0974850b81be78aebe4ad88a52871f17f1801edb1af3e589259d5bbe7b94d1f6

Sharing

Copy URL Twitter E-mail

General

Target

0974850b81be78aebe4ad88a52871f17f1801edb1af3e589259d5bbe7b94d1f6
Size

210KB
MD5

59e524f458d3a5fc42a860656b02250a
SHA1

195f6f44cfdf3c8f8868346c6b23f7945e80b7cf
SHA256

0974850b81be78aebe4ad88a52871f17f1801edb1af3e589259d5bbe7b94d1f6
SHA512

d8ff7b62cae6b7755cb736b90cbbdc26ff9ca619cc54e59fd8ce887314b7a9c65c3de4fa07d00648f3582e9c8d5028c49bed574fa961cc67fef465a478023755
SSDEEP

3072:L7REZ965OTO7K31z0g+W6THqiPFVtiof8Nc7hN1S159aoYSVPoAMY5pM0T5tpqgF:LGXtKGZ0b/TNPFVtii2gekUzZTjEgF

Score

N/A

Malware Config

Signatures

Files

0974850b81be78aebe4ad88a52871f17f1801edb1af3e589259d5bbe7b94d1f6
.exe windows x64

e96a73c7bf33a464c510ede582318bf2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

GetModuleInformation

advapi32

CloseServiceHandle
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
NotifyChangeEventLog
OpenEventLogA
GetNumberOfEventLogRecords
GetOldestEventLogRecord
ReadEventLogA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
QueryServiceStatus
CreateServiceA
OpenSCManagerA
DeleteService
OpenServiceA
StartServiceA
ControlService
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

ws2_32

ntohl
ntohs
htonl

kernel32

CreateEventA
CreateFileW
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
DeleteFileA
GetModuleHandleA
OpenProcess
Sleep
SetConsoleCtrlHandler
GetCurrentDirectoryA
GetTempPathA
GetVersionExA
ProcessIdToSessionId
GetCurrentProcessId
GetModuleFileNameA
GetCurrentProcess
LoadLibraryA
IsBadReadPtr
Process32Next
CloseHandle
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
WaitForSingleObject
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
GetProcAddress
TerminateProcess
MultiByteToWideChar
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
FreeResource
ResetEvent
GetLastError
ReadFile
FreeLibrary
GetSystemWindowsDirectoryA
SetEvent
CreateThread
WriteFile
WaitNamedPipeA
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeA
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
EncodePointer
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
GetCommandLineA
RtlUnwindEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
LoadLibraryW
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
SetStdHandle
LCMapStringW
GetStringTypeW

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e96a73c7bf33a464c510ede582318bf2

Headers

DLL Characteristics

File Characteristics

Imports

psapi

advapi32

secur32

ws2_32

kernel32

Sections

.text Size: 122KB - Virtual size: 121KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 22KB - Virtual size: 33KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 42KB - Virtual size: 42KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 22KB - Virtual size: 33KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 42KB - Virtual size: 42KB

.reloc
Size: 1KB - Virtual size: 1KB