638017d3a3e0a7d3dfdb771bc7ead52e74e29080ced4de68912c53e0a8f3224c

Sharing

Copy URL

Twitter E-mail

General

Target

638017d3a3e0a7d3dfdb771bc7ead52e74e29080ced4de68912c53e0a8f3224c
Size

762KB
MD5

4281659debf469ae0828fd0cd6195940
SHA1

bb606dc0de0ee02cdfa47d9ab94f9400a859d4e9
SHA256

638017d3a3e0a7d3dfdb771bc7ead52e74e29080ced4de68912c53e0a8f3224c
SHA512

3900cc233b24660e3ae463aa4ed9a37b643196f4493f2405be1f9ba36a487d99bbfd3fb063091a92b93600999b57a9e4d3d15735cadb399e6aea272b21433a7b
SSDEEP

12288:B0F1eURx6ypujF756vnI9OlIsQ/54NX7b9jdDr9JLUw:BQ1egNpuB74Efh4bjlr3LUw

Score

N/A

Malware Config

Signatures

Files

638017d3a3e0a7d3dfdb771bc7ead52e74e29080ced4de68912c53e0a8f3224c
.exe windows x86

b6c7511ab3fb4696070fe8d4ba250d0f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetTimeFormatA
InterlockedCompareExchange
CloseProfileUserMapping
NlsGetCacheUpdateCount
VirtualAlloc
GetUserDefaultLCID
GetLocaleInfoW
HeapSize
CreateJobObjectW
GetLastError
WritePrivateProfileSectionW
GetNamedPipeHandleStateA
CreateHardLinkW
FreeConsole
InterlockedIncrement
WriteConsoleOutputA
WriteFileEx
GetSystemDirectoryW
CompareStringW
GetVersion

iphlpapi

GetPerAdapterInfo
InternalSetIpForwardEntry
InternalDeleteIpNetEntry
GetTcpStatistics
InternalSetIpNetEntry
InternalSetIpStats
GetInterfaceInfo
NhGetInterfaceNameFromGuid
InternalGetIpForwardTable
GetBestInterface
InternalGetIfTable
GetIfTable
GetIpForwardTable
GetIpNetTable
GetBestRoute
InternalDeleteIpForwardEntry
InternalGetIpNetTable
GetTcpTable
InternalGetUdpTable
GetNetworkParams
AllocateAndGetIpAddrTableFromStack

netapi32

NetLocalGroupSetInfo
NetLocalGroupAddMembers
NetUseAdd
NetUseGetInfo
NetServerGetInfo
NetUserAdd
Netbios
NetLocalGroupGetInfo
NetQueryDisplayInformation
NetLocalGroupDel
DsRoleGetPrimaryDomainInformation
DsGetDcNameWithAccountW
NetUnregisterDomainNameChangeNotification
NetFileClose
NetServerSetInfo
NetJoinDomain
NetUnjoinDomain
NetServiceEnum
NetUseDel
NetGetJoinInformation
NetWkstaTransportEnum
NetServiceControl
NetFileGetInfo
DsGetSiteNameW

uxtheme

IsThemeBackgroundPartiallyTransparent
GetThemeMargins
GetThemePartSize
OpenThemeData
IsThemeActive
IsAppThemed
GetThemeBackgroundRegion
GetThemeBackgroundContentRect
IsThemePartDefined
GetThemeAppProperties
GetThemeBool
GetThemeMetric
SetWindowTheme
GetThemeFont
EnableThemeDialogTexture
GetThemeBackgroundExtent
GetThemeSysColor
GetThemeTextExtent
DrawThemeText
DrawThemeIcon
CloseThemeData
DrawThemeBackground
GetCurrentThemeName
GetThemeColor
GetThemeRect
GetWindowTheme
DrawThemeParentBackground
GetThemeSysFont

msvcrt

?name@type_info@@QBEPBDXZ
atol
memmove
strcpy
localeconv
vsprintf
_findclose
tmpfile
_wfindnext64
_wcsrev
strtoul
_fcvt
fwprintf
_except_handler3
sscanf
fgetws
_get_osfhandle
_mbsupr
_wgetcwd
_CIsqrt
sqrt
__p__commode
wcscat
__dllonexit
_statusfp
fsetpos
_mbsnbcmp

crypt32

CryptSIPVerifyIndirectData

advapi32

CreateServiceW
CryptDuplicateHash
SetTokenInformation
AllocateAndInitializeSid
LookupAccountSidA
SetSecurityDescriptorDacl
LsaNtStatusToWinError
LsaSetSecret
GetTokenInformation
RegCloseKey
EqualDomainSid
SystemFunction005
InitializeSecurityDescriptor
RegisterServiceCtrlHandlerA
GetSidSubAuthority
RegCreateKeyA
GetKernelObjectSecurity
AdjustTokenPrivileges
BuildExplicitAccessWithNameA

winspool.drv

AddMonitorA
EnumMonitorsA
AddPortW
GetPrinterW
SetJobW
EnumPrinterDataW
EnumPrintProcessorDatatypesW
EnumPortsW
AddPrinterDriverW
DeviceCapabilitiesA
EnumPrinterDriversA
OpenPrinterW
ConfigurePortW
FindNextPrinterChangeNotification
GetPrinterDriverDirectoryW
DeleteFormW
GetFormW
DeletePrinter
EndPagePrinter
ClosePrinter
GetPrinterDataExW
GetPrintProcessorDirectoryA
FindClosePrinterChangeNotification
OpenPrinterA
DocumentPropertiesA
XcvDataW
GetPrintProcessorDirectoryW

Sections

.text
Size: 26KB - Virtual size: 378KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 575KB - Virtual size: 927KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6c7511ab3fb4696070fe8d4ba250d0f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

iphlpapi

netapi32

uxtheme

msvcrt

crypt32

advapi32

winspool.drv

Sections

.text Size: 26KB - Virtual size: 378KB

INIT Size: 575KB - Virtual size: 927KB

.rsrc Size: 160KB - Virtual size: 159KB

.text
Size: 26KB - Virtual size: 378KB

INIT
Size: 575KB - Virtual size: 927KB

.rsrc
Size: 160KB - Virtual size: 159KB