cdf2d5ae7e7dbd107ad856a113e6bfab10203e95a498b98e79ea5eb6447a936e

Sharing

Copy URL Twitter E-mail

General

Target

cdf2d5ae7e7dbd107ad856a113e6bfab10203e95a498b98e79ea5eb6447a936e
Size

89KB
MD5

04608af8d9b829c50b70eb89a542ffb5
SHA1

9539b74d2d65fbe3e8c3e1b8b42f78d7cceea52a
SHA256

cdf2d5ae7e7dbd107ad856a113e6bfab10203e95a498b98e79ea5eb6447a936e
SHA512

88ac5cc051d5d687bd8e801d807a0f1640b7b21abee33a557df9ac82fc6e886b3cab8d4ce4e3bfe02882169178f307d3086a677254bd9221c651d76e038d0e56
SSDEEP

1536:SDQ+Fh0POSDOw/BaRwI5MCm6ulTyr/4/exyDj5tOqsLA6dXbDIZ:yLTo8Rw9ttyrKlj5tODU6dXoZ

Score

N/A

Malware Config

Signatures

Files

cdf2d5ae7e7dbd107ad856a113e6bfab10203e95a498b98e79ea5eb6447a936e
.exe windows x86

e6eeba611096acae1ec55db5c14bcbe4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord4213
ord2570
ord4392
ord3577
ord3605

ole32

ReleaseStgMedium
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoCreateInstance

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
InitializeSecurityDescriptor
CopySid
GetLengthSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegDeleteKeyW
RegEnumKeyExW
LsaOpenPolicy
LsaLookupNames
GetSidSubAuthorityCount
GetSidSubAuthority
LsaFreeMemory
LsaOpenAccount
LsaCreateAccount
LsaGetSystemAccessAccount
LsaSetSystemAccessAccount
LsaClose
GetSecurityDescriptorLength
GetSecurityDescriptorControl
AllocateAndInitializeSid
MakeSelfRelativeSD
FreeSid
MapGenericMask
ControlService
StartServiceW
EnumDependentServicesW
ChangeServiceConfigW
QueryServiceStatusEx
RevertToSelf
IsWellKnownSid
RegConnectRegistryW
QueryServiceStatus
GetUserNameW
RegDeleteValueW
EnumServicesStatusW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorDacl

shlwapi

ord437

gdi32

DeleteObject

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj5
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj50
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj51
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj52
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj53
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj54
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj55
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj56
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj57
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj58
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj59
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1231
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.JAKS
Size: 512B - Virtual size: 246B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GAHS
Size: 512B - Virtual size: 198B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HAJS
Size: 512B - Virtual size: 458B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HnJS
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SKALS
Size: 512B - Virtual size: 242B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SKAkS
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 302B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6eeba611096acae1ec55db5c14bcbe4

Headers

DLL Characteristics

File Characteristics

Imports

mfc42u

ole32

advapi32

shlwapi

gdi32

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 2KB - Virtual size: 2KB

.fhj5 Size: 512B - Virtual size: 196B

.fhj50 Size: 512B - Virtual size: 232B

.fhj51 Size: 512B - Virtual size: 204B

.fhj52 Size: 201KB - Virtual size: 200KB

.fhj53 Size: 201KB - Virtual size: 200KB

.fhj54 Size: 512B - Virtual size: 212B

.fhj55 Size: 512B - Virtual size: 214B

.fhj56 Size: 512B - Virtual size: 216B

.fhj57 Size: 512B - Virtual size: 214B

.fhj58 Size: 512B - Virtual size: 212B

.fhj59 Size: 512B - Virtual size: 212B

.1231 Size: 512B - Virtual size: 214B

.JAKS Size: 512B - Virtual size: 246B

.GAHS Size: 512B - Virtual size: 198B

.HAJS Size: 512B - Virtual size: 458B

.HnJS Size: 512B - Virtual size: 168B

.SKALS Size: 512B - Virtual size: 242B

.SKAkS Size: 512B - Virtual size: 260B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 302B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 2KB - Virtual size: 2KB

.fhj5
Size: 512B - Virtual size: 196B

.fhj50
Size: 512B - Virtual size: 232B

.fhj51
Size: 512B - Virtual size: 204B

.fhj52
Size: 201KB - Virtual size: 200KB

.fhj53
Size: 201KB - Virtual size: 200KB

.fhj54
Size: 512B - Virtual size: 212B

.fhj55
Size: 512B - Virtual size: 214B

.fhj56
Size: 512B - Virtual size: 216B

.fhj57
Size: 512B - Virtual size: 214B

.fhj58
Size: 512B - Virtual size: 212B

.fhj59
Size: 512B - Virtual size: 212B

.1231
Size: 512B - Virtual size: 214B

.JAKS
Size: 512B - Virtual size: 246B

.GAHS
Size: 512B - Virtual size: 198B

.HAJS
Size: 512B - Virtual size: 458B

.HnJS
Size: 512B - Virtual size: 168B

.SKALS
Size: 512B - Virtual size: 242B

.SKAkS
Size: 512B - Virtual size: 260B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 302B