1854283aeb39f78cc3c4cb37849b76d41290b60d5aeb59f3cb9450751533049f

Sharing

Copy URL Twitter E-mail

General

Target

1854283aeb39f78cc3c4cb37849b76d41290b60d5aeb59f3cb9450751533049f
Size

49KB
MD5

c3ea8423ca973e03393b06952a93eadb
SHA1

9a3fbff0df79d4a1913d729deb25d74b395972d1
SHA256

1854283aeb39f78cc3c4cb37849b76d41290b60d5aeb59f3cb9450751533049f
SHA512

3543ded58fb14cd4bf585a219a0bdac8a20413e024ad0a0ee2e8e8e7e8541cb35a8d8a336777b32d81b20e52c5fae6ff24e7021a0a4eebfe43b698def4c04be5
SSDEEP

768:XGZrg659aBU0dg/0ayqWJXUWGgJbhutQbJc0hXvYZHxeD1+PDnoPup:m865gBU0d+gXUWrkEJ/hgYAPDo2

Score

N/A

Malware Config

Signatures

Files

1854283aeb39f78cc3c4cb37849b76d41290b60d5aeb59f3cb9450751533049f
.exe windows x86

cd34303891171fb5835b5bd38eea5ec5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__commode
__p__fmode
__setusermatherr
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__getmainargs
memcpy
memset
strcpy_s
_vsnprintf_s

ntdll

NtCreatePort
NtConnectPort
NtListenPort
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
NtSetSecurityObject
NtOpenEvent
RtlFreeHeap
RtlAllocateHeap
RtlNtStatusToDosError
RtlSetProcessIsCritical
NtSetInformationProcess
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
NtSetInformationFile
RtlCreateSecurityDescriptor
RtlLengthSid
RtlSetOwnerSecurityDescriptor
RtlCreateAcl
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlAllocateAndInitializeSid
RtlAddMandatoryAce
RtlSetSaclSecurityDescriptor
RtlMakeSelfRelativeSD
RtlUnhandledExceptionFilter
DbgPrintEx
NtRequestWaitReplyPort

rpcrt4

I_RpcMapWin32Status
RpcServerRegisterIf2
RpcServerListen
RpcServerUseProtseqEpW
NdrServerCall2

sspisrv

SspiSrvInitialize
SspiSrvClientCallback

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetErrorMode
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-interlocked-l1-1-0

InterlockedCompareExchange
InterlockedExchange

api-ms-win-core-libraryloader-l1-1-0

GetProcAddress
LoadLibraryExW
GetModuleHandleA

api-ms-win-core-localregistry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-misc-l1-1-0

LocalAlloc
LocalFree
Sleep

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
SetEnvironmentVariableW

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
GetCurrentProcess
ExitThread
CreateThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

SetEvent
OpenEventW
CreateEventW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-security-base-l1-1-0

GetTokenInformation

Exports

Exports

LsaGetInterface
LsaRegisterExtension

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sexcokt
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cd34303891171fb5835b5bd38eea5ec5

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

rpcrt4

sspisrv

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 972B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 29KB

sexcokt Size: - Virtual size: 4KB

.text
Size: 16KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 972B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 29KB

sexcokt
Size: - Virtual size: 4KB