ad50f05cc9c6d3251d8f2ba0b605e73746653cf17182c2f051316ed50478aa46

Sharing

Copy URL Twitter E-mail

General

Target

ad50f05cc9c6d3251d8f2ba0b605e73746653cf17182c2f051316ed50478aa46
Size

732KB
MD5

d53cef38a7ad20a081ce4c8442a38844
SHA1

ff41827381558fb1cdc8f76c76239c57d380673e
SHA256

ad50f05cc9c6d3251d8f2ba0b605e73746653cf17182c2f051316ed50478aa46
SHA512

c104ada05fc52f674d3dc58c19c7f65e52e20190dfeb0edeb591981855efd65f357caa3ee7e72bed4b363324d0b0dd8df8deb2e15388af6498b407d2fdf547e6
SSDEEP

12288:MneMdTRReB7xh9TLILwnIJkTH++T9QnWOp5mNOOFW7BUGIvfiGUzN+:MeMdTRR6VLTL8sH++T9QnWPwpBUniX

Score

N/A

Malware Config

Signatures

Files

ad50f05cc9c6d3251d8f2ba0b605e73746653cf17182c2f051316ed50478aa46
.exe windows x86

d3af09ba96f54970b8db900a042a9817

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

netapi32

NetAuditRead
NetGroupGetUsers
NetFileGetInfo
DsGetDcNameWithAccountW
NetUserGetGroups
Netbios
NetUnregisterDomainNameChangeNotification
I_NetServerAuthenticate
NetLocalGroupGetInfo
NetUserGetLocalGroups
NetGroupDel

advapi32

CryptSetKeyParam
RevertToSelf
SetTokenInformation
BuildExplicitAccessWithNameA
CryptGetDefaultProviderW
CryptAcquireContextW
RegSetValueW
RegisterEventSourceW
SystemFunction041
CreateRestrictedToken
RegSetValueExW
CreateServiceW
GetTraceLoggerHandle
EnumServiceGroupW
ImpersonateAnonymousToken
GetEventLogInformation
RegSetKeySecurity
GetSidSubAuthorityCount
RegCreateKeyExW
AreAnyAccessesGranted

kernel32

SetUnhandledExceptionFilter
VirtualAlloc
SetConsoleKeyShortcuts
GetSystemDirectoryW
GetLogicalDriveStringsA
GetStdHandle
SetVolumeLabelA
FlushViewOfFile
FindNextVolumeW
EndUpdateResourceA

rtutils

RouterLogEventStringW
TraceRegisterExW
RouterLogEventExA
TracePrintfW
RouterLogRegisterW
RouterLogRegisterA
RouterLogDeregisterW
LogEventW
TracePrintfExA
RouterLogEventStringA
TraceRegisterExA
LogErrorA
TraceDumpExA

dnsapi

DnsRecordListFree
DnsNameCompare_W
DnsNotifyResolver
DnsModifyRecordsInSet_UTF8
DnsReplaceRecordSetUTF8
DnsValidateName_UTF8
DnsDhcpSrvRegisterTerm
DnsQueryConfig
DnsQuery_W
DnsQuery_UTF8
DnsNameCompareEx_W
DnsValidateName_W

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.aZvwK
Size: 186KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.iTWhDN
Size: 392KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 262B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3af09ba96f54970b8db900a042a9817

Headers

File Characteristics

Imports

netapi32

advapi32

kernel32

rtutils

dnsapi

Sections

.text Size: 30KB - Virtual size: 29KB

.aZvwK Size: 186KB - Virtual size: 333KB

.iTWhDN Size: 392KB - Virtual size: 632KB

.rsrc Size: 121KB - Virtual size: 121KB

.reloc Size: 512B - Virtual size: 262B

.text
Size: 30KB - Virtual size: 29KB

.aZvwK
Size: 186KB - Virtual size: 333KB

.iTWhDN
Size: 392KB - Virtual size: 632KB

.rsrc
Size: 121KB - Virtual size: 121KB

.reloc
Size: 512B - Virtual size: 262B