132124e0f7f695874b0e22918087dcbff6e483d111c4675df15981777edd73b2

Sharing

Copy URL

Twitter E-mail

General

Target

132124e0f7f695874b0e22918087dcbff6e483d111c4675df15981777edd73b2
Size

718KB
MD5

df9203d71607f84c3f87adf9f7c8e9a9
SHA1

82fcdf4536ec895285c72ec91b0d69f151abf252
SHA256

132124e0f7f695874b0e22918087dcbff6e483d111c4675df15981777edd73b2
SHA512

de4d000518d19369ed6cd6f0fc26aaf41f64f35d9d1a18f318218576333d2bc652ee7fba52c29f044f6b0f9c5c0256c116f7cffa98f141017ffbc1f78ba22650
SSDEEP

12288:9f9L48nttifU93DXSDi270xygqkLvgAW0qp1aGeYD0YHSSTnyE/52RmH:p9LrtifA7SW270xygqk7lWf7aw007zVh

Score

N/A

Malware Config

Signatures

Files

132124e0f7f695874b0e22918087dcbff6e483d111c4675df15981777edd73b2
.exe windows x86

f12331b061314da6e1ea2a9bf10e0a6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

GetExplicitEntriesFromAclW
WmiExecuteMethodW
CreatePrivateObjectSecurityEx
QueryServiceConfigA
CryptContextAddRef
QueryServiceStatus
RevertToSelf
GetSidLengthRequired
AllocateAndInitializeSid
AddAccessAllowedAceEx
GetOldestEventLogRecord
OpenEventLogW
SetFileSecurityW
BuildSecurityDescriptorW
GetNamedSecurityInfoA
BuildTrusteeWithObjectsAndSidW
GetSidIdentifierAuthority
RegSetKeySecurity
RegCreateKeyExW
CommandLineFromMsiDescriptor
GetCurrentHwProfileW

kernel32

SetErrorMode
GetStdHandle
GlobalLock
CreateIoCompletionPort
WriteTapemark
OutputDebugStringW
GetLastError
ExpandEnvironmentStringsA
LocalFree
CreateTapePartition
TlsAlloc
LoadLibraryW
RtlZeroMemory
DeviceIoControl
MapViewOfFileEx
GetVersion
VirtualAlloc
SetVolumeMountPointW
GetSystemTimeAsFileTime
GetFileSizeEx
SizeofResource
GetStringTypeA
EnterCriticalSection
MulDiv
CreateHardLinkW
DefineDosDeviceW
ReadConsoleOutputA
DisconnectNamedPipe

cfgmgr32

CM_Get_DevNode_Registry_PropertyW
CM_Enumerate_Classes_Ex
CM_Get_Child
CM_Locate_DevNode_ExW
CM_Get_Device_IDW
CMP_WaitNoPendingInstallEvents
CM_Get_Device_ID_ExW
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Next_Res_Des_Ex
CM_Get_Hardware_Profile_Info_ExW
CM_Open_DevNode_Key_Ex
CM_Connect_MachineW
CM_Get_First_Log_Conf_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_HW_Prof_Flags_ExW
CM_Get_DevNode_Status_Ex
CM_Free_Log_Conf_Handle
CM_Disconnect_Machine
CM_Get_Device_ID_Size
CM_Get_Device_Interface_List_Size_ExW
CM_Get_DevNode_Status
CM_Free_Res_Des_Handle
CM_Get_Device_Interface_List_ExW
CM_Get_Parent
CM_Locate_DevNodeW
CM_Get_Parent_Ex
CM_Get_Device_ID_List_ExW

rasapi32

RasGetSubEntryPropertiesW
RasGetCustomAuthDataW
RasSetEntryPropertiesW
RasSetCustomAuthDataW
RasGetEapUserIdentityW
RasGetEntryDialParamsW
RasEnumConnectionsA
RasSetCredentialsW
RasSetEapUserDataA
RasGetEntryPropertiesW
RasGetProjectionInfoW
RasGetConnectStatusW
RasSetSubEntryPropertiesW
RasFreeEapUserIdentityW
RasGetEntryHrasconnW
RasEnumEntriesW
RasGetHport
RasHangUpW
RasDeleteEntryW
RasGetCredentialsW
RasConnectionNotificationW
RasEnumConnectionsW
RasValidateEntryNameW
RasGetAutodialAddressW
RasSetAutodialAddressW
RasEnumDevicesW

msvcrt

??2@YAPAXI@Z
_makepath
_mktemp
wcsncmp
_open
floor
_wtempnam
wcscspn
_fileno
_fullpath
_swab
strpbrk
_mkdir
fputc
mktime
strncat
??3@YAXPAX@Z
_wchdir
wcslen
isspace
wcstombs
fread
rand
_mbsncpy
_tolower
_pctype
_CIpow
_dup2
vfprintf
_mbsinc
_unlock
fprintf
__pioinfo
_time64

imm32

ImmSetCompositionWindow
ImmUnlockIMC
ImmGetCompositionStringW
ImmDisableIME
ImmGetIMEFileNameW
ImmSetOpenStatus
ImmGetDefaultIMEWnd
ImmConfigureIMEW
ImmSetCompositionFontW
ImmSetConversionStatus
ImmEnumRegisterWordW
ImmGetProperty
ImmRequestMessageW
ImmGetIMEFileNameA
ImmSetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmDestroyContext
ImmGetImeMenuItemsW
ImmLockIMCC
ImmAssociateContext

crypt32

CryptDecodeMessage

winspool.drv

AddPrintProcessorW
DeleteFormW
GetJobA
ReadPrinter
SetJobW
AddPrinterConnectionW
EndPagePrinter
GetPrinterDataW
EnumFormsW
DevicePropertySheets
GetPrinterDriverDirectoryW
FreePrinterNotifyInfo
FindClosePrinterChangeNotification
EnumFormsA
EnumPrintProcessorsW
DocumentPropertySheets
GetPrinterDataExW
ConfigurePortW
OpenPrinterW
ClosePrinter
DocumentPropertiesA
StartDocPrinterW
DeviceCapabilitiesA
AddPrinterDriverW
EnumPrinterDataW

Sections

.data
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 36KB - Virtual size: 354KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 584KB - Virtual size: 903KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 310B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f12331b061314da6e1ea2a9bf10e0a6c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

cfgmgr32

rasapi32

msvcrt

imm32

crypt32

winspool.drv

Sections

.data Size: 1024B - Virtual size: 1000B

.rdata Size: 2KB - Virtual size: 1KB

.text Size: 36KB - Virtual size: 354KB

.rdata Size: 584KB - Virtual size: 903KB

.rsrc Size: 93KB - Virtual size: 93KB

.reloc Size: 512B - Virtual size: 310B

.data
Size: 1024B - Virtual size: 1000B

.rdata
Size: 2KB - Virtual size: 1KB

.text
Size: 36KB - Virtual size: 354KB

.rdata
Size: 584KB - Virtual size: 903KB

.rsrc
Size: 93KB - Virtual size: 93KB

.reloc
Size: 512B - Virtual size: 310B