9c1b09a8fb9c82763a1dbfa4b6c9ab48d33b049e70f765083920c5fed13819d7

Sharing

Copy URL Twitter E-mail

General

Target

9c1b09a8fb9c82763a1dbfa4b6c9ab48d33b049e70f765083920c5fed13819d7
Size

966KB
MD5

0e5a710e1ad16508bbc9a0f31a3ef5f0
SHA1

e9cd0788ebf1d1193b4629f8324dade1d1f7eece
SHA256

9c1b09a8fb9c82763a1dbfa4b6c9ab48d33b049e70f765083920c5fed13819d7
SHA512

8b967a3fd599b3f221889538a190e43cc40cee293f318deffb3a07d18b89256d3ef65ca5b30319dc03ee86eae9e03f5f5c470fb8947a897459b3a5dc13d952b7
SSDEEP

24576:Nhz3P8mQdNOdXwpQkg+xy+luaMAA+UC30+tJFMB7A:NJmYr+SAxJFI

Score

N/A

Malware Config

Signatures

Files

9c1b09a8fb9c82763a1dbfa4b6c9ab48d33b049e70f765083920c5fed13819d7
.exe windows x64

dcc361b77e68bb199108438c9f142947

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeleteFileW
GetSystemInfo
SetThreadIdealProcessor
FlushFileBuffers
GetFileAttributesW
GetTempFileNameW
CompareStringW
InitializeCriticalSectionAndSpinCount
SetFilePointerEx
SetEndOfFile
HeapReAlloc
SetFileAttributesW
DeleteCriticalSection
ResetEvent
lstrlenW
GetFullPathNameW
LocalAlloc
ReleaseMutex
FormatMessageW
WriteFile
SetFilePointer
GetProcAddress
GetOverlappedResult
LoadLibraryW
FreeLibrary
LocalFree
GetCurrentThread
GetVolumeInformationW
GetFileInformationByHandle
DuplicateHandle
DeviceIoControl
RemoveDirectoryW
GetFileSizeEx
GetTempPathW
CreateFileW
ReadFile
CreateDirectoryW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetLastError
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
UnlockFileEx
LockFileEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
Sleep
CreateThread
WaitForMultipleObjects
CreateEventW
CreateMutexW
CloseHandle
GetLastError
GetProcessHeap
SetEvent
WaitForSingleObject
HeapFree
HeapAlloc
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId

user32

GetMessageW
TranslateMessage
DispatchMessageW

msvcrt

_onexit
??3@YAXPEAX@Z
__dllonexit
_unlock
?terminate@@YAXXZ
memmove
memset
memcpy
wcschr
_wcsicmp
_vscwprintf
_wcsnicmp
_vsnwprintf
wcsrchr
wcsncmp
??2@YAPEAX_K@Z
_purecall
iswspace
memcmp
_lock
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs

ntdll

RtlDosPathNameToNtPathName_U
RtlAdjustPrivilege
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
RtlNtStatusToDosError
RtlAllocateHeap
RtlFreeHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlEnterCriticalSection
RtlReAllocateHeap
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlRaiseStatus
NtYieldExecution

rpcrt4

RpcRevertToSelf
RpcServerUseProtseqEpW
UuidFromStringW
RpcServerRegisterAuthInfoW
RpcImpersonateClient
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcServerListen
NdrServerCall2
RpcServerRegisterIf
UuidToStringW
UuidCreate
RpcStringFreeW

advapi32

RegQueryValueExW
OpenEncryptedFileRawW
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorSacl
SetSecurityInfo
GetSecurityDescriptorOwner
WriteEncryptedFileRaw
CloseEncryptedFileRaw
GetSecurityDescriptorControl
GetAclInformation
SetThreadToken
OpenThreadToken
RegCloseKey
RegOpenKeyExW
GetLengthSid
FreeSid
AllocateAndInitializeSid
InitializeAcl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx

Sections

.text
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dcc361b77e68bb199108438c9f142947

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcrt

ntdll

rpcrt4

advapi32

Sections

.text Size: 363KB - Virtual size: 363KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 576KB - Virtual size: 2.5MB

.text
Size: 363KB - Virtual size: 363KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 576KB - Virtual size: 2.5MB