be0ead062d1d886672935d022ce5e9a4d4066e444c2200193ec59cf95c6dedfa

Sharing

Copy URL Twitter E-mail

General

Target

be0ead062d1d886672935d022ce5e9a4d4066e444c2200193ec59cf95c6dedfa
Size

938KB
MD5

25ea9a9082ff2888df24dc124ac33870
SHA1

def5d750acc86733734049cf6f04e58af645991e
SHA256

be0ead062d1d886672935d022ce5e9a4d4066e444c2200193ec59cf95c6dedfa
SHA512

6b555bb5765d1d6fd0c5e90f2aee74e865a7c54ad88de6706103009f76f638636b76896648f38ac63df28581cdb6946d56660e0b26bb326e696f5a1e9ad8209d
SSDEEP

24576:CLo0ipNSuYeQz33Bbeq1mUJ6k1t/4VMtP4zH:TNSuYem3BbN1Gk1KU8

Score

N/A

Malware Config

Signatures

Files

be0ead062d1d886672935d022ce5e9a4d4066e444c2200193ec59cf95c6dedfa
.exe windows x86

8fe540664199b14b13c80028c252004e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

crypt32

CertVerifyCRLRevocation

advapi32

EnumServicesStatusExW
LsaRetrievePrivateData
RevertToSelf
SystemFunction041
ObjectCloseAuditAlarmW
OpenServiceA
ReportEventW
QueryServiceConfigW
GetAce
LockServiceDatabase
RegCreateKeyW
QueryRecoveryAgentsOnEncryptedFile
GetUserNameW
LookupAccountSidA
GetFileSecurityW
SetTokenInformation
LsaCreateTrustedDomainEx
GetSecurityDescriptorGroup
LsaRemoveAccountRights
GetSidIdentifierAuthority
GetCurrentHwProfileW
GetSidLengthRequired
ConvertStringSidToSidW
GetSidSubAuthority

rasapi32

RasGetHport
RasSetSubEntryPropertiesW
RasGetEntryHrasconnW
RasValidateEntryNameW
RasGetErrorStringW
RasSetEntryPropertiesW
RasConnectionNotificationW
RasGetSubEntryPropertiesW
RasDeleteEntryW
RasGetEntryPropertiesW
RasGetCredentialsW
RasGetEapUserIdentityW
RasEnumEntriesW
RasGetProjectionInfoW
RasGetConnectStatusW
RasEnumDevicesW
RasDialW
RasGetCustomAuthDataW
RasEnumConnectionsW

kernel32

GetVolumePathNameA
PeekConsoleInputW
CreateTapePartition
LoadLibraryExW
WideCharToMultiByte
HeapCompact
GetEnvironmentStrings
SetSystemTime
WriteTapemark
VirtualAlloc
CreateMailslotW
GetCompressedFileSizeA
WaitForMultipleObjects
GetDiskFreeSpaceW
FoldStringW
IsValidCodePage
GetAtomNameW
GetDevicePowerState
WriteProfileStringW
ExpandEnvironmentStringsA
CreateSemaphoreW

msvcrt

_stat
iswlower
_wgetenv
fclose
iswspace
wcsstr
_wsetlocale
_fullpath
wcsrchr
strtol
_snwprintf
_atoi64
_finite
_fmode
strncpy
ispunct
rand
?what@exception@@UBEPBDXZ
_Gettnames
_waccess
swscanf

dnsapi

DnsNameCompare_W
DnsStatusString
DnsReplaceRecordSetUTF8
DnsDhcpSrvRegisterTerm
DnsModifyRecordsInSet_UTF8
DnsValidateName_UTF8
DnsQueryConfig
DnsRecordListFree
DnsNameCompareEx_W
DnsQuery_UTF8
DnsValidateName_W
DnsDhcpSrvRegisterInit
DnsQuery_W
DnsNotifyResolver

Sections

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 28KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 692KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8fe540664199b14b13c80028c252004e

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

advapi32

rasapi32

kernel32

msvcrt

dnsapi

Sections

.data Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 1KB

.text Size: 28KB - Virtual size: 386KB

DATA Size: 692KB - Virtual size: 1.0MB

.rsrc Size: 212KB - Virtual size: 211KB

.reloc Size: 1024B - Virtual size: 212B

.data
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 386KB

DATA
Size: 692KB - Virtual size: 1.0MB

.rsrc
Size: 212KB - Virtual size: 211KB

.reloc
Size: 1024B - Virtual size: 212B