1138afff0d801a1f199a47e789aeed8231e6d6a7b0cea911689c5bd897202363

Sharing

Copy URL Twitter E-mail

General

Target

1138afff0d801a1f199a47e789aeed8231e6d6a7b0cea911689c5bd897202363
Size

273KB
MD5

1085310a62156b88f71a8b4d3fe2ba18
SHA1

083ea2a8c49d3d73e14d18da0492b0a9ecf09a44
SHA256

1138afff0d801a1f199a47e789aeed8231e6d6a7b0cea911689c5bd897202363
SHA512

f2a544500062d83f38e05ac9582f1e85fb1e9b0374486fef6dd8371c4d4bac7e62cfa47c384ecb9d82c0d37189f8a484f49982520d58c6dcfdb3207ef8108c1d
SSDEEP

6144:hY+eKaFt/Rqg3cyyeMsjGexTWSzMbRRySb+uCPxu:y+i3cyasGUTWSAbPPCPxu

Score

N/A

Malware Config

Signatures

Files

1138afff0d801a1f199a47e789aeed8231e6d6a7b0cea911689c5bd897202363
.exe windows x86

871fa0dcd5917b33fc44be534b640f9a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EqualSid
OpenThreadToken
RegSetValueExW
IsValidSid
RegOpenKeyExW
GetTokenInformation
RegCloseKey
SetThreadToken
CopySid
GetLengthSid
OpenProcessToken

oleaut32

SafeArrayUnlock
LoadTypeLi
SysFreeString
SafeArrayCreate
SafeArrayDestroy
SafeArrayLock
SysAllocStringByteLen
SysAllocStringLen
VarBstrCmp
SafeArrayCopy
VariantTimeToSystemTime
SysAllocString
SysStringByteLen
VariantInit
SysStringLen
SystemTimeToVariantTime
LoadRegTypeLi
SafeArrayGetVartype
VariantCopyInd
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
VariantClear
VariantCopy

userenv

UnloadUserProfile

ole32

CoGetInterfaceAndReleaseStream
CoRevertToSelf
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoMarshalInterThreadInterfaceInStream
StringFromGUID2
CoQueryProxyBlanket
CoImpersonateClient
CoUninitialize
CoCreateGuid

user32

UnregisterClassA
wsprintfW

kernel32

IsDebuggerPresent
GetLogicalDriveStringsW
GetVolumeNameForVolumeMountPointW
UnhandledExceptionFilter
GetThreadLocale
ResumeThread
HeapDestroy
GetCurrentThreadId
ResetEvent
GetProcessHeap
HeapFree
SetUnhandledExceptionFilter
FindNextVolumeMountPointW
CreateEventW
TerminateThread
GetDriveTypeW
HeapReAlloc
WaitForSingleObject
HeapSize
FormatMessageW
GetSystemTimeAsFileTime
FindVolumeMountPointClose
CreateThread
CloseHandle
EnterCriticalSection
RaiseException
GetSystemTime
GetACP
SetThreadLocale
LeaveCriticalSection
lstrlenW
HeapAlloc
DeleteCriticalSection
FindFirstVolumeMountPointW
GetCurrentProcessId
VirtualAlloc
GetVersion

rasppp

RasCpGetInfo

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 227KB - Virtual size: 12.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

871fa0dcd5917b33fc44be534b640f9a

Headers

File Characteristics

Imports

advapi32

oleaut32

userenv

ole32

user32

kernel32

rasppp

Sections

.text Size: 21KB - Virtual size: 21KB

.data Size: 227KB - Virtual size: 12.1MB

.rdata Size: 2KB - Virtual size: 467KB

.rsrc Size: 20KB - Virtual size: 20KB

.text
Size: 21KB - Virtual size: 21KB

.data
Size: 227KB - Virtual size: 12.1MB

.rdata
Size: 2KB - Virtual size: 467KB

.rsrc
Size: 20KB - Virtual size: 20KB