a47b73668fdab2b01667e3b82a7f57d8c25a9a9c2bdd96974e2750c5a9b1be9c

Sharing

Copy URL Twitter E-mail

General

Target

a47b73668fdab2b01667e3b82a7f57d8c25a9a9c2bdd96974e2750c5a9b1be9c
Size

147KB
MD5

f1be22b8b7f8697645ad528539c2b51d
SHA1

7e1317c20867f1c19d04494a00be207b62cdc31e
SHA256

a47b73668fdab2b01667e3b82a7f57d8c25a9a9c2bdd96974e2750c5a9b1be9c
SHA512

51af69b30ccfa311b57d1cf951ee3fc22cac7d52c8d4c405c695b9e4c195ce5db6a810d00dc7e19dc1c10dc36dc16d303925b48ea39aaa3d5f45ae3fe834072f
SSDEEP

3072:SRyhSeoAwzznccBRJ9Ne1vEru/QOP8eAnRTxOcXupjaRn:SRyhQAwzjv7J9Ai6FEOc+daRn

Score

N/A

Malware Config

Signatures

Files

a47b73668fdab2b01667e3b82a7f57d8c25a9a9c2bdd96974e2750c5a9b1be9c
.exe windows x86

1ee73fe1e3f52517989de00ef14c58b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetFileSecurityW
RegQueryValueExW
OpenProcessToken
OpenThreadToken
DestroyPrivateObjectSecurity
GetSecurityDescriptorSacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
CreatePrivateObjectSecurityEx
GetSecurityDescriptorDacl
RegDeleteValueW
RegOpenKeyExA
RegCreateKeyExW

kernel32

ExpandEnvironmentStringsW
GetWindowsDirectoryW
FreeLibrary
GetCurrentThread
GetDateFormatA
GetTimeFormatA
InterlockedDecrement
InterlockedIncrement
FlushFileBuffers
GetFileSize
SetEndOfFile
UnlockFileEx
LockFileEx
SetFilePointer
ReadFile
GetSystemTime
SystemTimeToFileTime
CopyFileW
CreateFileW
GetFileAttributesW
SetFileAttributesW
LocalFree
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CreateDirectoryW
UnmapViewOfFile
LocalAlloc
MapViewOfFile
GetTickCount
GetModuleHandleW
CloseHandle
SetLastError
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualFree
ExitProcess
DeleteFileW
HeapAlloc
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
GetVersionExA
GetVersionExW
InterlockedExchange
Sleep
InterlockedCompareExchange
OutputDebugStringA
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileMappingW
VirtualAllocEx
FindFirstFileA

msvcrt

fprintf
fflush
fclose
fread
_wfopen
_errno
_purecall
iswctype
_onexit
_lock
__dllonexit
_unlock
_controlfp
memmove
memcpy
memset
__set_app_type
__setusermatherr
_amsg_exit
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs

ole32

StringFromIID
CoInitialize
CoCreateInstance
StgOpenStorage
StgOpenStorageEx
PropVariantClear
CoTaskMemFree
CoUninitialize

oleaut32

SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringByteLen

ntdll

wcsrchr
_wcsnicmp
_ltow
_vsnprintf
towlower
atol
_vsnwprintf
wcsncmp
RtlUnwind
_wcsicmp

rpcrt4

UuidCreate

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

mscat32

CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext

user32

IsCharLowerW

msi

MsiSourceListAddSourceW
MsiGetTargetPathA
MsiGetProductInfoFromScriptA
MsiEnumProductsExW
MsiEnumProductsExA
MsiApplyMultiplePatchesW
MsiSetTargetPathA
MsiSourceListClearSourceW
MsiDatabaseOpenViewW
MsiEnumProductsA
MsiSummaryInfoPersist
MsiDatabaseGetPrimaryKeysW
MsiSourceListClearAllW
MsiOpenPackageA
MsiConfigureFeatureW
MsiSourceListForceResolutionW
MsiSetInternalUI
MsiDatabaseExportW
MsiQueryFeatureStateA
MsiGetProductCodeFromPackageCodeW
MsiRecordSetStreamW
MsiNotifySidChangeA
MsiSourceListAddSourceExA
MsiPreviewDialogA
MsiEnableUIPreview
MsiUseFeatureExW
MsiPreviewBillboardA
MsiSourceListAddMediaDiskW
MsiDatabaseIsTablePersistentW
MsiDatabaseCommit
MsiViewModify
MsiSetMode

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ee73fe1e3f52517989de00ef14c58b2

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

oleaut32

ntdll

rpcrt4

version

mscat32

user32

msi

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 9KB - Virtual size: 215KB

.rsrc Size: 113KB - Virtual size: 112KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 9KB - Virtual size: 215KB

.rsrc
Size: 113KB - Virtual size: 112KB