c8bf894572e1c4de1beb4aaa2f3b17e6a6b1c1c49bc85fcc58fe9fcc923aca00

Sharing

Copy URL

Twitter E-mail

General

Target

c8bf894572e1c4de1beb4aaa2f3b17e6a6b1c1c49bc85fcc58fe9fcc923aca00
Size

1.8MB
MD5

6f2d2f676e6bac09b2162d1c710b2b72
SHA1

327dd942a5adee91f8d91e97a5800579a74b2ba5
SHA256

c8bf894572e1c4de1beb4aaa2f3b17e6a6b1c1c49bc85fcc58fe9fcc923aca00
SHA512

0fdbb51ab31715aa9f6c6d3a16269e4096dc1f5987a41265fff1d9d03d750a14bb50420360b126231c94c0ab6f3010db7417d3ab408518b5724437f355756d9f
SSDEEP

49152:nvYgZ1gxA3HCLeS/kRQ3aiAfhjOEc+ptGEIJIb8:w7+3iGNGpO8

Score

N/A

Malware Config

Signatures

Files

c8bf894572e1c4de1beb4aaa2f3b17e6a6b1c1c49bc85fcc58fe9fcc923aca00
.exe windows x86

fb41a20ca94a9a79d2f293b323ed7621

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

modemui

CountryRunOnce
drvGetDefaultCommConfigA

wtsapi32

WTSVirtualChannelRead
WTSLogoffSession
WTSVirtualChannelClose
WTSWaitSystemEvent
WTSEnumerateServersA
WTSEnumerateSessionsW
WTSRegisterSessionNotification
WTSQuerySessionInformationA
WTSVirtualChannelWrite
WTSQueryUserToken
WTSEnumerateProcessesA
WTSSetSessionInformationA
WTSVirtualChannelOpen
WTSFreeMemory
WTSVirtualChannelQuery
WTSOpenServerW
WTSUnRegisterSessionNotification

rsaenh

CPEncrypt
CPCreateHash
CPGenKey

user32

GetPropA
IsCharLowerW
PostMessageA
LoadImageA
GetCaretPos
CharToOemA
wsprintfA
GetMessageA
DispatchMessageA
IsWindow
PeekMessageA
SetCursorPos
GetWindowTextA
DialogBoxParamA
GetWindowLongA

advapi32

RegQueryValueA
IsValidSid
RegSaveKeyA
ClearEventLogA
ControlService
RegEnumKeyA
RegOpenKeyExA
RegFlushKey
RegCloseKey
InitializeSid
IsValidSecurityDescriptor
IsTextUnicode
OpenServiceA
RegCreateKeyA
IsValidAcl
RegDeleteKeyA

msimg32

TransparentBlt
vSetDdrawflag
AlphaBlend

shlwapi

UrlUnescapeA
UrlHashA
UrlEscapeA
PathCombineA
UrlCanonicalizeA
UrlIsNoHistoryW
UrlGetLocationA
UrlCombineA
PathCommonPrefixA
UrlCreateFromPathA
UrlIsOpaqueA
UrlIsA
UrlCompareA

kernel32

GetProcAddress
GetEnvironmentVariableA
GetConsoleTitleA
GetDateFormatA
SetFilePointer
WaitForSingleObject
WriteConsoleA
GetBinaryTypeA
LoadLibraryA
GetPrivateProfileIntA
GetCurrentProcess
GetTimeFormatA
GetNumberFormatW

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb41a20ca94a9a79d2f293b323ed7621

Headers

DLL Characteristics

File Characteristics

Imports

modemui

wtsapi32

rsaenh

user32

advapi32

msimg32

shlwapi

kernel32

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.data Size: 1024B - Virtual size: 580B

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 22KB - Virtual size: 22KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 1024B - Virtual size: 580B

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 22KB - Virtual size: 22KB

.reloc
Size: 6KB - Virtual size: 6KB