0ec8d6e29a60df27ff6476f4529bcc03ce584378346501d121c1070d8d5999ae

Sharing

Copy URL Twitter E-mail

General

Target

0ec8d6e29a60df27ff6476f4529bcc03ce584378346501d121c1070d8d5999ae
Size

832KB
MD5

87b4738da8af2d712d3733cd578c7b7c
SHA1

e2c1b622056c7e79a60508c3bd5740530f9a3988
SHA256

0ec8d6e29a60df27ff6476f4529bcc03ce584378346501d121c1070d8d5999ae
SHA512

c1d7775ee3469aed011e1e47869c73512fb3adf5098bda02b8b287c053148d0e3c2c16cdf768e49c4b16a0f5bc46e1953aed334ee9dca3de2a16c45b8e591d22
SSDEEP

12288:YhUHCrjpYJiSh+OBWj3aeg4qM5y6OeEtO81a1gtkY+dp8pBk8BKfrLBZ6/:YeH6YERD9g6ORtO4aZY+dmpBxBUrj6

Score

N/A

Malware Config

Signatures

Files

0ec8d6e29a60df27ff6476f4529bcc03ce584378346501d121c1070d8d5999ae
.exe windows x86

2e88160d082e76e6b611fe2fd8d98252

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

wintrust

CryptCATAdminReleaseContext
CryptCATGetAttrInfo
CryptCATAdminAcquireContext
CryptCATGetMemberInfo
WintrustAddActionID
WinVerifyTrustEx

netapi32

NetLocalGroupSetInfo
NetGroupDelUser
NetGroupEnum
NetJoinDomain
NetLocalGroupGetInfo
DsGetSiteNameW
NetWkstaTransportEnum
NetGroupGetInfo
NetServerGetInfo
NetUseDel

shell32

Shell_NotifyIconA
DragFinish
SHAppBarMessage
SHGetFolderLocation
ShellExecuteExW
ShellAboutW
ExtractIconExW
ShellExecuteExA

kernel32

FindFirstChangeNotificationA
HeapSetInformation
WriteFile
GetFileSizeEx
Process32Next
TransactNamedPipe
SetFileApisToOEM
WaitCommEvent
GetProfileStringW
HeapQueryInformation
GetLocalTime
GetCommProperties
ConvertDefaultLocale
VirtualAlloc
SetHandleCount
GetMailslotInfo
CreateTimerQueue
GetStringTypeA
GetCommState
GetExitCodeThread
SetConsoleActiveScreenBuffer

advapi32

CryptGetProvParam
RegCreateKeyExA
InitializeSid
SystemFunction029
AreAnyAccessesGranted
OpenSCManagerA
RegNotifyChangeKeyValue
LsaQueryDomainInformationPolicy
RegSetValueA
QueryServiceStatusEx
OpenEventLogA
GetLengthSid
GetSidIdentifierAuthority

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 640KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e88160d082e76e6b611fe2fd8d98252

Headers

DLL Characteristics

File Characteristics

Imports

wintrust

netapi32

shell32

kernel32

advapi32

Sections

.text Size: 40KB - Virtual size: 37KB

.idata Size: 640KB - Virtual size: 1.0MB

.rsrc Size: 144KB - Virtual size: 140KB

.reloc Size: 4KB - Virtual size: 60B

.text
Size: 40KB - Virtual size: 37KB

.idata
Size: 640KB - Virtual size: 1.0MB

.rsrc
Size: 144KB - Virtual size: 140KB

.reloc
Size: 4KB - Virtual size: 60B