016fc20bafc53caff910d009dcaa3f4cba217d994130574283c4860a6477a386

Sharing

Copy URL Twitter E-mail

General

Target

016fc20bafc53caff910d009dcaa3f4cba217d994130574283c4860a6477a386
Size

1023KB
MD5

60b11a42d0af65ffdd383df5cc33e120
SHA1

881b78129b2f6b468d0088d26d3bb3b7257766b6
SHA256

016fc20bafc53caff910d009dcaa3f4cba217d994130574283c4860a6477a386
SHA512

ecffececeecff94c1e7b17f48b0798b6033c1283c6184c91f5b4eab6c62aeac31f29588e4128ddd3f340e1155d889f97862f7d85164f2cd4ec676505a72053b5
SSDEEP

24576:Hyk/7WJU45bvLl1Nnngae6Nd0899Z/jvdXALRIQWG:HT/7WJU45bvLl1NnnjdN99ZL1X

Score

N/A

Malware Config

Signatures

Files

016fc20bafc53caff910d009dcaa3f4cba217d994130574283c4860a6477a386
.exe windows x86

929879191b781359908bef05d2a18e83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntW
LCMapStringW
GetStringTypeW
GetLocaleInfoA
RtlUnwind
VirtualAlloc
HeapAlloc
IsValidCodePage
GetACP
FreeEnvironmentStringsW
EnterCriticalSection
GetSystemTimeAsFileTime
VirtualFree
HeapCreate
InterlockedIncrement
TlsGetValue
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
DeleteCriticalSection
lstrcmpiW
InitializeCriticalSection
LeaveCriticalSection
Sleep
GetLastError
CloseHandle
FindClose
InterlockedExchange
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
VerifyVersionInfoW
FileTimeToSystemTime
FlushFileBuffers
CreateDirectoryW
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetSystemInfo
lstrcmpiA
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
TryEnterCriticalSection
LoadLibraryExW
DeleteFileW
OutputDebugStringA
CreateFileMappingW
CreateMutexW
TlsFree
TlsAlloc
GetExitCodeThread
OpenThread
VirtualQuery
GetShortPathNameW
CreateFileMappingA
InterlockedCompareExchange
CreateFileA
UnhandledExceptionFilter
IsDebuggerPresent
FindNextFileW
GetFileAttributesExW
VerSetConditionMask
SetFilePointer
GetLocalTime
GetModuleFileNameW
GetModuleFileNameA
GetStdHandle
ExitProcess
GetCPInfo
WriteConsoleW
GetConsoleOutputCP
RaiseException
SetStdHandle
IsDBCSLeadByteEx
WideCharToMultiByte
MoveFileExW
GetCommandLineA
HeapDestroy
WriteFile
TlsSetValue
InterlockedDecrement
GetEnvironmentStrings
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetOEMCP
HeapSize
GetStringTypeA
LocalFree
SetLastError
RemoveDirectoryA

user32

wsprintfW

advapi32

RegCloseKey
RegQueryValueExA
SetSecurityDescriptorDacl
GetLengthSid
GetTokenInformation
OpenProcessToken
FreeSid
AllocateAndInitializeSid
LookupAccountNameW
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
RegQueryValueExW
ReportEventW
RegSetValueExW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetSecurityDescriptorOwner
RegOpenKeyExA
RegDeleteKeyW
RegSetKeySecurity
RegCreateKeyExA
GetAce
IsValidSid

msvcrt

getenv
fwrite
free
gmtime
fputc
fprintf
puts
memcmp
malloc
pow
fread
wcslen

crypt32

CertGetPublicKeyLength
CertCreateCertificateContext

shlwapi

PathRemoveFileSpecW
PathAppendW

Sections

.text
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

929879191b781359908bef05d2a18e83

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

crypt32

shlwapi

Sections

.text Size: 116KB - Virtual size: 112KB

.rdata Size: 72KB - Virtual size: 68KB

.data Size: 72KB - Virtual size: 2.2MB

.rsrc Size: 76KB - Virtual size: 75KB

.text
Size: 116KB - Virtual size: 112KB

.rdata
Size: 72KB - Virtual size: 68KB

.data
Size: 72KB - Virtual size: 2.2MB

.rsrc
Size: 76KB - Virtual size: 75KB