bb16787253a1be58fbbd4b1884127b08acb057174ecdbafa2e3fb9cfc1fe65ff

Sharing

Copy URL Twitter E-mail

General

Target

bb16787253a1be58fbbd4b1884127b08acb057174ecdbafa2e3fb9cfc1fe65ff
Size

722KB
MD5

2574ff5b1f288f3d793575e15246d462
SHA1

f59f2608559799c8f6dc3d2220d1707e3f59e591
SHA256

bb16787253a1be58fbbd4b1884127b08acb057174ecdbafa2e3fb9cfc1fe65ff
SHA512

39417d9b19a59c2d8ba0f2571065ead84f4d75176ef8f9621dc899029abdfe33ecb68aa1f957da9750b620cbb31a19b0d20b65da00f3c3b63224f7e259eedd08
SSDEEP

12288:cl1MzCcBfKsOkK12UO+s9FYutNMxriLkHVCB6BjY:cOPNK1lO99PAri8VQ6B

Score

N/A

Malware Config

Signatures

Files

bb16787253a1be58fbbd4b1884127b08acb057174ecdbafa2e3fb9cfc1fe65ff
.exe windows x86

bc5d8ae955bced7435a66ca065adb793

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

SetThreadPriorityBoost
ClearCommError
Process32Next
EnumSystemLocalesA
QueryPerformanceFrequency
GetCurrentProcess
GetStdHandle
Sleep
GetNextVDMCommand
WritePrivateProfileSectionW
MoveFileA
GetCommandLineA
FormatMessageW
DnsHostnameToComputerNameW
CopyFileExW
GetStringTypeA
GetCurrentThread
GetDriveTypeW
VirtualAlloc
GetWriteWatch
ExpandEnvironmentStringsW
PeekConsoleInputW
GetLastError
PeekConsoleInputA
VirtualLock
FindAtomW
MulDiv
OpenSemaphoreW
GlobalAddAtomA
DeleteFileW
GetThreadSelectorEntry
SetThreadPriority

secur32

InitializeSecurityContextW
GetComputerObjectNameW
QueryContextAttributesW
ApplyControlToken
LsaRegisterPolicyChangeNotification
LsaConnectUntrusted
LsaRegisterLogonProcess
EncryptMessage
FreeContextBuffer
LsaGetLogonSessionData
InitSecurityInterfaceW
DeleteSecurityContext
QuerySecurityContextToken
FreeCredentialsHandle
QuerySecurityPackageInfoW
AcceptSecurityContext
LsaFreeReturnBuffer
EnumerateSecurityPackagesW
LsaDeregisterLogonProcess
DecryptMessage
TranslateNameW

dbghelp

SymUnloadModule64
SymSetOptions
ImageDirectoryEntryToDataEx
SymLoadModule64
EnumerateLoadedModules
ImageRvaToVa
ImageDirectoryEntryToData
ImageNtHeader
SymCleanup
SymInitialize
MakeSureDirectoryPathExists
SymRegisterCallback64

msvcrt

wcscat
_wsplitpath
strtol
_strnicoll
_CItanh
_Gettnames
_ui64tow
ctime
_fpclass
fwrite
__lc_handle
_ftime
__argv
_i64toa
swprintf
_wtol
_CItan
swscanf
fscanf
ceil
tan
_timezone
??0exception@@QAE@ABV0@@Z
_cabs
strcoll
strlen
log10
_strdate
_strrev
_wcsupr
tmpfile
isalpha
_exit
tolower
_locking
realloc
ungetc
_CxxThrowException

wintrust

CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAddCatalog
CryptCATGetCatAttrInfo
WTHelperGetProvSignerFromChain
WinVerifyTrustEx
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATGetMemberInfo
CryptCATGetAttrInfo
WintrustAddActionID
WTHelperGetFileHash
CryptCATCatalogInfoFromContext
WintrustLoadFunctionPointers
IsCatalogFile
CryptCATEnumerateMember
CryptCATAdminReleaseContext
CryptCATOpen
CryptCATAdminEnumCatalogFromHash
WTHelperGetProvCertFromChain
CryptCATAdminReleaseCatalogContext
CryptCATEnumerateCatAttr
CryptCATClose
WintrustRemoveActionID

crypt32

CryptSIPRemoveSignedDataMsg

advapi32

CryptGenRandom
GetSidSubAuthority
SetServiceStatus
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSaveKeyW
LsaOpenSecret
LookupAccountSidA
ElfDeregisterEventSource
SetKernelObjectSecurity
CryptContextAddRef
GetOldestEventLogRecord
CryptDecrypt
GetSidLengthRequired
GetEffectiveRightsFromAclW
CryptEnumProvidersW
ImpersonateSelf
LsaEnumerateTrustedDomains
LookupPrivilegeNameW
CryptAcquireContextA
LsaQuerySecret
CloseServiceHandle
GetCurrentHwProfileA
AreAnyAccessesGranted
RegEnumKeyA
RegSaveKeyA
GetAce
CryptEncrypt
CryptReleaseContext
QueryServiceConfig2W
GetLengthSid
ConvertSidToStringSidW

winspool.drv

DeviceCapabilitiesW
StartDocPrinterW
GetPrinterW
AddMonitorA
DeletePrinter
GetPrinterDataW
WritePrinter
EnumMonitorsW
FreePrinterNotifyInfo
ConfigurePortW
GetFormW
AbortPrinter
DocumentPropertySheets
SetPrinterDataW
GetPrinterA
GetPrinterDriverW
FindNextPrinterChangeNotification
GetPrinterDataExW
AddPrinterDriverExW
AddPrinterW
EnumPrinterDriversW
SetFormW
GetPrintProcessorDirectoryW
GetPrinterDriverDirectoryW
EnumPrintProcessorDatatypesW
GetPrinterDataA
EndPagePrinter
EnumJobsW
DeleteFormW

Sections

.text
Size: 32KB - Virtual size: 419KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 181KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: 178KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 170KB - Virtual size: 358KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc5d8ae955bced7435a66ca065adb793

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

secur32

dbghelp

msvcrt

wintrust

crypt32

advapi32

winspool.drv

Sections

.text Size: 32KB - Virtual size: 419KB

.edata Size: 181KB - Virtual size: 326KB

BSS Size: 178KB - Virtual size: 231KB

.idata Size: 170KB - Virtual size: 358KB

.rsrc Size: 159KB - Virtual size: 159KB

.reloc Size: 512B - Virtual size: 304B

.text
Size: 32KB - Virtual size: 419KB

.edata
Size: 181KB - Virtual size: 326KB

BSS
Size: 178KB - Virtual size: 231KB

.idata
Size: 170KB - Virtual size: 358KB

.rsrc
Size: 159KB - Virtual size: 159KB

.reloc
Size: 512B - Virtual size: 304B