cf204df2ed45dceed6349a36487080551e21ed3537afee3dcd931653ed681106

Sharing

Copy URL Twitter E-mail

General

Target

cf204df2ed45dceed6349a36487080551e21ed3537afee3dcd931653ed681106
Size

256KB
MD5

2bb62a66de144a929741fa5f0013c760
SHA1

02f5a2d1d1e17f42ec91912cb6e24550d3c6e159
SHA256

cf204df2ed45dceed6349a36487080551e21ed3537afee3dcd931653ed681106
SHA512

4483fc38a9b0550d738b53fd86630521bb8493f3b28b08515149fef1704aff31d577251d9cb6fd515e364fa3349861015ec507255885fb41ab46debc1f1b53cf
SSDEEP

3072:2pwirV8O2tbOVG/fKWYqB/i/0pbfFTMJcq1kzaTQiB61c2EPuf5V51cwYP4UUnXg:O2tbd/r5B/RpblxqkqQ625wwS4UUnxb

Score

N/A

Malware Config

Signatures

Files

cf204df2ed45dceed6349a36487080551e21ed3537afee3dcd931653ed681106
.exe windows x86

cdfa377b8062b8e53a34fbbd21368ecd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesW
lstrlenA
GetCurrentProcess
CreateToolhelp32Snapshot
Process32NextW
OpenProcess
LocalAlloc
LocalFree
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
WriteFile
CreateFileA
SetLastError
GetCommandLineW
SetEvent
GetModuleHandleW
InitializeCriticalSection
GetCurrentThreadId
InterlockedDecrement
LoadLibraryExW
GetModuleFileNameW
DeleteCriticalSection
RaiseException
MultiByteToWideChar
LeaveCriticalSection
InterlockedIncrement
WideCharToMultiByte
Sleep
EnterCriticalSection
lstrcmpiW
GetTickCount
GetSystemDirectoryW
GetProcAddress
LoadLibraryW
lstrlenW
FreeLibrary
GetLocalTime
FindResourceExW
GetPrivateProfileIntW
GetVersionExW
LoadResource
WaitForMultipleObjects
LockResource
ReleaseMutex
SizeofResource
GetLastError
CreateMutexW
CopyFileW
CloseHandle
FindResourceW
Process32FirstW
SetStdHandle
LoadLibraryA
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetModuleFileNameA
GetStdHandle
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
VirtualAlloc
VirtualFree
HeapCreate
GetCPInfo
LCMapStringW
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
LCMapStringA

user32

PostThreadMessageW
MessageBoxW
CharNextW
LoadStringW
GetSystemMetrics
UnregisterClassA

advapi32

SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
SetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
ChangeServiceConfig2W
CreateServiceW
ChangeServiceConfigW
StartServiceW
RegCreateKeyExW
StartServiceCtrlDispatcherW
DeleteService
OpenServiceW
RegEnumKeyExW
SetServiceStatus
DeregisterEventSource
ReportEventW
RegisterEventSourceW
ControlService
RegisterServiceCtrlHandlerW
QueryServiceStatus
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
CreateProcessAsUserW
CloseServiceHandle
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenSCManagerW

shell32

ShellExecuteW

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringLen
RegisterTypeLi
SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
VarUI4FromStr

shlwapi

PathRemoveFileSpecW
PathFindExtensionW
PathAddBackslashW
PathAppendW
PathFileExistsW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

Sections

.text
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.frdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cdfa377b8062b8e53a34fbbd21368ecd

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wtsapi32

Sections

.text Size: 116KB - Virtual size: 114KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 1KB

.frdata Size: 80KB - Virtual size: 80KB

.text
Size: 116KB - Virtual size: 114KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 1KB

.frdata
Size: 80KB - Virtual size: 80KB