57ee81ca09c203aacbc03333bc00fc3e718073f92fa933dd2b093d7fa59bfc3c

Sharing

Copy URL Twitter E-mail

General

Target
57ee81ca09c203aacbc03333bc00fc3e718073f92fa933dd2b093d7fa59bfc3c
Size 331KB
Sample221121-nrccvscd4t
SHA256 57ee81ca09c203aacbc03333bc00fc3e718073f92fa933dd2b093d7fa59bfc3c
MD5 2d2775744508b0ce5309c4feca98af75
SHA1 fc1ed9489b6de5a0a5630468f9543a705cf246f6
SHA512 a9f36942d40f69209b7f35ce5060e2f99da12ca6fa50447168c962513ea126f9c9170a0c65755802ef081b5ccc15972a3afc128201d0367d0d7d077964419703
SSDEEP 6144:/a0kcCVmYTaaZY+qEHWcUTrQSDS2eSZg6Oy4h1vM0t:/a0kcYm+q+esSDSDSZncj0
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

57ee81ca09c203aacbc03333bc00fc3e718073f92fa933dd2b093d7fa59bfc3c

.exe 331KB

57ee81ca09c203aacbc03333bc00fc3e718073f92fa933dd2b093d7fa59bfc3c

IMPHASH c7a4716d27ffa1f8c0483064cc8ea859
SHA256 57ee81ca09c203aacbc03333bc00fc3e718073f92fa933dd2b093d7fa59bfc3c
MD5 2d2775744508b0ce5309c4feca98af75
SHA1 fc1ed9489b6de5a0a5630468f9543a705cf246f6
SHA512 a9f36942d40f69209b7f35ce5060e2f99da12ca6fa50447168c962513ea126f9c9170a0c65755802ef081b5ccc15972a3afc128201d0367d0d7d077964419703
SSDEEP 6144:/a0kcCVmYTaaZY+qEHWcUTrQSDS2eSZg6Oy4h1vM0t:/a0kcYm+q+esSDSDSZncj0
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

229376

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_CxxThrowException ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z wcstok __CxxFrameHandler setlocale wcslen _vsnwprintf _except_handler3 _purecall _wcsicmp _c_exit _exit _XcptFilter _cexit exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type ??1type_info@@UAE@XZ __dllonexit _onexit ?terminate@@YAXXZ _controlfp

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW MapGenericMask AccessCheck AdjustTokenPrivileges GetTokenInformation RegQueryValueExW MakeAbsoluteSD OpenProcessToken OpenThreadToken GetAclInformation ImpersonateLoggedOnUser RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetSecurityDescriptorLength MakeSelfRelativeSD RegDisablePredefinedCache RevertToSelf SetThreadToken FreeSid SetSecurityDescriptorDacl AddAce InitializeAcl GetLengthSid CopySid AllocateAndInitializeSid InitializeSecurityDescriptor ReportEventW RegisterEventSourceW DeregisterEventSource RegSetValueExW

kernel32

HeapDestroy HeapAlloc HeapFree DeleteCriticalSection InterlockedCompareExchange GetProcAddress GetModuleHandleW lstrcmpiW GetCurrentProcessId CloseHandle InterlockedIncrement InterlockedDecrement SetEvent InitializeCriticalSectionAndSpinCount TerminateProcess GetCurrentProcess GetLastError WaitForMultipleObjects GetCurrentThreadId WaitForSingleObject DuplicateHandle Sleep CreateThread UnmapViewOfFile GetVersionExW HeapCreate LocalFree MapViewOfFile CreateFileMappingW OpenFileMappingW OpenEventW lstrlenW GetModuleFileNameW DebugBreak EnterCriticalSection LeaveCriticalSection TlsAlloc TlsFree ChangeTimerQueueTimer InterlockedExchange SwitchToThread CreateEventW LCMapStringW GetTickCount GetCurrentThread QueryPerformanceCounter GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleA GetStartupInfoA GetProcessHeap GetCommandLineW GetStringTypeExW

user32

PostMessageW DefWindowProcW DeleteMenu GetSystemMenu UpdateWindow ShowWindow CreateWindowExW RegisterClassW LoadCursorW MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects PeekMessageW GetMessageW TranslateMessage DispatchMessageW DestroyWindow UnregisterClassW LoadIconW

ntdll

NtQuerySystemInformation wcstol wcsncpy

wbemcomn

?DebugTrace@@YAHDPBDZZ ?ErrorTrace@@YAHDPBDZZ

fastprox

?New@CWbemCallSecurity@@SGPAV1@XZ

ncobjapi

WmiCreateObjectWithFormat WmiEventSourceDisconnect WmiDestroyObject WmiSetAndCommitObject WmiEventSourceConnect

oleaut32

SafeArrayGetUBound SafeArrayGetElement SafeArrayGetLBound VariantClear SysAllocString SysFreeString SafeArrayGetDim SysAllocStringLen VariantInit

ole32

CoImpersonateClient CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoCreateGuid CoGetClassObject CLSIDFromString StringFromGUID2 CoUninitialize CoRevertToSelf CoSwitchCallContext CoGetCallContext CoCreateInstance CoRegisterClassObject CoFreeUnusedLibrariesEx CoInitializeEx CoInitializeSecurity CoRevokeClassObject

rpcrt4

RpcMgmtSetServerStackSize

Name

.text

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

63KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE