af1412395cfe07419b01278a29dfbb618efcc1e7ca33eeb722c412deaff81ec1

Sharing

Copy URL Twitter E-mail

General

Target

af1412395cfe07419b01278a29dfbb618efcc1e7ca33eeb722c412deaff81ec1
Size

84KB
MD5

39621f3d27aa89ee7a1e860e3f99b0dd
SHA1

6b3981a96278e3f526ec5eb4458a1521379f2077
SHA256

af1412395cfe07419b01278a29dfbb618efcc1e7ca33eeb722c412deaff81ec1
SHA512

4c2f8958def7beedbb6e3474c29a9516afc4c4d01763298e4f66421ffc941e45d3353312d9cf07f273068e961a78a1952998f14f599522f83fc1b18638ae818f
SSDEEP

1536:Hgai7/RT2aEXvWT3Ms5EYQGgp7NSYTQe8ZPhqb:H8pqZfS1A7NkvP

Score

N/A

Malware Config

Signatures

Files

af1412395cfe07419b01278a29dfbb618efcc1e7ca33eeb722c412deaff81ec1
.exe windows x86

063ef528648b38b3e43e608a3538fda3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

StartServiceW
CryptDestroyHash
CryptImportKey
OpenSCManagerW
CryptGenKey
GetServiceDisplayNameW
ChangeServiceConfig2W
DuplicateTokenEx
CloseServiceHandle
CryptVerifySignatureW
RegCreateKeyExW
CryptDecrypt
CryptAcquireContextW
StartServiceCtrlDispatcherW
GetTokenInformation
RegisterServiceCtrlHandlerExW
SetServiceStatus
CryptCreateHash
GetLengthSid
CryptExportKey
OpenProcessToken
EnumServicesStatusExW
CryptGetHashParam
RevertToSelf
RegCloseKey
QueryServiceConfig2W
CryptDestroyKey
AdjustTokenPrivileges
RegSetValueExW
ImpersonateLoggedOnUser
CryptEncrypt
CryptReleaseContext
CreateProcessAsUserW
DuplicateToken
RegQueryValueExW
DeleteService
CryptDuplicateHash
LookupPrivilegeValueW
CreateServiceW
OpenServiceW

crypt32

CryptDecodeObjectEx

kernel32

CreateFileMappingW
DeleteFileW
VirtualProtectEx
GetProcessHeap
lstrcatW
CreateToolhelp32Snapshot
CreateProcessW
CreateFileW
FlushFileBuffers
MultiByteToWideChar
SetEvent
VirtualAllocEx
GetVolumeInformationW
GetThreadContext
WriteFile
GetProcAddress
HeapReAlloc
Process32FirstW
LocalFree
CreateMutexW
UnmapViewOfFile
WTSGetActiveConsoleSessionId
GetFileAttributesW
MapViewOfFile
LoadLibraryW
GetNativeSystemInfo
MoveFileExW
GetCurrentProcessId
lstrcmpiW
GetTempPathW
lstrcpynW
GetWindowsDirectoryW
ProcessIdToSessionId
CreateDirectoryW
VirtualQueryEx
CreateThread
HeapFree
LoadLibraryA
GetComputerNameW
WideCharToMultiByte
SetLastError
SetErrorMode
ExitProcess
SetFilePointer
VirtualFree
Process32NextW
VirtualAlloc
lstrcpyW
IsWow64Process
SetFileAttributesW
FreeLibrary
lstrlen
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
Sleep
GetModuleFileNameW
GetModuleHandleW
ResumeThread
TerminateProcess
GetLocalTime
GetCommandLineW
UnlockFileEx
GetTickCount
CreateEventW
SignalObjectAndWait
ReleaseMutex
LockFileEx
GetCurrentProcess
GetTempFileNameW
SetThreadContext
WaitForSingleObject
GetCurrentThreadId
WriteProcessMemory
GetLastError
lstrlenW
CopyFileW
ResetEvent
CloseHandle
GetFileSize

ntdll

RtlAllocateHeap
_snwprintf
_vsnprintf
NtUnmapViewOfSection
memcpy
RtlComputeCrc32
memset
_snprintf
_vsnwprintf
RtlGetVersion

shell32

SHFileOperationW
SHGetFolderPathW

urlmon

ObtainUserAgentString

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wininet

InternetCrackUrlW
InternetSetOptionW
InternetSetStatusCallbackW
InternetCloseHandle
HttpQueryInfoW
HttpSendRequestW
InternetQueryOptionW
HttpEndRequestW
InternetReadFile
InternetConnectW
HttpOpenRequestW
InternetReadFileExW
HttpSendRequestExA
InternetReadFileExA
InternetOpenW

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

Sections

.text
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mackt
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

063ef528648b38b3e43e608a3538fda3

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

kernel32

ntdll

shell32

urlmon

userenv

wininet

wtsapi32

Sections

.text Size: 51KB - Virtual size: 52KB

.rdata Size: 2KB - Virtual size: 4KB

.data Size: 15KB - Virtual size: 16KB

.mackt Size: 12KB - Virtual size: 12KB

.text
Size: 51KB - Virtual size: 52KB

.rdata
Size: 2KB - Virtual size: 4KB

.data
Size: 15KB - Virtual size: 16KB

.mackt
Size: 12KB - Virtual size: 12KB