4da6e13e972463af500b7b946283664992ff6ef668458b2523573ab0498a6889

Sharing

Copy URL Twitter E-mail

General

Target

4da6e13e972463af500b7b946283664992ff6ef668458b2523573ab0498a6889
Size

1.2MB
MD5

5fa2dbce8f37a8407352acabfb129374
SHA1

468155c05330c7739dbe8b4763caac60ec991082
SHA256

4da6e13e972463af500b7b946283664992ff6ef668458b2523573ab0498a6889
SHA512

99dc622e6557f51b58b79385994e775aff89ab1314f6a109a087aa7b10527f1216e00bc8aca3525f65f88f9052c15abc0d77a0293bffd71fca65474fa1139d41
SSDEEP

24576:qyW/7WJU45bvLl1RnngaeWJb8+keRuOHAX5QxwCRJi1Ic0CHtQxS:qd/7WJU45bvLl1Rnnpb88YOHAcXcV0Cd

Score

N/A

Malware Config

Signatures

Files

4da6e13e972463af500b7b946283664992ff6ef668458b2523573ab0498a6889
.exe windows x86

929879191b781359908bef05d2a18e83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntW
LCMapStringW
GetStringTypeW
GetLocaleInfoA
RtlUnwind
VirtualAlloc
HeapAlloc
IsValidCodePage
GetACP
FreeEnvironmentStringsW
EnterCriticalSection
GetSystemTimeAsFileTime
VirtualFree
HeapCreate
InterlockedIncrement
TlsGetValue
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
DeleteCriticalSection
lstrcmpiW
InitializeCriticalSection
LeaveCriticalSection
Sleep
GetLastError
CloseHandle
FindClose
InterlockedExchange
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
VerifyVersionInfoW
FileTimeToSystemTime
FlushFileBuffers
CreateDirectoryW
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetSystemInfo
lstrcmpiA
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
TryEnterCriticalSection
LoadLibraryExW
DeleteFileW
OutputDebugStringA
CreateFileMappingW
CreateMutexW
TlsFree
TlsAlloc
GetExitCodeThread
OpenThread
VirtualQuery
GetShortPathNameW
CreateFileMappingA
InterlockedCompareExchange
CreateFileA
UnhandledExceptionFilter
IsDebuggerPresent
FindNextFileW
GetFileAttributesExW
VerSetConditionMask
SetFilePointer
GetLocalTime
GetModuleFileNameW
GetModuleFileNameA
GetStdHandle
ExitProcess
GetCPInfo
WriteConsoleW
GetConsoleOutputCP
RaiseException
SetStdHandle
IsDBCSLeadByteEx
WideCharToMultiByte
MoveFileExW
GetCommandLineA
HeapDestroy
WriteFile
TlsSetValue
InterlockedDecrement
GetEnvironmentStrings
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetOEMCP
HeapSize
GetStringTypeA
LocalFree
SetLastError
RemoveDirectoryA

user32

wsprintfW

advapi32

RegCloseKey
RegQueryValueExA
SetSecurityDescriptorDacl
GetLengthSid
GetTokenInformation
OpenProcessToken
FreeSid
AllocateAndInitializeSid
LookupAccountNameW
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
RegQueryValueExW
ReportEventW
RegSetValueExW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetSecurityDescriptorOwner
RegOpenKeyExA
RegDeleteKeyW
RegSetKeySecurity
RegCreateKeyExA
GetAce
IsValidSid

msvcrt

getenv
fwrite
free
gmtime
fputc
fprintf
puts
memcmp
malloc
pow
fread
wcslen

crypt32

CertGetPublicKeyLength
CertCreateCertificateContext

shlwapi

PathRemoveFileSpecW
PathAppendW

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

929879191b781359908bef05d2a18e83

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

crypt32

shlwapi

Sections

.text Size: 112KB - Virtual size: 111KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 72KB - Virtual size: 2.2MB

.rsrc Size: 76KB - Virtual size: 75KB

.text
Size: 112KB - Virtual size: 111KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 72KB - Virtual size: 2.2MB

.rsrc
Size: 76KB - Virtual size: 75KB