938cf4b31913550b9c4bfad2af2e98824e4feaea47fdd070d9ff966c0036a148

Sharing

Copy URL Twitter E-mail

General

Target

938cf4b31913550b9c4bfad2af2e98824e4feaea47fdd070d9ff966c0036a148
Size

298KB
MD5

762370e24e9f5233ae628aae8e1e72c0
SHA1

1da305c5368de144351c0e3e1eee7d3f51190a2e
SHA256

938cf4b31913550b9c4bfad2af2e98824e4feaea47fdd070d9ff966c0036a148
SHA512

df4827b0f57bd00d588a7b23317787c843b2ae5dc1d6c1ca5a686393dbb26293370ca75836c83bdd4998ed40700db65bde37d3c7e5bae603c779bef848cce477
SSDEEP

6144:roi3T9Gu8niBjQWZuc201AQ35n9nMSmUAnKgm2qMWpVyC6UFsh52C2:rPD9oi9ZEpK5FjmUAKL2pWpVyC6UFWF2

Score

N/A

Malware Config

Signatures

Files

938cf4b31913550b9c4bfad2af2e98824e4feaea47fdd070d9ff966c0036a148
.exe windows x86

a6b95e8ce24c54140ca20289c673e92a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetClientRect
ShowWindowAsync
MoveWindow
TileWindows
GetWindowTextA
DeferWindowPos
CreateWindowExA
DefDlgProcA
GetWindowPlacement
MessageBoxExA
SetWindowPlacement
FindWindowExA

advapi32

RegisterEventSourceW
RegCreateKeyA
GetOldestEventLogRecord
RegDeleteKeyA
OpenBackupEventLogW
RegisterEventSourceA
SetTokenInformation
AdjustTokenPrivileges
RegOverridePredefKey

kernel32

SetEvent
IsValidCodePage
OpenMutexA
WritePrivateProfileStructA
GetProfileStringA
WritePrivateProfileSectionA
GetPrivateProfileStringA
GetModuleHandleA
GetProcAddress
VirtualAlloc
GlobalAlloc
GetStartupInfoA
LocalAlloc
GetCPInfoExA
OpenSemaphoreA
GetACP
WaitForSingleObject
HeapSize
GlobalFlags
GetSystemDefaultLangID
HeapWalk
VirtualLock
LocalReAlloc

netapi32

NetGetAnyDCName
NetGroupAddUser
NetFileClose
NetFileEnum
NetGroupAdd
NetErrorLogRead
NetErrorLogClear
NetConfigSet
NetConfigGetAll
NetErrorLogWrite
NetFileGetInfo
NetMessageNameAdd
NetMessageBufferSend
NetMessageNameDel
NetGetJoinInformation
NetAuditWrite
NetGetJoinableOUs
NetGetDCName

wtsapi32

WTSEnumerateProcessesA
WTSEnumerateSessionsA
WTSCloseServer
WTSTerminateProcess
WTSQueryUserConfigW
WTSVirtualChannelOpen
WTSOpenServerA
WTSEnumerateSessionsW
WTSQueryUserConfigA
WTSVirtualChannelClose
WTSDisconnectSession
WTSEnumerateServersA
WTSQueryUserToken
WTSSendMessageA
WTSEnumerateProcessesW
WTSVirtualChannelRead
WTSFreeMemory

uxtheme

IsAppThemed
GetThemeFont
CloseThemeData
GetThemePropertyOrigin
IsThemePartDefined
DrawThemeText
EnableTheming
GetThemeColor
GetThemeAppProperties
GetThemePosition
GetThemeSysBool
GetThemeSysColorBrush
GetThemeTextExtent
GetThemeTextMetrics
GetThemeEnumValue

usp10

ScriptItemize
ScriptApplyLogicalWidth
ScriptGetGlyphABCWidth
ScriptStringOut
ScriptStringCPtoX
ScriptPlace
ScriptFreeCache
ScriptString_pLogAttr
ScriptGetCMap
ScriptStringAnalyse
ScriptShape
ScriptLayout
ScriptTextOut
ScriptCPtoX
ScriptJustify

msvcrt

_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 274KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6b95e8ce24c54140ca20289c673e92a

Headers

File Characteristics

Imports

user32

advapi32

kernel32

netapi32

wtsapi32

uxtheme

usp10

msvcrt

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 274KB - Virtual size: 274KB

.data Size: 512B - Virtual size: 326KB

.rsrc Size: 17KB - Virtual size: 17KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 274KB - Virtual size: 274KB

.data
Size: 512B - Virtual size: 326KB

.rsrc
Size: 17KB - Virtual size: 17KB