44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003

General

Target

44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003
Size

204KB
MD5

1670f783fc5bc7d5b5f38f0a17a71b08
SHA1

1c5bd36b21a7729b5de7e6ac43ae3d7b6f0006b7
SHA256

44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003
SHA512

dce76bd1f7eb20e78519f0aeee6a703953be67bfbbeeefb3db8433803ba0185553ff830f6d1a457921b4d5123fff07a166e2360b4c2aa6973ed011fa7ed4473d
SSDEEP

6144:FJNZKQMkmsRMYCrAenKhvRiDixaZP31uE:rNZftV2HrAeKhsu0Ph

Score

N/A

Malware Config

Signatures

Files

44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003
.dll windows x86

0681600cc1d31be495cbb908b46f837a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
WinExec
DisableThreadLibraryCalls
Sleep
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
GetLastError
WideCharToMultiByte
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapFree
CloseHandle
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
GetStringTypeA
GetStringTypeW
MultiByteToWideChar
LCMapStringA
LCMapStringW
RtlUnwind

advapi32

RegQueryValueExA
RegOpenKeyA

Exports

Exports

WlxActivateUserShell
WlxDisconnectNotify
WlxDisplayLockedNotice
WlxDisplaySASNotice
WlxDisplayStatusMessage
WlxGetConsoleSwitchCredentials
WlxGetStatusMessage
WlxInitialize
WlxIsLockOk
WlxIsLogoffOk
WlxLoggedOnSAS
WlxLoggedOutSAS
WlxLogoff
WlxNegotiate
WlxNetworkProviderLoad
WlxReconnectNotify
WlxRemoveStatusMessage
WlxScreenSaverNotify
WlxShutdown
WlxStartApplication
WlxWkstaLockedSAS

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0681600cc1d31be495cbb908b46f837a

Headers

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 172KB - Virtual size: 177KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 172KB - Virtual size: 177KB

.reloc
Size: 4KB - Virtual size: 3KB