6c11689475477be441dfc18319d9b9274d692a2890d03f2a0d4e0c34a23e8e3d

Sharing

Copy URL Twitter E-mail

General

Target

6c11689475477be441dfc18319d9b9274d692a2890d03f2a0d4e0c34a23e8e3d
Size

818KB
MD5

05b5d08d502def113165a2900ae0f84e
SHA1

12b86b85d613b98b08adba66e570d1f675240e3f
SHA256

6c11689475477be441dfc18319d9b9274d692a2890d03f2a0d4e0c34a23e8e3d
SHA512

5aa6bb54b3bb48c7cfbd7677e366dd622c0836e35ea88c5e2391522e2465807ccb77c0e1cdd03e7b3a99ce9a9cc6a61594695d1abcff2a373cc7cc3b55b2e4a0
SSDEEP

24576:P2poEPR35tNWcyaYg4jxfYZzG+mrtGx4gfZE9cfQvr:e/fyf1NGQa4kE9cf

Score

N/A

Malware Config

Signatures

Files

6c11689475477be441dfc18319d9b9274d692a2890d03f2a0d4e0c34a23e8e3d
.exe windows x86

42d59b1cd4b117a0dcd0baf7d222a7f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextFileA
GetTickCount
GetCommConfig
IsValidCodePage
VirtualUnlock
HeapSummary
GetFileInformationByHandle
VirtualAlloc
GetProcessShutdownParameters
DosPathToSessionPathA
GetNumaHighestNodeNumber
VerLanguageNameW
CloseProfileUserMapping
DuplicateHandle
GetEnvironmentStringsA
ResetWriteWatch
DuplicateConsoleHandle
OpenEventW
GetDiskFreeSpaceExW
GetNumberFormatA
InitializeCriticalSectionAndSpinCount
GetConsoleAliasExesA
SetClientTimeZoneInformation
WaitForDebugEvent
SuspendThread
GetProcAddress
GetFileAttributesExW
ReplaceFileA
GetPrivateProfileSectionNamesA
WriteConsoleInputW
PeekNamedPipe
LoadLibraryA
VirtualAllocEx
WriteFileGather
IsDebuggerPresent
GetConsoleDisplayMode
TryEnterCriticalSection
SetEnvironmentVariableA
SetTimerQueueTimer
Heap32ListNext
ProcessIdToSessionId
IsProcessInJob
Thread32First
ResumeThread
CreateWaitableTimerW
SetConsoleCP
CreateProcessInternalW
lstrcmp
AttachConsole
GetCommProperties
DebugActiveProcessStop
GetAtomNameA
GlobalAlloc
AddVectoredExceptionHandler
EscapeCommFunction
SetTermsrvAppInstallMode
ClearCommBreak
ContinueDebugEvent

advapi32

RegSetValueA
AddAccessAllowedAce
IsValidSecurityDescriptor
SetSecurityInfoExA
SaferCloseLevel
CryptExportKey
QueryAllTracesA
CryptSetProvParam
DecryptFileW
GetSecurityDescriptorLength
RegRestoreKeyW
TrusteeAccessToObjectW
AreAnyAccessesGranted
GetManagedApplicationCategories
AddAce
GetTraceLoggerHandle
SystemFunction032
RegOpenKeyA
LookupSecurityDescriptorPartsA
ChangeServiceConfig2W
RegQueryInfoKeyW
WmiSetSingleItemA
LsaOpenPolicySce
BuildImpersonateTrusteeW
RegSetValueExA
ConvertStringSDToSDRootDomainA
LogonUserW
GetServiceKeyNameW
CreateProcessAsUserA
SetEntriesInAccessListA
WmiSetSingleInstanceA

polstore

IPSecFreeFilterSpecs
IPSecCopyNegPolData
IPSecCreateFilterData
IPSecFreeMulPolicyData
IPSecImportPolicies
IPSecDeleteISAKMPData
IPSecFreeNegPolData
IPSecFreePolicyData
IPSecCopyFilterSpec
IPSecFreeMulISAKMPData
IPSecFreeMulNFAData
IPSecExportPolicies
IPSecCreateNegPolData
IPSecFreeNFAData
IPSecCopyFilterData
IPSecAllocPolStr
IPSecIsDomainPolicyAssigned
IPSecDeleteFilterData
IPSecClosePolicyStore
IPSecUnassignPolicy
IPSecCopyAuthMethod
IPSecAllocPolMem
IPSecSetNegPolData
IPSecDeletePolicyData
IPSecCopyPolicyData

esent

JetSetTableSequential
JetCloseFile
JetEnumerateColumns
JetCreateDatabase2
JetCloseDatabase
JetEndSession
JetInit2
JetDeleteIndex
JetGrowDatabase
JetCommitTransaction@8
JetOpenDatabase
JetAttachDatabase
JetRetrieveColumns
JetExternalRestore
JetResetCounter
JetGetVersion
JetSetColumns
JetUnregisterCallback
JetRestore
JetDBUtilities
JetBeginExternalBackupInstance
JetGetSystemParameter
JetDeleteTable
JetInit
JetEnableMultiInstance
JetMakeKey@20
JetRetrieveColumn
JetOpenTempTable

Sections

.text
Size: 401KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42d59b1cd4b117a0dcd0baf7d222a7f1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

polstore

esent

Sections

.text Size: 401KB - Virtual size: 400KB

.rdata Size: 135KB - Virtual size: 135KB

.data Size: 192KB - Virtual size: 1.5MB

.rsrc Size: 86KB - Virtual size: 86KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 401KB - Virtual size: 400KB

.rdata
Size: 135KB - Virtual size: 135KB

.data
Size: 192KB - Virtual size: 1.5MB

.rsrc
Size: 86KB - Virtual size: 86KB

.reloc
Size: 1KB - Virtual size: 1KB