6c6602e9aae0832485b33038ec568d12be12618074b1ff34785132657884a853

Sharing

Copy URL Twitter E-mail

General

Target

6c6602e9aae0832485b33038ec568d12be12618074b1ff34785132657884a853
Size

777KB
MD5

0617a1bc7ff268224cdc9876b6300800
SHA1

1a1cc0d00cc1a7027f936bea7358f9b42af45322
SHA256

6c6602e9aae0832485b33038ec568d12be12618074b1ff34785132657884a853
SHA512

2ce4d9c46eec10954f3e98965efc132dc1794c562b2021ff0146afc437f6355df3858c49d4fc5e84478d5e22cb6024c50818fe1470014064cbe9291623dfbbc5
SSDEEP

24576:g3OIgdQeED/TGSgbr8MxEGfukBkEM2g2q9sC2:geHdQZTGSgb4MxEGmkJa2EsC

Score

N/A

Malware Config

Signatures

Files

6c6602e9aae0832485b33038ec568d12be12618074b1ff34785132657884a853
.exe windows x86

af1b9be288963da87900a6d9958016b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

rtutils

TraceRegisterExW
TraceVprintfExA
RouterLogEventExW
RouterLogEventA
RouterLogDeregisterA
LogEventA
RouterLogEventExA
TracePrintfExA
TraceDumpExA
RouterLogRegisterA
RouterLogDeregisterW
LogErrorA
MprSetupProtocolFree
RouterLogEventW
TraceDeregisterExA
TracePrintfW
TraceDeregisterA
TracePrintfExW
RouterLogRegisterW
TracePrintfA
TraceDeregisterW
RouterLogEventDataA
MprSetupProtocolEnum
RouterLogEventStringW
LogEventW
TracePutsExA
TraceRegisterExA
RouterLogEventStringA

crypt32

I_CertSrvProtectFunction

shlwapi

PathFindNextComponentW
StrCSpnIW
SHAutoComplete
SHRegQueryInfoUSKeyW
SHQueryValueExW
StrSpnW
SHDeleteValueW
PathGetArgsW
wnsprintfW
StrCpyNW
SHDeleteKeyW
StrDupW
PathSkipRootW
HashData
PathRemoveExtensionA
PathRemoveFileSpecA
StrSpnA
StrStrW
StrRChrW
UrlCanonicalizeW

msvcrt

wcsncmp
labs
iswspace
_CIlog10
_finite
strncat
__toascii
??1exception@@UAE@XZ
_mbsnextc
_mbsdec
fseek
floor
??9type_info@@QBEHABV0@@Z
memcmp
_access
_setjmp3
isalpha
_ismbblead
_mbsnbcnt
_mbscpy
_mbsinc
wcstol
_acmdln
bsearch
_fullpath
??_V@YAXPAX@Z

advapi32

RegisterServiceCtrlHandlerA
ControlService
SetSecurityDescriptorGroup
CryptExportKey
RegOpenKeyExW
WmiOpenBlock
SetFileSecurityA
LsaICLookupNames
ObjectCloseAuditAlarmA
DeregisterEventSource
LsaCreateSecret
LsaLookupNames
SystemFunction012
RegisterEventSourceW
RegQueryValueExA
RegOpenKeyW
RegRestoreKeyA
CryptGetUserKey
QueryServiceConfigA
AllocateLocallyUniqueId
GetSecurityDescriptorDacl
LsaQueryInformationPolicy
InitializeSid
GetTokenInformation
InitiateSystemShutdownExW
SystemFunction041
RegisterServiceCtrlHandlerExW
CryptVerifySignatureW
RegCreateKeyExW

setupapi

CM_Get_DevNode_Registry_Property_ExW
SetupDiSetClassInstallParamsA
pSetupGetGlobalFlags
SetupDiGetSelectedDevice
SetupGetIntField
SetupInstallFilesFromInfSectionW
CM_Get_Device_ID_ExW
SetupAddInstallSectionToDiskSpaceListW
SetupFindFirstLineA
CM_Get_Sibling
CM_Get_Next_Res_Des_Ex
CM_Get_Device_ID_List_SizeW
SetupDiGetDeviceRegistryPropertyW
CM_Open_DevNode_Key_Ex
SetupQuerySourceListW
SetupDiRemoveDeviceInterface
CM_Get_Sibling_Ex
CM_Setup_DevNode
CM_Get_Device_ID_ListW
pSetupSetGlobalFlags
CM_Free_Log_Conf_Handle
CM_Query_And_Remove_SubTreeW
SetupDiGetDriverInfoDetailW
SetupGetLineTextA
SetupDiOpenDeviceInfoA
SetupDiSetSelectedDevice

kernel32

ReleaseMutex
SetThreadLocale
SetFileAttributesA
lstrcatA
CreateMutexA
DebugBreak
GetShortPathNameW
ContinueDebugEvent
ReadConsoleA
SetTimerQueueTimer
GetDefaultCommConfigW
SetStdHandle
GlobalMemoryStatus
VirtualAlloc
EraseTape
SetConsoleScreenBufferSize
WritePrivateProfileStructA
RtlUnwind
SearchPathW
QueueUserWorkItem
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SwitchToThread
VirtualQueryEx
GetSystemInfo
WaitForSingleObjectEx
GetDriveTypeA
SizeofResource
EnumLanguageGroupLocalesW
GetDateFormatA
MoveFileWithProgressW

netapi32

NetFileEnum
NetShareDel
NetUserSetInfo
NetServerGetInfo
NetGetAnyDCName
NetShareEnum
NetLocalGroupGetInfo
NetUseDel
DsGetSiteNameW
I_NetServerReqChallenge
NetLocalGroupDelMembers
NetUserGetInfo
NetGroupDel
DsGetDcNameW
NetValidateName
NetUnregisterDomainNameChangeNotification
NetRenameMachineInDomain
NetUserChangePassword
NetRemoteTOD
NetServiceEnum
NetConnectionEnum
NetServiceInstall
NetStatisticsGet
NetServiceControl

user32

ShowOwnedPopups
UnhookWindowsHookEx
EnumDesktopsA
GetCursorPos
LoadStringW
MessageBeep
SystemParametersInfoA
SendMessageW
UnregisterClassA
SetLastErrorEx
LockSetForegroundWindow
CharToOemA
GetMonitorInfoA

Sections

.text
Size: 91KB - Virtual size: 547KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 80KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 87KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 136KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af1b9be288963da87900a6d9958016b4

Headers

DLL Characteristics

File Characteristics

Imports

rtutils

crypt32

shlwapi

msvcrt

advapi32

setupapi

kernel32

netapi32

user32

Sections

.text Size: 91KB - Virtual size: 547KB

.rdata Size: 221KB - Virtual size: 289KB

.bss Size: 80KB - Virtual size: 277KB

.rdata Size: 87KB - Virtual size: 242KB

.edata Size: 136KB - Virtual size: 169KB

.rsrc Size: 160KB - Virtual size: 159KB

.reloc Size: 1024B - Virtual size: 798B

.text
Size: 91KB - Virtual size: 547KB

.rdata
Size: 221KB - Virtual size: 289KB

.bss
Size: 80KB - Virtual size: 277KB

.rdata
Size: 87KB - Virtual size: 242KB

.edata
Size: 136KB - Virtual size: 169KB

.rsrc
Size: 160KB - Virtual size: 159KB

.reloc
Size: 1024B - Virtual size: 798B