d29cc9d503aa738fefea8b26a885933e7d06e25704e20387a2b1284b7e5caa1b

Sharing

Copy URL

Twitter E-mail

General

Target

d29cc9d503aa738fefea8b26a885933e7d06e25704e20387a2b1284b7e5caa1b
Size

588KB
MD5

22bfc036881d1fb42bef2827359741a0
SHA1

514b2b6071afb7cc82870360c572c8bd5ece67fd
SHA256

d29cc9d503aa738fefea8b26a885933e7d06e25704e20387a2b1284b7e5caa1b
SHA512

aaebc0bb545c55b424b0236caec2613c70e3f2a95f7094d1c0a21db0306817786a9950ee09d0f8e6493bc174d079847cddff7deb5d375030b4acb29983405557
SSDEEP

6144:kjjkLmzA8F0UQLfwXI5bqhSN5L2vRq/NYB215mPX7zSZwp/5s6lE/4Eg:uI6z0OIYhmObwMPX7GK1gRg

Score

N/A

Malware Config

Signatures

Files

d29cc9d503aa738fefea8b26a885933e7d06e25704e20387a2b1284b7e5caa1b
.exe windows x86

2f37bd2cfc60f22d94e4856bdefb22d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
IsTextUnicode
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegDeleteKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
ControlService
StartServiceW
DeleteService
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership

kernel32

UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
LocalFree
FormatMessageW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
GetTempFileNameW
lstrcmpiW
lstrcmpW
lstrlenW
GetFileAttributesW
DeleteFileW
ReadFile
SetFilePointer
ReleaseMutex
WaitForSingleObject
HeapFree
GetProcessHeap
SetEndOfFile
HeapAlloc
InterlockedCompareExchange
CreateMutexW
CreateEventW
SetEvent
InterlockedExchangeAdd
ResetEvent
FreeLibrary
SetConsoleCursorPosition
FillConsoleOutputCharacterW
ReadConsoleOutputW
GetConsoleScreenBufferInfo
SetConsoleMode
GetConsoleMode
FreeConsole
GetStdHandle
GetProcAddress
LoadLibraryW
WriteConsoleOutputW
WriteConsoleW
QueryPerformanceCounter
GetTickCount
InterlockedDecrement
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersionExA
GetStartupInfoW
MultiByteToWideChar
HeapReAlloc
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetThreadLocale
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualQuery
VirtualAlloc
IsBadWritePtr
Sleep
HeapSize
LCMapStringA
WideCharToMultiByte
LCMapStringW
VirtualProtect
GetSystemInfo
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
CreateThread
CreateFileW
WriteFile
GetCommandLineW
GlobalFree
GetUserDefaultUILanguage
GetCurrentThreadId
IsValidLocale
WaitForMultipleObjects
lstrcpyW
LocalReAlloc
DeviceIoControl
GetSystemDirectoryW
LocalAlloc
VerSetConditionMask
VerifyVersionInfoW
CompareStringW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
SetLastError
CopyFileW
GetShortPathNameW
MoveFileExW
RemoveDirectoryW
CreateDirectoryW
GetFullPathNameW
lstrcpynW
GetModuleHandleW
GetCurrentProcess
GetLastError
CloseHandle
FindResourceExW
FindResourceW
LoadResource
EnumResourceLanguagesW
GetLocalTime
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetWindowsDirectoryW
SetHandleCount
SetCurrentDirectoryW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
RtlUnwind

gdi32

EndPage
StartDocW
EndDoc
GetTextMetricsW
GetDeviceCaps
CreateFontIndirectW
DeleteObject
StartPage

user32

DrawTextExW
LoadImageW
LoadBitmapW
GetSystemMetrics
GetSysColor
LoadIconW
LoadStringW
DestroyWindow
GetWindowLongW
SendDlgItemMessageW
InvalidateRect
SystemParametersInfoW
GetDC
ReleaseDC
SetWindowLongW
SetWindowTextW
SetDlgItemTextW
GetParent
PostMessageW
IsDlgButtonChecked
CheckDlgButton
SetFocus
CallWindowProcW
DestroyIcon
DialogBoxParamW
EndDialog
GetDlgItem
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
SendMessageW
CharLowerW
CharPrevW

ntdll

memset

shell32

ord59
CommandLineToArgvW
SHGetFolderPathW

setupapi

SetupDefaultQueueCallbackW
SetupCommitFileQueueW
SetupInitDefaultQueueCallbackEx
SetupOpenFileQueue
SetupCloseFileQueue
SetupGetTargetPathW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupCopyOEMInfW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoList
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
SetupDiSetClassInstallParamsW
SetupDiOpenDeviceInfoW
SetupTermDefaultQueueCallback
SetupOpenInfFileW
SetupCloseInfFile
SetupDiGetActualSectionToInstallW
SetupGetLineCountW
SetupOpenAppendInfFileW
SetupFindFirstLineW
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupPromptReboot
SetupInstallFilesFromInfSectionW
SetupFindNextMatchLineW
SetupFindNextLine
SetupGetStringFieldW
SetupGetIntField
SetupGetFieldCount
pSetupGetGlobalFlags
pSetupSetGlobalFlags
SetupDiClassNameFromGuidW
SetupDiOpenClassRegKey
CM_Locate_DevNodeW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Setup_DevNode
CM_Query_And_Remove_SubTreeW
CM_Enumerate_Classes
CM_Get_Device_IDW
SetupQueueCopyIndirectW
SetupQueueCopyW
SetupDiSetSelectedDevice
CMP_WaitNoPendingInstallEvents

wintrust

CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust

ole32

CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantClear
VariantChangeType
SysAllocString
VariantInit
SysFreeString

crypt32

CertFreeCTLContext
CryptQueryObject
CertFreeCertificateContext
CertGetCTLContextProperty

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2f37bd2cfc60f22d94e4856bdefb22d6

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

ntdll

shell32

setupapi

wintrust

ole32

oleaut32

crypt32

version

Sections

.text Size: 394KB - Virtual size: 393KB

.data Size: 3KB - Virtual size: 12KB

Shared Size: 512B - Virtual size: 8B

.rsrc Size: 103KB - Virtual size: 102KB

.tdata Size: 80KB - Virtual size: 80KB

.text
Size: 394KB - Virtual size: 393KB

.data
Size: 3KB - Virtual size: 12KB

Shared
Size: 512B - Virtual size: 8B

.rsrc
Size: 103KB - Virtual size: 102KB

.tdata
Size: 80KB - Virtual size: 80KB