55407d87514e83a5b6af8e6fce58ffb160e2800cf9cbf613f0f0f2493d69c775

Sharing

Copy URL Twitter E-mail

General

Target

55407d87514e83a5b6af8e6fce58ffb160e2800cf9cbf613f0f0f2493d69c775
Size

327KB
MD5

0330a501074b2115fbff630da24fd72a
SHA1

978e3af9c291c11f6f1304deaf818a36abd34733
SHA256

55407d87514e83a5b6af8e6fce58ffb160e2800cf9cbf613f0f0f2493d69c775
SHA512

2cff97021fc7edbd5a3834b89ee9c8df79a3ce7a3f96a31a2a991c3255ff0d851d34add3461066e254695d4ae1f38a165acda036eecaced78e9636db32c002bc
SSDEEP

6144:S4oBWy6mJF2k0WvBYrCzfCZuA9GpjT8j4wXZ6c1Usfwk:ShX0WvVzfCF8/8j4A/hfw

Score

N/A

Malware Config

Signatures

Files

55407d87514e83a5b6af8e6fce58ffb160e2800cf9cbf613f0f0f2493d69c775
.exe windows x86

1909f76b05a0f7afc2d83456d3e78988

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
wcscat
wcsncpy
calloc
wcscpy
__CxxFrameHandler
wcsstr
wcstok
_snwprintf
wcslen
_itow
wcsncat

msvcp60

?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z

advapi32

RegCloseKey
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ControlService

kernel32

InterlockedIncrement
InterlockedDecrement
CloseHandle
GetCurrentProcess
DeleteFileW
UnmapViewOfFile
HeapFree
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
WriteFile
VirtualFree
DisableThreadLibraryCalls
VirtualAlloc
ReadFile
HeapAlloc
GetProcessHeap

netsh.exe

PrintMessageFromModule
RegisterHelper
PrintMessage
PrintError
MatchToken
MatchEnumTag
RegisterContext

ole32

CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringLen

shlwapi

SHGetValueW

userenv

ExpandEnvironmentStringsForUserW

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9e3c
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1o2p
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.16as
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.aeas
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.k1kl
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ps1i
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t3ta
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ksi1
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.12i1
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.123f
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eaa
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ze
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.1teaX
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.134
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.724
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.182
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.381
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.832
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ii32
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.i832
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.i833
Size: 512B - Virtual size: 222B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1909f76b05a0f7afc2d83456d3e78988

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

msvcp60

advapi32

kernel32

netsh.exe

ole32

oleaut32

shlwapi

userenv

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 1KB

.9e3c Size: 512B - Virtual size: 216B

.1o2p Size: 512B - Virtual size: 216B

.16as Size: 512B - Virtual size: 216B

.aeas Size: 512B - Virtual size: 216B

.k1kl Size: 512B - Virtual size: 216B

.ps1i Size: 512B - Virtual size: 216B

.t3ta Size: 512B - Virtual size: 216B

.ksi1 Size: 512B - Virtual size: 216B

.12i1 Size: 512B - Virtual size: 216B

.123f Size: 512B - Virtual size: 216B

.eaa Size: 93KB - Virtual size: 92KB

.ze Size: 93KB - Virtual size: 92KB

.1teaX Size: 93KB - Virtual size: 92KB

.134 Size: 512B - Virtual size: 216B

.724 Size: 512B - Virtual size: 216B

.182 Size: 512B - Virtual size: 216B

.381 Size: 512B - Virtual size: 216B

.832 Size: 512B - Virtual size: 216B

.ii32 Size: 512B - Virtual size: 216B

.i832 Size: 512B - Virtual size: 216B

.i833 Size: 512B - Virtual size: 222B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 252KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 1KB

.9e3c
Size: 512B - Virtual size: 216B

.1o2p
Size: 512B - Virtual size: 216B

.16as
Size: 512B - Virtual size: 216B

.aeas
Size: 512B - Virtual size: 216B

.k1kl
Size: 512B - Virtual size: 216B

.ps1i
Size: 512B - Virtual size: 216B

.t3ta
Size: 512B - Virtual size: 216B

.ksi1
Size: 512B - Virtual size: 216B

.12i1
Size: 512B - Virtual size: 216B

.123f
Size: 512B - Virtual size: 216B

.eaa
Size: 93KB - Virtual size: 92KB

.ze
Size: 93KB - Virtual size: 92KB

.1teaX
Size: 93KB - Virtual size: 92KB

.134
Size: 512B - Virtual size: 216B

.724
Size: 512B - Virtual size: 216B

.182
Size: 512B - Virtual size: 216B

.381
Size: 512B - Virtual size: 216B

.832
Size: 512B - Virtual size: 216B

.ii32
Size: 512B - Virtual size: 216B

.i832
Size: 512B - Virtual size: 216B

.i833
Size: 512B - Virtual size: 222B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 252KB