8061f94de9773588315d6ec67b8dc921666414b452cc56cd6b16e4c397730342

Sharing

Copy URL Twitter E-mail

General

Target

8061f94de9773588315d6ec67b8dc921666414b452cc56cd6b16e4c397730342
Size

759KB
MD5

28954386b7002df533f7d5a7d15f7574
SHA1

3056b772938a44d3ff3b54b3925782b7665a993f
SHA256

8061f94de9773588315d6ec67b8dc921666414b452cc56cd6b16e4c397730342
SHA512

35e7caa8227bffe6f032301ed7111ebedf06f910d00b8f1351d93a22520ec801d3601e1c11e29c8ea34b57c3a6c4e35b425e172ccb125a37ec91f7154cd41f7c
SSDEEP

12288:wcw7/6QaAAHu8HWffryEuWjmSJHUdSDLfsecsqNqfHTiJYscfalO/kUPRrwYsOEH:wcw7/65AAO8HWnGhEmSJHP/Es1HkUPRg

Score

N/A

Malware Config

Signatures

Files

8061f94de9773588315d6ec67b8dc921666414b452cc56cd6b16e4c397730342
.exe windows x64

10a3eb5d4eb2b454de32c5b3d99e2903

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ExpandEnvironmentStringsW
GetFullPathNameW
RegisterWaitForSingleObject
CreateEventW
UnregisterWaitEx
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetComputerNameExW
CompareStringW
GetLocaleInfoW
EnumUILanguagesW
CreateFileW
HeapSetInformation
FreeLibrary
GetProcAddress
LoadLibraryW
LocalFree
EnterCriticalSection
LocalAlloc
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetLastError
WideCharToMultiByte
GetLastError
MultiByteToWideChar
CloseHandle
GetCurrentThread
GetVersionExW
GetSystemDirectoryW
LoadLibraryExW

msvcrt

_itow
_ultow
iswalnum
_CxxThrowException
__CxxFrameHandler3
??1type_info@@UEAA@XZ
memcpy
memset
fwprintf
_iob
_wcsicmp
__wgetmainargs
__C_specific_handler
_XcptFilter
wcsstr
wcstoul
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
_exit
_cexit
exit
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_wcsnicmp
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
memcpy_s
??0exception@@QEAA@AEBV0@@Z
wcschr
_wtoi
_scwprintf
_wtoi64
iswspace
wcsncmp
_vsnwprintf
_purecall
memcmp

ntdll

EtwLogTraceEvent
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwEventRegister
EtwEventUnregister
EtwEventWrite
EtwEventEnabled

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

SysAllocString
SysStringLen
VariantInit
VarCmp
VariantClear
SysFreeString

httpapi

HttpSetServiceConfiguration
HttpTerminate
HttpDeleteServiceConfiguration
HttpQueryServiceConfiguration
HttpInitialize

wsmsvc

?AllocBstr@WSManMemory@@SAPEAGPEBGHAEBVCallSite@TestSystem@@@Z
?Free@WSManMemory@@SAXPEAXAEBVCallSite@TestSystem@@@Z
?Alloc@WSManMemory@@SAPEAX_KAEBVCallSite@TestSystem@@W4Mode@3@@Z

advapi32

FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
SetThreadToken
RevertToSelf
CopySid
GetLengthSid
IsWellKnownSid
CredDeleteW
CredFree
CredWriteW
CredReadW
RegConnectRegistryW
LogonUserW
RegCreateKeyExW
RegEnumKeyExW
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
MapGenericMask
GetAce
GetSecurityDescriptorDacl
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetTokenInformation
OpenThreadToken
OpenProcessToken

crypt32

CertFreeCertificateContext
CryptBinaryToStringW
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptAcquireCertificatePrivateKey
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CertCloseStore
CertGetNameStringW
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW

netutils

NetApiBufferFree

wkscli

NetGetJoinInformation

rpcrt4

UuidCreate

ws2_32

WSAStartup
getnameinfo
freeaddrinfo
WSACleanup
getaddrinfo

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

10a3eb5d4eb2b454de32c5b3d99e2903

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ntdll

ole32

oleaut32

httpapi

wsmsvc

advapi32

crypt32

netutils

wkscli

rpcrt4

ws2_32

Sections

.text Size: 235KB - Virtual size: 234KB

.data Size: 8KB - Virtual size: 10KB

.pdata Size: 11KB - Virtual size: 10KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.vmp0 Size: 500KB - Virtual size: 1.8MB

.text
Size: 235KB - Virtual size: 234KB

.data
Size: 8KB - Virtual size: 10KB

.pdata
Size: 11KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.vmp0
Size: 500KB - Virtual size: 1.8MB