da722979b69dbbdc551ba922d45e12e130891d970bc7b2e3af4dff7027718fdb

General

Target

da722979b69dbbdc551ba922d45e12e130891d970bc7b2e3af4dff7027718fdb
Size

588KB
MD5

787708e116fc795821847eb89922912a
SHA1

03af00b7d53f6a863484d54e4fe18958d6b2d188
SHA256

da722979b69dbbdc551ba922d45e12e130891d970bc7b2e3af4dff7027718fdb
SHA512

eeb9272700ce678d7122a7d7c55093a2b2c85216c0e89b680bb0b9952944351cb4bf8f96f05fa5f4db765100d957b405da3ab85a94f86b28abc68acb9beff63f
SSDEEP

12288:NDNnCIfBJaOWKosebVvgzKjOvDbEzktd9BVS7im:x5OOWFvguI/EzkXwd

Score

N/A

Malware Config

Signatures

Files

da722979b69dbbdc551ba922d45e12e130891d970bc7b2e3af4dff7027718fdb
.exe windows x86

aa5de25e7bb8afc31c7e481752c73f2e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_APPCONTAINER

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetComputerNameA
lstrcpynA
GetPrivateProfileIntA
SetEnvironmentVariableA
GetBinaryTypeA
GetDiskFreeSpaceA
GetTickCount
CompareStringA
GetTimeFormatA
SetEndOfFile
FormatMessageA
GetProcessHeap
DeviceIoControl
InterlockedExchange
InterlockedDecrement
GetProcessTimes
GetProcAddress
HeapValidate
GetCurrentDirectoryA
GetModuleHandleA
CloseHandle

shimeng

SE_ProcessDying
SE_IsShimDll
SE_InstallAfterInit

wtsapi32

WTSVirtualChannelOpen
WTSSetUserConfigA
WTSRegisterSessionNotification
WTSCloseServer
WTSSendMessageA
WTSFreeMemory
WTSVirtualChannelWrite
WTSVirtualChannelClose
WTSQueryUserToken
WTSVirtualChannelQuery
WTSUnRegisterSessionNotification
WTSEnumerateSessionsA
WTSLogoffSession
WTSQuerySessionInformationA

onex

OneXCopyAuthParams
OneXAddTLV
OneXInitialize

Sections

.text
Size: 572KB - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa5de25e7bb8afc31c7e481752c73f2e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shimeng

wtsapi32

onex

Sections

.text Size: 572KB - Virtual size: 572KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 40KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 572KB - Virtual size: 572KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 40KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 9KB - Virtual size: 9KB