5d020dff793235708640e367aa972992a40c6cf1086324e6318d16dd75ccacee

Sharing

Copy URL Twitter E-mail

General

Target

5d020dff793235708640e367aa972992a40c6cf1086324e6318d16dd75ccacee
Size

732KB
MD5

463d7d19a7512c0a9526b32ddbc16afb
SHA1

00ec779e5a4667ef1c9ae109a00dc2cb0b6ce144
SHA256

5d020dff793235708640e367aa972992a40c6cf1086324e6318d16dd75ccacee
SHA512

728a137fca61bbeb2b34a702827f429470c004d8944f520a590378153865443af7b97b7ec04644b6fcef6c4f646ec2650011d5f1ec24533673b86f1303400a04
SSDEEP

12288:hneMdTRReB7xh9TLILwnIJkTH++T9QnWOp5mNOOFW7BUGIvfiGUzNky:heMdTRR6VLTL8sH++T9QnWPwpBUniX

Score

N/A

Malware Config

Signatures

Files

5d020dff793235708640e367aa972992a40c6cf1086324e6318d16dd75ccacee
.exe windows x86

d3af09ba96f54970b8db900a042a9817

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

netapi32

NetAuditRead
NetGroupGetUsers
NetFileGetInfo
DsGetDcNameWithAccountW
NetUserGetGroups
Netbios
NetUnregisterDomainNameChangeNotification
I_NetServerAuthenticate
NetLocalGroupGetInfo
NetUserGetLocalGroups
NetGroupDel

advapi32

CryptSetKeyParam
RevertToSelf
SetTokenInformation
BuildExplicitAccessWithNameA
CryptGetDefaultProviderW
CryptAcquireContextW
RegSetValueW
RegisterEventSourceW
SystemFunction041
CreateRestrictedToken
RegSetValueExW
CreateServiceW
GetTraceLoggerHandle
EnumServiceGroupW
ImpersonateAnonymousToken
GetEventLogInformation
RegSetKeySecurity
GetSidSubAuthorityCount
RegCreateKeyExW
AreAnyAccessesGranted

kernel32

SetUnhandledExceptionFilter
VirtualAlloc
SetConsoleKeyShortcuts
GetSystemDirectoryW
GetLogicalDriveStringsA
GetStdHandle
SetVolumeLabelA
FlushViewOfFile
FindNextVolumeW
EndUpdateResourceA

rtutils

RouterLogEventStringW
TraceRegisterExW
RouterLogEventExA
TracePrintfW
RouterLogRegisterW
RouterLogRegisterA
RouterLogDeregisterW
LogEventW
TracePrintfExA
RouterLogEventStringA
TraceRegisterExA
LogErrorA
TraceDumpExA

dnsapi

DnsRecordListFree
DnsNameCompare_W
DnsNotifyResolver
DnsModifyRecordsInSet_UTF8
DnsReplaceRecordSetUTF8
DnsValidateName_UTF8
DnsDhcpSrvRegisterTerm
DnsQueryConfig
DnsQuery_W
DnsQuery_UTF8
DnsNameCompareEx_W
DnsValidateName_W

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.aZvwK
Size: 186KB - Virtual size: 333KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.iTWhDN
Size: 392KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 262B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3af09ba96f54970b8db900a042a9817

Headers

File Characteristics

Imports

netapi32

advapi32

kernel32

rtutils

dnsapi

Sections

.text Size: 30KB - Virtual size: 29KB

.aZvwK Size: 186KB - Virtual size: 333KB

.iTWhDN Size: 392KB - Virtual size: 632KB

.rsrc Size: 121KB - Virtual size: 121KB

.reloc Size: 512B - Virtual size: 262B

.text
Size: 30KB - Virtual size: 29KB

.aZvwK
Size: 186KB - Virtual size: 333KB

.iTWhDN
Size: 392KB - Virtual size: 632KB

.rsrc
Size: 121KB - Virtual size: 121KB

.reloc
Size: 512B - Virtual size: 262B