60b6018ba01e7e41647d2b85845fa11b3935830e70fc99e6a94882c082ab47b9

Sharing

Copy URL Twitter E-mail

General

Target

60b6018ba01e7e41647d2b85845fa11b3935830e70fc99e6a94882c082ab47b9
Size

828KB
MD5

5af2e8afdbb27b4aeef0c2f5b6faf675
SHA1

7d2a57f23c659f6999e8343907054d75ba98d749
SHA256

60b6018ba01e7e41647d2b85845fa11b3935830e70fc99e6a94882c082ab47b9
SHA512

715fb7a216ba0216102d606299e1747c0ac83ee09e13996cabd220f4cdcb791e0af14704beb04b9ddcbcca10d9403d3e4b8b9e0990e08e65710ea7a2b29f4845
SSDEEP

12288:htznxfcwDl9rndbygLOMDzNqRVim9CW+jLcUrm1L2s4MKlD9fGecSNhUhln6sCK0:ht7xTDxLO2kbiu+LfwSsM946w

Score

N/A

Malware Config

Signatures

Files

60b6018ba01e7e41647d2b85845fa11b3935830e70fc99e6a94882c082ab47b9
.exe windows x86

78c022507e044a5474cf86125debe02d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegEnumValueA
QueryServiceStatus
QueryServiceConfig2A
IsValidSecurityDescriptor
ObjectDeleteAuditAlarmW
EnableTrace
LsaEnumerateAccountsWithUserRight
ElfRegisterEventSourceW
LsaQueryDomainInformationPolicy
SystemFunction011
RegQueryMultipleValuesA
SaferiSearchMatchingHashRules
LsaClose
ConvertStringSidToSidA
GetSecurityDescriptorDacl
LookupPrivilegeValueA
StartTraceW
ChangeServiceConfigW
AddAccessAllowedObjectAce
SaferGetPolicyInformation
LsaSetInformationPolicy
SystemFunction025
SystemFunction021
GetTraceEnableFlags
ConvertToAutoInheritPrivateObjectSecurity
InitiateSystemShutdownExA
RegNotifyChangeKeyValue
LsaSetSecurityObject
BuildTrusteeWithObjectsAndSidW

kernel32

GetLocaleInfoA
WriteProfileStringA
SetThreadAffinityMask
WriteConsoleW
FileTimeToSystemTime
EnumLanguageGroupLocalesA
HeapFree
WriteConsoleInputVDMW
GetProfileIntW
GetNumberFormatW
SetTermsrvAppInstallMode
GetVolumePathNameW
GetCurrentThread
GetQueuedCompletionStatus
GetModuleHandleW
GetDiskFreeSpaceA
WritePrivateProfileStructA
LoadLibraryW
ReleaseSemaphore
lstrcmpiW

sqlunirl

_LookupAccountSid_@28
__hwrite_@12
_PolyTextOut_@12
_OpenDesktop_@16
_EnumWindowStations_@8
_GetFileVersionInfoSize_@8
_SetWindowText@8
_MapVirtualKey_@8
_GetDateFormat_@24
_GetClassInfoEx_@12
_DefWindowProc@16
_AppendMenu_@16
__lcreat_@8
_CreateDialogIndirectParam@20
_CreateFontIndirect@4
_GetDiskFreeSpace_@20
_OpenFile_@12
_GetObject@12
_IsDialogMessage@8
_LoadMenu@8
_CreateDirectoryEx_@12
_VkKeyScanEx_@8
_EnumDisplaySettings_@12
_OpenEventLog_@8
_RegisterClass_@4
_MoveFile@8
_SetUserObjectInformation_@16
_GetWindowTextLength@4
_ttof
_GetClassName_@12
_EnumResourceTypes_@12
_GetEnvironmentVariable_@12
_RegCreateKey_@12
_CharToOemBuff_@12
_FormatMessage@28
_ClearEventLog_@8
newMultiByteFromWideCharEx
_lstrcpy_@8
_NDdeShareEnum_@24
_RegEnumKeyEx_@32
_SHBrowseForFolder_@4
_NDdeSetShareSecurity_@16
_GetWindowLong@8
_SetDlgItemText@12
_FindResourceEx_@16
_ExtractAssociatedIcon_@12

crypt32

CertAddCRLContextToStore
CertVerifyCRLRevocation
CryptGetMessageCertificates
CertGetCTLContextProperty
PFXIsPFXBlob
CertEnumCTLsInStore
CertFindCRLInStore
CryptUnregisterOIDInfo
CryptSetKeyIdentifierProperty
CryptMsgVerifyCountersignatureEncodedEx
CryptSIPGetSignedDataMsg
CertAddEncodedCertificateToSystemStoreW
I_CryptFindSmartCardCertInStore
I_CryptDisableLruOfEntries
I_CryptInstallOssGlobal
CryptUnregisterDefaultOIDFunction
CertGetCRLContextProperty
CryptExportPKCS8
CertEnumCertificatesInStore
CryptStringToBinaryA
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertUnregisterPhysicalStore
RegCreateHKCUKeyExU
CertSetCertificateContextPropertiesFromCTLEntry
CryptMsgGetAndVerifySigner
CryptMsgCalculateEncodedLength
I_CryptAddRefLruEntry

user32

DrawIconEx
OpenInputDesktop
GetPropW
ChangeMenuW
RegisterServicesProcess
AlignRects
UnhookWindowsHook
KillTimer
SetLastErrorEx
wvsprintfW
WinHelpA
RegisterClipboardFormatW
InsertMenuA
GetTabbedTextExtentA
GetKeyboardType
HideCaret
LoadStringW

Sections

.text
Size: 383KB - Virtual size: 382KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 173KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78c022507e044a5474cf86125debe02d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

sqlunirl

crypt32

user32

Sections

.text Size: 383KB - Virtual size: 382KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 173KB - Virtual size: 1.6MB

.rsrc Size: 170KB - Virtual size: 169KB

.reloc Size: 1024B - Virtual size: 868B

.text
Size: 383KB - Virtual size: 382KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 173KB - Virtual size: 1.6MB

.rsrc
Size: 170KB - Virtual size: 169KB

.reloc
Size: 1024B - Virtual size: 868B