5930e1b6338a4029f5d1a6370ac756f716b8eb99f88b2abbe579bf1029e28883

Sharing

Copy URL Twitter E-mail

General

Target

5930e1b6338a4029f5d1a6370ac756f716b8eb99f88b2abbe579bf1029e28883
Size

282KB
MD5

52bc8f254e4999bba1f3bb914bdb13ee
SHA1

7c1aa8d7d373c9c620534b06b7fcd78adaa6f085
SHA256

5930e1b6338a4029f5d1a6370ac756f716b8eb99f88b2abbe579bf1029e28883
SHA512

97515b4549f128d15bbf761443502e88d668e7ce19afcde0020dc766ed206d77a03f84ad682769f1966623f3fda42af0e855ad73e83f17ae2c63da91bdfddf3a
SSDEEP

3072:PNjM+9VYpAhZZkqnRiCznANiouI0MVDN/9KEQwtzuUL6Y193OmZj7rpOzbBBiKXF:thZZkqnRi0IBHR0U13L3pOzbmKX

Score

N/A

Malware Config

Signatures

Files

5930e1b6338a4029f5d1a6370ac756f716b8eb99f88b2abbe579bf1029e28883
.exe windows x86

ae4a7352f4223873eda2ab51b85e521a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegisterServiceCtrlHandlerExW
RegCloseKey
RegOpenKeyExW
RegDisablePredefinedCache
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetServiceStatus
StartServiceCtrlDispatcherW
SetThreadToken
OpenThreadToken
OpenProcessToken

kernel32

ExitProcess
Sleep
OpenEventW
GetLastError
HeapSetInformation
GetProcessHeap
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
SetEvent
SetLastError
OpenProcess
InterlockedIncrement
RaiseException
InterlockedDecrement
GetModuleHandleW
TlsSetValue
LoadLibraryA
LocalAlloc
GetCurrentThread
GetProcAddress
FreeLibrary
DeleteCriticalSection
HeapFree
HeapAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
ExitThread
InterlockedCompareExchange
InterlockedExchange
CloseHandle
WaitForSingleObject
CreateEventW
CreateThread
SetUnhandledExceptionFilter

msvcrt

__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
??3@YAXPAX@Z
_purecall
_stricmp
memset
_adjust_fdiv
__p__commode
_except_handler4_common
__p__fmode
wcschr
memcpy
?terminate@@YAXXZ
_controlfp
??2@YAPAXI@Z
_wcsicmp
__set_app_type

rpcrt4

RpcRevertToSelfEx
NdrAsyncServerCall
NdrAsyncClientCall
RpcImpersonateClient
RpcRevertToSelf
I_RpcBindingIsClientLocal
I_RpcSessionStrictContextHandle
RpcRaiseException
NdrServerCall2
RpcMgmtSetServerStackSize
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerListen
RpcServerUseProtseqEpA
RpcServerUseProtseqW
RpcObjectSetType
RpcServerRegisterIf2
RpcServerRegisterIf
RpcServerInqBindings
RpcEpRegisterW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcStringFreeW
NdrClientCall2
RpcServerTestCancel
RpcAsyncAbortCall
I_RpcExceptionFilter
RpcServerUnsubscribeForNotification
RpcServerSubscribeForNotification
I_RpcBindingInqTransportType
RpcAsyncCompleteCall

ntdll

TpWaitForWait
TpSetWait
TpReleaseTimer
TpWaitForTimer
TpReleaseIoCompletion
TpWaitForIoCompletion
TpReleaseAlpcCompletion
TpWaitForAlpcCompletion
TpCallbackMayRunLong
RtlNtStatusToDosError
TpStartAsyncIoOperation
TpAllocIoCompletion
TpAllocAlpcCompletion
TpSetPoolMinThreads
TpSetPoolMaxThreads
TpAllocPool
TpAllocWait
TpSimpleTryPost
TpPostWork
TpAllocWork
TpSetTimer
TpAllocTimer
TpReleasePool
TpReleaseWait
TpWaitForWork
RtlValidRelativeSecurityDescriptor
TpReleaseWork

slc

SLGetWindowsInformationDWORD

Exports

Exports

ServerGetPrintClassObject
ServerGetTlsBindingHandle
YAbortPrinter
YAddJob
YDriverUnloadComplete
YEndDocPrinter
YEndPagePrinter
YFlushPrinter
YGetPrinter
YGetPrinterDriver2
YGetPrinterDriverDirectory
YReadPrinter
YSeekPrinter
YSetJob
YSetPort
YSetPrinter
YSplReadPrinter
YStartDocPrinter
YStartPagePrinter
YWritePrinter

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

PACK
Size: 160KB - Virtual size: 416KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ae4a7352f4223873eda2ab51b85e521a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

rpcrt4

ntdll

slc

Exports

Exports

Sections

.text Size: 105KB - Virtual size: 104KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 6KB - Virtual size: 5KB

PACK Size: 160KB - Virtual size: 416KB

.text
Size: 105KB - Virtual size: 104KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 6KB - Virtual size: 5KB

PACK
Size: 160KB - Virtual size: 416KB