a8a294ad5592d430526e1718bb43e363c54068af84b7254878fe92f5f333e809

Sharing

Copy URL Twitter E-mail

General

Target

a8a294ad5592d430526e1718bb43e363c54068af84b7254878fe92f5f333e809
Size

280KB
MD5

3296b766770f2b64d5e090aff1001240
SHA1

d62b1a68b3c034fdbfbb104ffbe8caee82caca76
SHA256

a8a294ad5592d430526e1718bb43e363c54068af84b7254878fe92f5f333e809
SHA512

69a5bd104f1f2c82a47c01e7d9af754ad2c3d9f4b638e619bbbbb0be34cc909972db8f90092d7d5bdbe05f568b60c45b2e8e7c236deb73ef5c198dbf43def81e
SSDEEP

6144:gqAc2iJa1D3fab1q4hbMvHI0w7I+Hh69gGl5vsh/Igkwq:9ABWa17fahq4hbMvHIPI+HkLl5v4nq

Score

N/A

Malware Config

Signatures

Files

a8a294ad5592d430526e1718bb43e363c54068af84b7254878fe92f5f333e809
.exe windows x86

cef286b707b776035785d8eb29f799f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

InitializeAcl
SetNamedSecurityInfoW
SetSecurityDescriptorOwner
InitializeSid
GetSecurityDescriptorOwner
GetSidLengthRequired
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
InitializeSecurityDescriptor
GetAce
GetSecurityDescriptorGroup
GetAclInformation
MakeAbsoluteSD
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
GetSecurityDescriptorSacl
GetLengthSid
GetSecurityDescriptorDacl
MakeSelfRelativeSD
CopySid
GetSecurityDescriptorControl
EqualSid
IsValidSid
GetSecurityDescriptorLength
AddAce
OpenThreadToken
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
ConvertSidToStringSidW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
TraceEvent

kernel32

TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
ReleaseMutex
GetEnvironmentVariableW
WaitForSingleObject
DuplicateHandle
CreateDirectoryW
RaiseException
DeleteFileW
FindResourceW
CloseHandle
DeleteCriticalSection
SizeofResource
lstrlenW
LockResource
LoadResource
FindResourceExW
WaitForMultipleObjects
lstrcmpiW
GetModuleHandleW
LocalFree
LoadLibraryW
CreateFileW
DeviceIoControl
GetPrivateProfileStringW
SetProcessWorkingSetSize
OpenProcess
CreateProcessW
CreateEventW
ResetEvent
lstrcmpW
GetFileAttributesExW
TlsAlloc
GetLocalTime
SetFilePointer
OutputDebugStringA
GetPrivateProfileIntW
OutputDebugStringW
MoveFileExW
GetFileTime
FlushFileBuffers
ReadFile
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
VirtualQuery
GetTempPathW
CreateMutexW
TryEnterCriticalSection
SetEvent
InterlockedCompareExchange
ReadProcessMemory
GetThreadLocale
lstrcpynW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CreateThread
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
MultiByteToWideChar
FreeEnvironmentStringsA
GetModuleFileNameW
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
CreateSemaphoreW
GetProcessId
VirtualQueryEx
RtlCaptureContext
ReleaseSemaphore
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter
GetLastError
GetStartupInfoW
GetProcessHeap
HeapAlloc
GetVersionExA
TlsGetValue
GetUserDefaultLangID
GetSystemDefaultLangID
WritePrivateProfileStringW
GetComputerNameExW
GetOverlappedResult
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
UnregisterWait
GetProcessTimes
UnregisterWaitEx
RegisterWaitForSingleObject
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetSystemInfo
VirtualProtect
HeapFree
RemoveDirectoryW

ole32

StringFromGUID2
CoCreateGuid

shell32

SHGetFolderPathW

user32

CloseClipboard
SetClipboardData
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
MessageBoxW
wsprintfW
CharUpperW
CharLowerW
wvsprintfW
DispatchMessageW
OpenClipboard
UnregisterClassA
GetMessageW
PeekMessageW
PostThreadMessageW
EmptyClipboard

netapi32

NetApiBufferFree
NetWkstaGetInfo

shlwapi

PathStripPathW
SHQueryValueExW
PathRemoveFileSpecW
PathRemoveExtensionW
PathIsRelativeW
PathAppendW
PathCanonicalizeW

userenv

UnloadUserProfile

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rrdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cef286b707b776035785d8eb29f799f7

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ole32

shell32

user32

netapi32

shlwapi

userenv

version

Sections

.text Size: 142KB - Virtual size: 142KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 17KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 15KB - Virtual size: 14KB

.rrdata Size: 68KB - Virtual size: 68KB

.text
Size: 142KB - Virtual size: 142KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 17KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 15KB - Virtual size: 14KB

.rrdata
Size: 68KB - Virtual size: 68KB