1d8764783dc722337c0ef8dcebf739b974cdb5547ce89e2abe3aa5af52eabd6c

Sharing

Copy URL Twitter E-mail

General

Target
1d8764783dc722337c0ef8dcebf739b974cdb5547ce89e2abe3aa5af52eabd6c
Size 776KB
Sample221121-nsaknagg65
SHA256 1d8764783dc722337c0ef8dcebf739b974cdb5547ce89e2abe3aa5af52eabd6c
MD5 22d08bf921a56046748bd81fd721ed99
SHA1 710f7e90973c75f52818e250909ad9f35f9d440d
SHA512 fc1ce7dc93e58356653d7ad0388c255aa0b1bff3a4bd37dc6118e00dca83d81ec9cd87eb72849ec2b5e542fb14eb667ee70055ccc7a09dce30f5ee5664992924
SSDEEP 12288:9xLVMsCpn5K6hRL4bZpQhGrFrBL47xLctn8ORX301Ngrb1AeR7eFE3BEkAbcBiI8:9xLYi6h2pQhoL47ZcV8ORX31A40W
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

1d8764783dc722337c0ef8dcebf739b974cdb5547ce89e2abe3aa5af52eabd6c

.exe 776KB

1d8764783dc722337c0ef8dcebf739b974cdb5547ce89e2abe3aa5af52eabd6c

IMPHASH 059c8b5c9fcbb1ab63e14cae9688b3fb
SHA256 1d8764783dc722337c0ef8dcebf739b974cdb5547ce89e2abe3aa5af52eabd6c
MD5 22d08bf921a56046748bd81fd721ed99
SHA1 710f7e90973c75f52818e250909ad9f35f9d440d
SHA512 fc1ce7dc93e58356653d7ad0388c255aa0b1bff3a4bd37dc6118e00dca83d81ec9cd87eb72849ec2b5e542fb14eb667ee70055ccc7a09dce30f5ee5664992924
SSDEEP 12288:9xLVMsCpn5K6hRL4bZpQhGrFrBL47xLctn8ORX301Ngrb1AeR7eFE3BEkAbcBiI8:9xLYi6h2pQhoL47ZcV8ORX31A40W
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

191090

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

malloc free wcscmp wcsncmp __CxxFrameHandler ??2@YAPAXI@Z sprintf strstr swprintf wcscat ??3@YAXPAX@Z exit wcsstr wcslen wcscpy mbstowcs _wcsupr memmove wcsrchr towupper wcsncpy fclose fflush mbtowc __mb_cur_max fopen wcschr _c_exit _exit _XcptFilter _cexit __initenv __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 __dllonexit _onexit _controlfp

advapi32

RegDeleteKeyA RegOpenKeyExA RegOpenKeyW InitiateSystemShutdownW RegCreateKeyExW RegSetValueExW RegUnLoadKeyW RegLoadKeyW RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW DeregisterEventSource RegOpenKeyA RegQueryValueExA RegCloseKey RegisterServiceCtrlHandlerW LookupPrivilegeValueW PrivilegeCheck AllocateAndInitializeSid FreeSid CheckTokenMembership OpenThreadToken OpenProcessToken SetServiceStatus StartServiceCtrlDispatcherW RegDeleteKeyW

kernel32

FindClose GetFileAttributesW lstrlenA InterlockedIncrement ExitThread GetProcAddress FreeLibrary TerminateThread DeleteVolumeMountPointW SetVolumeMountPointW FindFirstVolumeW FindNextVolumeW FindVolumeClose LoadLibraryW ResumeThread CreateFileA LocalAlloc GetComputerNameW IsBadCodePtr FindFirstFileW lstrcpyA IsBadWritePtr GetSystemDirectoryW GetComputerNameExW WideCharToMultiByte MultiByteToWideChar LoadLibraryA SetEndOfFile SetFilePointerEx QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleA CompareStringW GetCurrentThreadId InterlockedDecrement SetLastError HeapAlloc GetProcessHeap HeapFree QueryDosDeviceW DeviceIoControl CloseHandle CreateFileW DefineDosDeviceW GetDriveTypeW Sleep LocalFree GetLastError lstrcmpiA SetEvent lstrcmpW lstrlenW FormatMessageW GetModuleHandleW CreateEventW WaitForSingleObject LeaveCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentThread CreateThread SetErrorMode InitializeCriticalSection DeleteCriticalSection IsBadStringPtrW IsBadReadPtr lstrcpyW GetVolumeNameForVolumeMountPointW GetVolumePathNameW lstrcatW GetVolumePathNamesForVolumeNameW

user32

PostThreadMessageW GetMessageW TranslateMessage DispatchMessageW LoadIconW LoadCursorW RegisterClassW CreateWindowExW ShowWindow DefWindowProcW BroadcastSystemMessageW PostMessageW DestroyWindow wsprintfW LoadStringW PostQuitMessage

ntdll

NtFlushBuffersFile NtDeviceIoControlFile NtQueryVolumeInformationFile NtQuerySystemTime RtlAdjustPrivilege RtlExtendedLargeIntegerDivide NtQuerySystemInformation RtlFreeUnicodeString NtOpenFile RtlCreateUnicodeString NtFsControlFile NtWriteFile NtReadFile NtDeleteBootEntry NtTranslateFilePath NtEnumerateBootEntries NtModifyBootEntry NtQuerySymbolicLinkObject RtlExtendedIntegerMultiply RtlInitUnicodeString NtOpenSymbolicLinkObject NtClose

ole32

CoSuspendClassObjects CoRevertToSelf CoImpersonateClient CoTaskMemAlloc CoSetProxyBlanket CoTaskMemRealloc CoTaskMemFree CoUninitialize CoRevokeClassObject CoRegisterClassObject CoInitializeSecurity CoInitializeEx

rpcrt4

RpcServerUseProtseqEpW RpcServerRegisterIf RpcServerListen RpcMgmtStopServerListening RpcServerUnregisterIf UuidFromStringW UuidEqual UuidCreate RpcImpersonateClient RpcRevertToSelf NdrServerCall2

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList CM_Locate_DevNodeW CM_Get_Device_IDW CM_Get_Device_ID_Size_Ex CM_Get_DevNode_Status_Ex SetupDiOpenDeviceInterfaceW SetupDiCreateDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiOpenDeviceInfoW CM_Get_Parent_Ex CM_Get_Device_ID_List_ExW CM_Get_Device_ID_List_Size_ExW SetupDiEnumDeviceInterfaces CM_Reenumerate_DevNode_Ex

clusapi

GetNodeClusterState

dmutil

AddEntryBootFileGpt LowNtWriteFile LowNtReadFile LowNtReadOnlyAttributeOff GetSystemVolume GetInstallDirectoryPath LowAcquirePrivilege DynamicSupport FreeRgszw RgszwFromArgs RgszwFromValist RgszwDupRgszw GetErrorData AddEntryBootFileMbr TranslateError

osuninst

IsUninstallImageValid