378b1b24cdc137f63e21ba998595b9687cc2c6b6d475a86449883e99eadb1b1e

Sharing

Copy URL Twitter E-mail

General

Target

378b1b24cdc137f63e21ba998595b9687cc2c6b6d475a86449883e99eadb1b1e
Size

719KB
MD5

1af60878f9511c798873f75cf6df2dd0
SHA1

d04e50c3be0eff6e81a822c8c0ea05b5a2e25a7a
SHA256

378b1b24cdc137f63e21ba998595b9687cc2c6b6d475a86449883e99eadb1b1e
SHA512

24c28293980eed63b3038543086987a0eab9981548bca157ae72984d96c136a01bcd27ede8a2276f10284fc310f4db7f321aabe709fe3aceb4b898ca6d66fdc5
SSDEEP

12288:uyyfNYj671Tw3QW68iM96tIm+GPFfCWil+/V5PW3Ndhz+itugWfiAzl9:u7FYGN6QWJim6tRdxCWXV5+ciw

Score

N/A

Malware Config

Signatures

Files

378b1b24cdc137f63e21ba998595b9687cc2c6b6d475a86449883e99eadb1b1e
.exe windows x86

a29e0e2769164bc4a7fba3f4b45e9634

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

crypt32

I_CertSrvProtectFunction

userenv

GetDefaultUserProfileDirectoryW
RsopSetPolicySettingStatus
RegisterGPNotification
DestroyEnvironmentBlock
ProcessGroupPolicyCompleted
LoadUserProfileW
DeleteProfileW
RsopResetPolicySettingStatus
GetUserProfileDirectoryA
UnregisterGPNotification
ExpandEnvironmentStringsForUserW
GetAppliedGPOListW
ProcessGroupPolicyCompletedEx
GetAllUsersProfileDirectoryW
ForceSyncFgPolicy
CreateEnvironmentBlock
GetProfileType
RefreshPolicy
EnterCriticalPolicySection
GetUserProfileDirectoryW
LeaveCriticalPolicySection
FreeGPOListW
GetProfilesDirectoryW
UnloadUserProfile

wintrust

CryptCATGetAttrInfo
CryptCATAdminEnumCatalogFromHash
IsCatalogFile
WintrustRemoveActionID
CryptCATGetCatAttrInfo
CryptCATAdminAddCatalog
WintrustLoadFunctionPointers
WTHelperGetProvSignerFromChain
CryptCATEnumerateCatAttr
CryptCATEnumerateMember
CryptCATClose
CryptCATAdminAcquireContext
WinVerifyTrustEx
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATOpen
CryptCATAdminReleaseContext
WTHelperGetFileHash
CryptCATAdminReleaseCatalogContext
CryptCATGetMemberInfo
CryptCATEnumerateAttr
WTHelperGetProvCertFromChain

shell32

SHUpdateRecycleBinIcon
Shell_NotifyIconA
ExtractAssociatedIconA
SHBindToParent
Shell_NotifyIconW
SHGetInstanceExplorer
ShellExecuteExW
SHGetSettings
SHChangeNotifySuspendResume
ShellAboutW
SHGetFileInfoW
ExtractAssociatedIconW
SheChangeDirExW
SHOpenFolderAndSelectItems
SHGetDataFromIDListW
CommandLineToArgvW
SHGetDesktopFolder
DuplicateIcon
SHGetFolderPathA
SHParseDisplayName
SHFormatDrive
SHGetIconOverlayIndexW
SHGetSpecialFolderPathA
SHGetFolderLocation
ExtractIconExW

oleaut32

SysFreeString
SafeArrayGetLBound
SafeArrayPtrOfIndex
VariantCopy
SafeArrayCreate
SysAllocStringByteLen
GetActiveObject
SysReAllocStringLen
SafeArrayGetUBound
VariantClear
VariantChangeType
SysAllocStringLen
SysStringLen
GetErrorInfo
VariantInit

msvcrt

strtok
_winminor
_wpopen
scanf
_ui64tow
_fpclass
memcpy
iswspace
_strlwr
_itow
atoi
_CIatan2
_cabs
wcspbrk
??1exception@@UAE@XZ
_wcsnset
_vsnwprintf
_Getmonths
_eof
ldiv
iswprint
clock
_mbsnbcpy
strchr
_wfindnext64

kernel32

GetUserDefaultLangID
SetVolumeLabelA
IsProcessorFeaturePresent
GetFileAttributesExW
GetModuleFileNameW
SetFilePointer
GetPrivateProfileStringW
GetDefaultCommConfigW
GetPrivateProfileStringA
GetCommModemStatus
VirtualUnlock
GetDateFormatA
FormatMessageW
SetTimeZoneInformation
TlsAlloc
IsBadCodePtr
Sleep
EnumTimeFormatsW
FindFirstChangeNotificationW
FormatMessageA
GetCurrentThread
CreateSemaphoreW
SetPriorityClass
VirtualAlloc
GetSystemWindowsDirectoryA
GetSystemTimeAsFileTime
PeekConsoleInputW
AllocConsole
OpenSemaphoreA
VirtualProtect
GetCurrentProcess
ClearCommError
GetFileAttributesA
GetComputerNameA
EnumResourceNamesA
EnterCriticalSection
GetCommandLineA

advapi32

AddAccessDeniedObjectAce
RegisterTraceGuidsW
CommandLineFromMsiDescriptor
LsaClose
RegQueryValueA
RegCreateKeyExA
SystemFunction036
SystemFunction009
OpenEncryptedFileRawW
CryptGetDefaultProviderW
BuildTrusteeWithSidW
FreeEncryptionCertificateHashList
RegSaveKeyW
CryptSignHashW
GetSidLengthRequired
IsValidSid
LsaQueryInformationPolicy
CreateServiceW
CryptHashData
ConvertStringSidToSidW
AccessCheckAndAuditAlarmA
SetKernelObjectSecurity
EqualDomainSid
RegOpenUserClassesRoot
RegEnumKeyExA
RegisterServiceCtrlHandlerA
TraceEvent
CryptCreateHash
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumValueW
GetSidSubAuthority
GetSecurityDescriptorControl
LsaQueryDomainInformationPolicy
RegQueryMultipleValuesW
GetCurrentHwProfileA

winspool.drv

AddFormW
EnumPrinterDataW
EnumPrinterDriversA
XcvDataW
EnumFormsW
DocumentPropertiesA
DeviceCapabilitiesW
EndPagePrinter
SetPrinterDataW
GetFormW
WritePrinter
EnumPortsW
GetPrinterDataA
EnumPrintersA
SetPrinterW
EnumJobsW
FindClosePrinterChangeNotification
GetPrinterDriverDirectoryA
DevicePropertySheets
GetPrinterA
SetPrinterDataExW
EnumPrinterDataExW
GetPrintProcessorDirectoryW
GetJobA

Sections

.text
Size: 29KB - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CRT
Size: 230KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a29e0e2769164bc4a7fba3f4b45e9634

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

userenv

wintrust

shell32

oleaut32

msvcrt

kernel32

advapi32

winspool.drv

Sections

.text Size: 29KB - Virtual size: 484KB

CRT Size: 230KB - Virtual size: 398KB

.rdata Size: 200KB - Virtual size: 396KB

.data Size: 98KB - Virtual size: 187KB

.rsrc Size: 160KB - Virtual size: 159KB

.reloc Size: 1024B - Virtual size: 220B

.text
Size: 29KB - Virtual size: 484KB

CRT
Size: 230KB - Virtual size: 398KB

.rdata
Size: 200KB - Virtual size: 396KB

.data
Size: 98KB - Virtual size: 187KB

.rsrc
Size: 160KB - Virtual size: 159KB

.reloc
Size: 1024B - Virtual size: 220B