f2cc706e80757e594c6bf3a1b175b1437f8a922c6be8708660bb4b89114e789f

Sharing

Copy URL Twitter E-mail

General

Target

f2cc706e80757e594c6bf3a1b175b1437f8a922c6be8708660bb4b89114e789f
Size

777KB
MD5

23f459efc8d9fb8bb3621c5d2311bdd0
SHA1

f5673329ee40c0c09a08ec5251de3a5636c7bff1
SHA256

f2cc706e80757e594c6bf3a1b175b1437f8a922c6be8708660bb4b89114e789f
SHA512

aa6bee1a95692b2734c48490c2801e517a912c0e857927af8c9fb6115f224408ff2c36ba754d30cbf2217c754443c6422472ebd90bf8b28654c1b61fa566f34b
SSDEEP

24576:63OIgdQeED/TGSgbr8MxEGfukBkEM2g2q9sC2:6eHdQZTGSgb4MxEGmkJa2EsC

Score

N/A

Malware Config

Signatures

Files

f2cc706e80757e594c6bf3a1b175b1437f8a922c6be8708660bb4b89114e789f
.exe windows x86

af1b9be288963da87900a6d9958016b4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

rtutils

TraceRegisterExW
TraceVprintfExA
RouterLogEventExW
RouterLogEventA
RouterLogDeregisterA
LogEventA
RouterLogEventExA
TracePrintfExA
TraceDumpExA
RouterLogRegisterA
RouterLogDeregisterW
LogErrorA
MprSetupProtocolFree
RouterLogEventW
TraceDeregisterExA
TracePrintfW
TraceDeregisterA
TracePrintfExW
RouterLogRegisterW
TracePrintfA
TraceDeregisterW
RouterLogEventDataA
MprSetupProtocolEnum
RouterLogEventStringW
LogEventW
TracePutsExA
TraceRegisterExA
RouterLogEventStringA

crypt32

I_CertSrvProtectFunction

shlwapi

PathFindNextComponentW
StrCSpnIW
SHAutoComplete
SHRegQueryInfoUSKeyW
SHQueryValueExW
StrSpnW
SHDeleteValueW
PathGetArgsW
wnsprintfW
StrCpyNW
SHDeleteKeyW
StrDupW
PathSkipRootW
HashData
PathRemoveExtensionA
PathRemoveFileSpecA
StrSpnA
StrStrW
StrRChrW
UrlCanonicalizeW

msvcrt

wcsncmp
labs
iswspace
_CIlog10
_finite
strncat
__toascii
??1exception@@UAE@XZ
_mbsnextc
_mbsdec
fseek
floor
??9type_info@@QBEHABV0@@Z
memcmp
_access
_setjmp3
isalpha
_ismbblead
_mbsnbcnt
_mbscpy
_mbsinc
wcstol
_acmdln
bsearch
_fullpath
??_V@YAXPAX@Z

advapi32

RegisterServiceCtrlHandlerA
ControlService
SetSecurityDescriptorGroup
CryptExportKey
RegOpenKeyExW
WmiOpenBlock
SetFileSecurityA
LsaICLookupNames
ObjectCloseAuditAlarmA
DeregisterEventSource
LsaCreateSecret
LsaLookupNames
SystemFunction012
RegisterEventSourceW
RegQueryValueExA
RegOpenKeyW
RegRestoreKeyA
CryptGetUserKey
QueryServiceConfigA
AllocateLocallyUniqueId
GetSecurityDescriptorDacl
LsaQueryInformationPolicy
InitializeSid
GetTokenInformation
InitiateSystemShutdownExW
SystemFunction041
RegisterServiceCtrlHandlerExW
CryptVerifySignatureW
RegCreateKeyExW

setupapi

CM_Get_DevNode_Registry_Property_ExW
SetupDiSetClassInstallParamsA
pSetupGetGlobalFlags
SetupDiGetSelectedDevice
SetupGetIntField
SetupInstallFilesFromInfSectionW
CM_Get_Device_ID_ExW
SetupAddInstallSectionToDiskSpaceListW
SetupFindFirstLineA
CM_Get_Sibling
CM_Get_Next_Res_Des_Ex
CM_Get_Device_ID_List_SizeW
SetupDiGetDeviceRegistryPropertyW
CM_Open_DevNode_Key_Ex
SetupQuerySourceListW
SetupDiRemoveDeviceInterface
CM_Get_Sibling_Ex
CM_Setup_DevNode
CM_Get_Device_ID_ListW
pSetupSetGlobalFlags
CM_Free_Log_Conf_Handle
CM_Query_And_Remove_SubTreeW
SetupDiGetDriverInfoDetailW
SetupGetLineTextA
SetupDiOpenDeviceInfoA
SetupDiSetSelectedDevice

kernel32

ReleaseMutex
SetThreadLocale
SetFileAttributesA
lstrcatA
CreateMutexA
DebugBreak
GetShortPathNameW
ContinueDebugEvent
ReadConsoleA
SetTimerQueueTimer
GetDefaultCommConfigW
SetStdHandle
GlobalMemoryStatus
VirtualAlloc
EraseTape
SetConsoleScreenBufferSize
WritePrivateProfileStructA
RtlUnwind
SearchPathW
QueueUserWorkItem
ReadConsoleInputW
GetNumberOfConsoleInputEvents
SwitchToThread
VirtualQueryEx
GetSystemInfo
WaitForSingleObjectEx
GetDriveTypeA
SizeofResource
EnumLanguageGroupLocalesW
GetDateFormatA
MoveFileWithProgressW

netapi32

NetFileEnum
NetShareDel
NetUserSetInfo
NetServerGetInfo
NetGetAnyDCName
NetShareEnum
NetLocalGroupGetInfo
NetUseDel
DsGetSiteNameW
I_NetServerReqChallenge
NetLocalGroupDelMembers
NetUserGetInfo
NetGroupDel
DsGetDcNameW
NetValidateName
NetUnregisterDomainNameChangeNotification
NetRenameMachineInDomain
NetUserChangePassword
NetRemoteTOD
NetServiceEnum
NetConnectionEnum
NetServiceInstall
NetStatisticsGet
NetServiceControl

user32

ShowOwnedPopups
UnhookWindowsHookEx
EnumDesktopsA
GetCursorPos
LoadStringW
MessageBeep
SystemParametersInfoA
SendMessageW
UnregisterClassA
SetLastErrorEx
LockSetForegroundWindow
CharToOemA
GetMonitorInfoA

Sections

.text
Size: 91KB - Virtual size: 547KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 80KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 87KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 136KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 798B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af1b9be288963da87900a6d9958016b4

Headers

DLL Characteristics

File Characteristics

Imports

rtutils

crypt32

shlwapi

msvcrt

advapi32

setupapi

kernel32

netapi32

user32

Sections

.text Size: 91KB - Virtual size: 547KB

.rdata Size: 221KB - Virtual size: 289KB

.bss Size: 80KB - Virtual size: 277KB

.rdata Size: 87KB - Virtual size: 242KB

.edata Size: 136KB - Virtual size: 169KB

.rsrc Size: 160KB - Virtual size: 159KB

.reloc Size: 1024B - Virtual size: 798B

.text
Size: 91KB - Virtual size: 547KB

.rdata
Size: 221KB - Virtual size: 289KB

.bss
Size: 80KB - Virtual size: 277KB

.rdata
Size: 87KB - Virtual size: 242KB

.edata
Size: 136KB - Virtual size: 169KB

.rsrc
Size: 160KB - Virtual size: 159KB

.reloc
Size: 1024B - Virtual size: 798B