4d970e7e24abbf6642bb1787da12b33e51e8749730e803b9463f4a916c0e9a05

Sharing

Copy URL Twitter E-mail

General

Target

4d970e7e24abbf6642bb1787da12b33e51e8749730e803b9463f4a916c0e9a05
Size

183KB
MD5

c45e367f2d298bce4a289b308548cc60
SHA1

4621b18e89707e614c84fc95143a48a3ebbe5fd8
SHA256

4d970e7e24abbf6642bb1787da12b33e51e8749730e803b9463f4a916c0e9a05
SHA512

20a151df4aee92044db04460bc7b934aa4cf3d4dffa60b02bb3f9bddb623f4658a652fed7bea0408179ac3ca5975dc6b60a0ca4710db49f8f45fb08c8e841f22
SSDEEP

3072:2VkS+xXcaCFQvgAMtZBRsiWLvduZCZxBzwjCcge3dcdG0ujg2VUFzac83eYyhCpu:1NefrLBWL11zwbJ2MM2VUg13eiRJxyHK

Score

N/A

Malware Config

Signatures

Files

4d970e7e24abbf6642bb1787da12b33e51e8749730e803b9463f4a916c0e9a05
.exe windows x86

12daf20b473bdfc0791c29f880dd1f7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoTaskMemFree
CoSetProxyBlanket
StringFromCLSID
CoImpersonateClient
StringFromGUID2
CoGetCallContext
CoCreateGuid
CoCreateInstance
CoTaskMemAlloc
CoInitializeSecurity
StringFromIID
CoRegisterClassObject
CoInitializeEx
CoRevertToSelf
CoGetClassObject
CLSIDFromString
CoQueryProxyBlanket
CoDisconnectObject
CoUninitialize
CoTaskMemRealloc
CoRevokeClassObject

rpcrt4

RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcBindingSetAuthInfoA
NdrClientCall
RpcStringFreeA

shlwapi

PathFindExtensionA

oleacc

LresultFromObject
AccessibleObjectFromPoint

kernel32

SizeofResource
SetLastError
DeleteCriticalSection
GetACP
HeapAlloc
HeapFree
GetEnvironmentStrings
CreateEventA
LoadLibraryA
FreeLibrary
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
SetHandleCount
GetOEMCP
GetModuleHandleW
SetUnhandledExceptionFilter
GetStdHandle
ReleaseMutex
CompareStringA
SetEnvironmentVariableA
InitializeCriticalSection
SetEvent
EnterCriticalSection
GetPrivateProfileStringA
lstrcmpiA
IsBadWritePtr
GetVersionExA
CreateProcessA
CreateProcessW
IsBadReadPtr
WaitForSingleObject
WriteFile
lstrcatA
LocalSize
FindFirstFileA
OpenProcess
MapViewOfFile
GetPrivateProfileSectionNamesA
SetErrorMode
GetCPInfo
VirtualFree
GetProcAddress
QueryPerformanceCounter
VirtualAlloc
WriteProfileStringA
GetCurrentThreadId
CreateDirectoryA
TerminateThread
WideCharToMultiByte
lstrcpynA
GetSystemInfo
FreeEnvironmentStringsA
FormatMessageA
lstrlenW
ReadFile
LoadLibraryExA
CreateThread
SetStdHandle
GetModuleHandleA
LocalFree
lstrlenA
WritePrivateProfileStringA
GetCurrentProcessId
FlushFileBuffers
Sleep
TerminateProcess
VirtualQuery
GetProfileStringA
LoadLibraryW
GetProcessTimes
VirtualProtect
EnumSystemLanguageGroupsW
GetStringTypeW
GetStringTypeA
TlsGetValue
TlsAlloc
GetProcessHeap
GetFileAttributesA
MultiByteToWideChar
TlsSetValue
TlsFree
LockResource
GetEnvironmentStringsW
SetEndOfFile
GetCurrentProcess
GetLastError
InterlockedDecrement
SetFilePointer
DuplicateHandle
UnhandledExceptionFilter
HeapSize
GetThreadLocale
CompareStringW
GetCurrentThread
LCMapStringW
LocalAlloc
ResetWriteWatch
InterlockedExchange
GetFileType
CreateFileA
ReadProcessMemory
CreateFileMappingA
LoadResource
RaiseException
IsBadCodePtr
GetExitCodeProcess
GetComputerNameA
GetModuleFileNameA
LeaveCriticalSection
GetStartupInfoA
HeapReAlloc
GetModuleFileNameW
HeapDestroy
IsDBCSLeadByte
FindResourceExA
ExitProcess
GetCommandLineA
GetPrivateProfileSectionA
FindClose
InterlockedIncrement
RtlUnwind
lstrcpyA
GetPrivateProfileIntA
UnmapViewOfFile
HeapCreate
GetTickCount
CloseHandle
CreateMutexA
GetSystemDirectoryA
LCMapStringA
GetVersion
FindResourceA
InterlockedCompareExchange
GetLocaleInfoA
HeapFree

user32

CharNextA
EnumWindows
KillTimer
LoadStringA
SetTimer
GetMessageA
GetWindowTextA
PostThreadMessageA
MessageBoxA
GetWindowThreadProcessId
PeekMessageA
DispatchMessageA
IsWindowVisible
CharUpperA
wsprintfW
wsprintfA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

advapi32

InitializeAcl
RegEnumKeyExA
CloseServiceHandle
FreeSid
GetSecurityDescriptorOwner
InitializeSid
EqualSid
CopySid
GetSidSubAuthority
GetSecurityDescriptorSacl
GetAclInformation
SetThreadToken
IsValidSid
SetServiceStatus
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
DeleteService
QueryServiceStatus
IsValidSecurityDescriptor
LookupAccountSidA
RegQueryValueExW
RegEnumKeyA
RegisterServiceCtrlHandlerA
OpenSCManagerA
InitializeSecurityDescriptor
RegCreateKeyExA
LookupAccountNameA
LookupAccountSidW
RegSetKeySecurity
AddAccessAllowedAce
LookupPrivilegeValueA
RegOpenKeyExA
AdjustTokenPrivileges
GetSecurityDescriptorControl
RegDeleteKeyA
RegCreateKeyA
DeregisterEventSource
GetUserNameA
GetSecurityDescriptorDacl
RegQueryInfoKeyA
GetSidLengthRequired
OpenThreadToken
CreateServiceA
RegCloseKey
RegQueryValueExA
AccessCheck
SetSecurityDescriptorOwner
AddAce
RegEnumValueA
OpenProcessToken
GetLengthSid
AllocateAndInitializeSid
DuplicateTokenEx
GetSecurityDescriptorLength
GetTokenInformation
AddAccessDeniedAce
MakeAbsoluteSD
RegisterEventSourceA
RegSetValueExA
RegConnectRegistryA
SetSecurityDescriptorSacl
DuplicateToken
PrivilegeCheck
GetAce
MakeSelfRelativeSD
SetSecurityDescriptorGroup
OpenServiceA
RegDeleteValueA
ChangeServiceConfigA
StartServiceCtrlDispatcherA
ControlService
ReportEventA
RegOpenKeyExW

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

12daf20b473bdfc0791c29f880dd1f7a

Headers

File Characteristics

Imports

ole32

rpcrt4

shlwapi

oleacc

kernel32

user32

version

advapi32

Sections

.text Size: 64KB - Virtual size: 64KB

.rdata Size: 7KB - Virtual size: 147KB

.data Size: 110KB - Virtual size: 109KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 64KB - Virtual size: 64KB

.rdata
Size: 7KB - Virtual size: 147KB

.data
Size: 110KB - Virtual size: 109KB

.rsrc
Size: 512B - Virtual size: 4KB