1929e5109861dc04c4f4f4d9ab50f5a4a7ae3fb88ef65e0214891af644369284

Sharing

Copy URL Twitter E-mail

General

Target

1929e5109861dc04c4f4f4d9ab50f5a4a7ae3fb88ef65e0214891af644369284
Size

126KB
MD5

400e72da4b80fdf95cd69e09956e97c0
SHA1

15fcd8a52cdb59a889d0d121989a853e95d9d138
SHA256

1929e5109861dc04c4f4f4d9ab50f5a4a7ae3fb88ef65e0214891af644369284
SHA512

9b018b5b37d794e7f404d82aa90504d6803b7d23cc4adb7415d943382fe696b6203630da82ca6f6db6a72a3cdb53405eb9c2a4d8d08af0c8234b00e9a20d1ba1
SSDEEP

3072:P02gdQoD0TdkxSb2L0MI/O+il3qkymoyj39+Vzhsa7BrAcBiV2/:PBgdd+dkxZ4MI/OZ3Qmo632LBrC2

Score

N/A

Malware Config

Signatures

Files

1929e5109861dc04c4f4f4d9ab50f5a4a7ae3fb88ef65e0214891af644369284
.exe windows x86

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
InitializeAcl
InitializeSecurityDescriptor
MakeAbsoluteSD
IsValidRelativeSecurityDescriptor
RegQueryValueExW
IsValidSecurityDescriptor
MakeSelfRelativeSD
FreeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
AllocateAndInitializeSid
AddAccessDeniedAce
GetAce
GetAclInformation
IsValidAcl
GetSecurityDescriptorDacl
DeleteAce
EqualSid
RegEnumValueW
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptGetUserKey
CryptAcquireContextW
CryptExportKey
CryptDecrypt
CryptImportKey
CryptEncrypt
EventUnregister
EventWrite
EventRegister

kernel32

InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
CloseHandle
CreateEventW
GetModuleFileNameW
FreeLibrary
InitializeCriticalSection
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
GetACP
WaitForSingleObject
CreateThread
Sleep
GetCurrentThreadId
SetEvent
GetCommandLineW
CompareStringW
InterlockedIncrement
ResetEvent
SetLastError
GetSystemDirectoryW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
GetVersionExA
GetLastError
HeapSetInformation
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringA
lstrlenW
MultiByteToWideChar

user32

CharNextW
UnregisterClassA
CharUpperW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW

msvcrt

_onexit
__wgetmainargs
_callnewh
_controlfp
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
wcsncmp
??1exception@@UAE@XZ
_lock
__dllonexit
_unlock
_errno
_wtol
?terminate@@YAXXZ
_except_handler4_common
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memcpy
_wtoi
_vsnwprintf
wcscat_s
wcscpy_s
memset
_purecall
__CxxFrameHandler3
wcsncpy_s
_CxxThrowException
memcpy_s
free
malloc
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
realloc
_cexit
??0exception@@QAE@ABV0@@Z
iswdigit

shlwapi

StrCmpIW

oleaut32

SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
SafeArrayDestroy
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
VarBstrCmp
SysAllocStringLen
VarBstrCat

ole32

CoWaitForMultipleHandles
CoResumeClassObjects
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

netapi32

NetLocalGroupGetInfo
NetLocalGroupAdd
NetLocalGroupDel
NetLocalGroupAddMembers
NetLocalGroupDelMembers
NetLocalGroupGetMembers
NetApiBufferFree

crypt32

CryptStringToBinaryW
CryptBinaryToStringW

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

haskhhc
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

96492b298bc428b6b5486d205cc84968

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

oleaut32

ole32

wtsapi32

shell32

netapi32

crypt32

Sections

.text Size: 77KB - Virtual size: 76KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 14KB - Virtual size: 13KB

.reloc Size: 34KB - Virtual size: 35KB

haskhhc Size: - Virtual size: 4KB

.text
Size: 77KB - Virtual size: 76KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 14KB - Virtual size: 13KB

.reloc
Size: 34KB - Virtual size: 35KB

haskhhc
Size: - Virtual size: 4KB