetInfo
NetWkstaUserGetInfo
NetUserGetInfo
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory

ole32

CoTaskMemFree
CoCreateInstance
CLSIDFromString
CoInitialize
CreateBindCtx

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ntdll

RtlInitUnicodeString

shell32

ord155
SHGetDesktopFolder
ord25
SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderLocation

shlwapi

PathRenameExtensionW
PathRemoveFileSpecW
StrStrW
PathAppendW
PathIsRootW

activeds

ord3

secur32

QuerySecurityPackageInfoW
FreeContextBuffer
AcquireCredentialsHandleW
InitializeSecurityContextW
FreeCredentialsHandle
DeleteSecurityContext
RevertSecurityContext
ImpersonateSecurityContext
AcceptSecurityContext

crypt32

CryptProtectData
CertCloseStore
CertAddEncodedCertificateToStore
CertFreeCertificateContext
CertDeleteCertificateFromStore
CertFindCertificateInStore
CertOpenSystemStoreW
CertOpenStore
CryptQueryObject
CryptUnprotectData

mapi32

ord21
ord11
ord17
ord140
ord19
ord23

msi

ord113
ord70
ord37
ord8
ord118
ord160
ord159
ord32
ord92

wininet

InternetCrackUrlW

setupapi

SetupIterateCabinetW

wintrust

CryptCATGetCatAttrInfo
CryptCATOpen
CryptCATClose

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 255KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de7c4d64260ade06c8cc7fdb94e06e8b

Headers

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

oleaut32

winspool.drv

netapi32

ole32

version

ntdll

shell32

shlwapi

activeds

secur32

crypt32

mapi32

msi

wininet

setupapi

wintrust

iphlpapi

Sections

.text Size: 255KB - Virtual size: 254KB

.data Size: 73KB - Virtual size: 79KB

.rsrc Size: 75KB - Virtual size: 75KB

.text
Size: 255KB - Virtual size: 254KB

.data
Size: 73KB - Virtual size: 79KB

.rsrc
Size: 75KB - Virtual size: 75KB