f3daea149734f917859455cfb172acd83ca856a95c3a9039d4deb30b5bda5648

Sharing

Copy URL

Twitter E-mail

General

Target

f3daea149734f917859455cfb172acd83ca856a95c3a9039d4deb30b5bda5648
Size

245KB
MD5

143318cd9c53055ba8c68f994dac9f88
SHA1

bb04ed57647f2c953843ff70e0779186c559e940
SHA256

f3daea149734f917859455cfb172acd83ca856a95c3a9039d4deb30b5bda5648
SHA512

6a5a684e20ebfaa08d001e79fb1e01a3a2c1c8c1a728381f3d482c11bbd08b3cfc0d03f385f06f3bba35f2f8a029009408afa49620bf91c8580cdf9efca7cdf0
SSDEEP

6144:PMWHbRh4N04G+U2cnJLaWVKhxQd91ShzXakv0h:0u4G4GlJLJKnw91SlXW

Score

N/A

Malware Config

Signatures

Files

f3daea149734f917859455cfb172acd83ca856a95c3a9039d4deb30b5bda5648
.exe windows x86

4a216a97b1e5c26106e51f46f36f5772

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CloseServiceHandle
RegCloseKey
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
AddAce
QueryServiceStatusEx
RegQueryInfoKeyW
CheckTokenMembership
MakeSelfRelativeSD
GetSecurityDescriptorSacl
OpenThreadToken
IsValidSid
SetSecurityDescriptorDacl
ConvertSidToStringSidW
RegOpenKeyExW
GetAclInformation
OpenSCManagerW
InitializeSid
RegCreateKeyExW
SetEntriesInAclW
RegEnumKeyExW
GetSecurityDescriptorDacl
OpenServiceW
EqualSid
MakeAbsoluteSD
GetSecurityDescriptorOwner
InitializeAcl
BuildTrusteeWithSidW
GetSecurityDescriptorLength
RegSetValueExW
GetSecurityDescriptorGroup
SetSecurityInfo
GetSidLengthRequired
RegQueryValueExW
RegEnumValueW
CopySid
GetLengthSid
GetSecurityDescriptorControl
GetSecurityInfo
InitializeSecurityDescriptor
CreateServiceW
RegDeleteKeyW

kernel32

ReadFile
SetUnhandledExceptionFilter
WaitForMultipleObjects
VerifyVersionInfoW
DeleteCriticalSection
HeapReAlloc
CreateEventW
RaiseException
GetACP
CreateFileW
IsDebuggerPresent
LeaveCriticalSection
GetSystemTime
GetModuleHandleW
WriteFile
GetTempPathW
HeapDestroy
lstrlenA
HeapAlloc
VerSetConditionMask
FormatMessageW
CreateMutexW
SetLastError
DeleteFileW
HeapFree
GetThreadLocale
ReleaseMutex
GetProcessHeap
OpenEventW
HeapSize
WaitForSingleObject
FindFirstFileW
SetThreadLocale
FindClose
TerminateThread
GetCurrentThreadId
LockResource
UnhandledExceptionFilter
FindResourceExW
LoadResource
SizeofResource
CloseHandle
FindResourceW
CreateThread
EnterCriticalSection
lstrlenW
QueryDosDeviceW
GetLongPathNameW
LocalFree
GetSystemTimeAsFileTime
GetVersion
VirtualAllocEx
lstrcmpA

user32

CharLowerBuffW
UnregisterClassA
wsprintfW

shlwapi

PathRemoveFileSpecW
PathIsDirectoryW
PathStripPathW
PathFileExistsW
PathAppendW

userenv

UnloadUserProfile

oleaut32

VariantClear
SafeArrayCopy
SystemTimeToVariantTime
SysAllocStringByteLen
SafeArrayGetLBound
SysAllocStringLen
VariantCopyInd
SafeArrayCreate
SafeArrayGetUBound
GetErrorInfo
SafeArrayLock
VarBstrCmp
SafeArrayRedim
GetRecordInfoFromGuids
VarUdateFromDate
SafeArrayAccessData
VariantInit
SafeArrayGetVartype
SafeArrayGetDim
SafeArrayCreateVectorEx
SysAllocString
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SysStringByteLen
SafeArrayUnlock
VariantChangeType
SysFreeString
SysStringLen
SafeArrayDestroy
VariantCopy

shell32

SHGetSpecialFolderPathW

ole32

CoCreateInstance
StringFromGUID2
CoRevertToSelf
CoGetInterfaceAndReleaseStream
CoCreateGuid
CoMarshalInterThreadInterfaceInStream
CoQueryProxyBlanket
CoUninitialize
CoInitializeEx
CoImpersonateClient
CoSetProxyBlanket
CoGetCallContext

security

ExportSecurityContext
QuerySecurityContextToken
InitSecurityInterfaceA
AcceptSecurityContext

softpub

GenericChainCertificateTrust
SoftpubLoadSignature

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 214KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a216a97b1e5c26106e51f46f36f5772

Headers

File Characteristics

Imports

advapi32

kernel32

user32

shlwapi

userenv

oleaut32

shell32

ole32

security

softpub

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 214KB - Virtual size: 215KB

.rsrc Size: 9KB - Virtual size: 9KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 214KB - Virtual size: 215KB

.rsrc
Size: 9KB - Virtual size: 9KB