f21c47bad1fe802404f182fedcc8dffc4653cff352d8120279934252f6b53725

Sharing

Copy URL Twitter E-mail

General

Target

f21c47bad1fe802404f182fedcc8dffc4653cff352d8120279934252f6b53725
Size

256KB
MD5

68203aabe8728d470d0487437d7e2102
SHA1

074d9a76c842a978601faa6e8a2b9011cce0d802
SHA256

f21c47bad1fe802404f182fedcc8dffc4653cff352d8120279934252f6b53725
SHA512

65fb8435056c6d270699f7ebd4dcc28737e585feb55552be5e6290fabaae51208b876c9a2445bd3b713d655ac0401a1aa8435e80d8f95a97b34f5025a77375fd
SSDEEP

6144:FpSkwLJrufeODAS72qOisSZRmICxHK6kNdvllcC:2kWJrufop6lCHkN

Score

N/A

Malware Config

Signatures

Files

f21c47bad1fe802404f182fedcc8dffc4653cff352d8120279934252f6b53725
.exe windows x86

020ad0bc1d8aa3e902a81fa07ae43381

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CLSIDFromString

crypt32

CryptMsgOpenToDecode
CertAddCertificateContextToStore
CryptMsgClose
CertNameToStrA
CertCreateCertificateContext
CryptMemRealloc
CertCloseStore
CertVerifyValidityNesting
CertFreeCertificateContext
CertCompareCertificate
CryptMemFree
CryptMsgGetParam
CertDuplicateCertificateContext
CryptMemAlloc
CryptDecodeObjectEx
CryptMsgControl
CertGetIssuerCertificateFromStore
CertOpenStore
CertFindExtension
CertCompareIntegerBlob
CryptMsgUpdate
CertGetIntendedKeyUsage
CertFreeCertificateChain

kernel32

lstrlenW
GetWindowsDirectoryA
RemoveDirectoryA
HeapSize
MoveFileW
LoadResource
FreeLibrary
GetFileSize
LocalFree
GetSystemTimeAsFileTime
FileTimeToSystemTime
ReadFile
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
FindResourceA
CompareFileTime
LeaveCriticalSection
DeleteCriticalSection
CreateFileW
OpenEventA
LocalAlloc
DeleteFileA
CloseHandle
PulseEvent
HeapDestroy
GetFileAttributesExA
lstrlenA
MoveFileExA
HeapFree
LoadLibraryExA
RaiseException
FindFirstFileA
CreateHardLinkA
WriteFile
DeviceIoControl
SetFilePointer
FindResourceExA
HeapReAlloc
EnterCriticalSection
WideCharToMultiByte
SetEndOfFile
SetFileAttributesW
GetCurrentThreadId
CreateEventA
CopyFileW
FindNextFileA
DeleteFileW
IsDebuggerPresent
CreateDirectoryA
CreateFileA
UnhandledExceptionFilter
DuplicateHandle
FindClose
HeapAlloc
LockResource
CopyFileExA
SetFileAttributesA
SizeofResource
WaitForSingleObject
OpenProcess
GetProcessHeap
GetModuleHandleA
VirtualAllocEx

shell32

SHGetSpecialFolderPathA

user32

CharNextA
wsprintfA
CharPrevA

shlwapi

PathFileExistsW
PathAppendA

advapi32

RegQueryValueExA
RegDeleteValueA
CryptAcquireContextA
TraceEvent
GetTraceLoggerHandle
RegCreateKeyExA
RegEnumValueA
CryptCreateHash
RegSetValueExA
GetTraceEnableFlags
CryptReleaseContext
CryptDestroyHash
RegOpenKeyExA
GetTraceEnableLevel
RegisterTraceGuidsA
CryptHashData
RegDeleteKeyA
CryptGetHashParam
RegCloseKey
UnregisterTraceGuids

certcli

CAOIDCreateNew
CAGetCAFlags
CAFindByName
CAGetCertTypeFlags
CAUpdateCA
CADeleteCA
CACreateNewCA
DllGetClassObject
CAEnumCertTypesForCA
CAAccessCheck

kbdhu

KbdLayerDescriptor

Sections

.text
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zVPJ
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.iNOYI
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.QNimp
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BBZWp
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.LcOnp
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.aelHe
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.WlnYWfY
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ssqsSfY
Size: 512B - Virtual size: 303B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

020ad0bc1d8aa3e902a81fa07ae43381

Headers

DLL Characteristics

File Characteristics

Imports

ole32

crypt32

kernel32

shell32

user32

shlwapi

advapi32

certcli

kbdhu

Sections

.text Size: 222KB - Virtual size: 221KB

.zVPJ Size: 2KB - Virtual size: 1KB

.iNOYI Size: 3KB - Virtual size: 3KB

.rdata Size: 4KB - Virtual size: 22KB

.QNimp Size: 3KB - Virtual size: 2KB

.BBZWp Size: 3KB - Virtual size: 3KB

.LcOnp Size: 3KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 145KB

.rsrc Size: 2KB - Virtual size: 2KB

.aelHe Size: 512B - Virtual size: 283B

.WlnYWfY Size: 2KB - Virtual size: 1KB

.ssqsSfY Size: 512B - Virtual size: 303B

.text
Size: 222KB - Virtual size: 221KB

.zVPJ
Size: 2KB - Virtual size: 1KB

.iNOYI
Size: 3KB - Virtual size: 3KB

.rdata
Size: 4KB - Virtual size: 22KB

.QNimp
Size: 3KB - Virtual size: 2KB

.BBZWp
Size: 3KB - Virtual size: 3KB

.LcOnp
Size: 3KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 145KB

.rsrc
Size: 2KB - Virtual size: 2KB

.aelHe
Size: 512B - Virtual size: 283B

.WlnYWfY
Size: 2KB - Virtual size: 1KB

.ssqsSfY
Size: 512B - Virtual size: 303B