98e337076dd8ffb210915f8870448346df4da8954e971fc0077ad8d9cb75db08

Sharing

Copy URL

Twitter E-mail

General

Target

98e337076dd8ffb210915f8870448346df4da8954e971fc0077ad8d9cb75db08
Size

329KB
MD5

8faadcb7f6ef56e465b2285e868be5a8
SHA1

89c818b4c45bc1526a24595ef85ba137f27ea6ba
SHA256

98e337076dd8ffb210915f8870448346df4da8954e971fc0077ad8d9cb75db08
SHA512

9ebcbaea9be84bca628d31cb356d4250542ac73f88a4a210715126ed4a36259e5e175db7c9e03d1e73bf4005c87826953efce7a8a56c87bb89fad114d0211df3
SSDEEP

6144:RBTr2EconjAGniJ4PK6mzbbLWs34e0OaVxLRyRVoGcegGcIMuDBHUpDATQ57fXX:Tlvg4PK6GyU0OaVaxcegGcIMuD50DAT6

Score

N/A

Malware Config

Signatures

Files

98e337076dd8ffb210915f8870448346df4da8954e971fc0077ad8d9cb75db08
.exe windows x86

9db09835f3b01ebd778def08639b0730

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

secur32

CredMarshalTargetInfo
CredUnmarshalTargetInfo
LsaGetLogonSessionData
FreeContextBuffer
LsaFreeReturnBuffer

msvcrt

sprintf
wcscpy
_ultoa
wcsrchr
swprintf
qsort
malloc
_vsnprintf
_strnicmp
sscanf
wcslen
_stricmp
_initterm
wcsspn
wcscmp
_strcmpi
wcstoul
_wcsicmp
_wcsnicmp
_adjust_fdiv
free
strchr
wcscat
_except_handler3
strrchr

ntdll

RtlUnicodeStringToAnsiString
RtlSubAuthoritySid
RtlLeaveCriticalSection
RtlDeleteTimerQueue
RtlGetElementGenericTable
RtlDeleteResource
RtlDeregisterWait
RtlFreeSid
NtDuplicateObject
RtlIntegerToUnicodeString
RtlDeleteElementGenericTable
RtlEqualSid
RtlInitAnsiString
RtlInsertElementGenericTableAvl
RtlCompareMemory
RtlUpcaseUnicodeString
VerSetConditionMask
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlCreateAcl
RtlDeleteCriticalSection
RtlLengthRequiredSid
NtAllocateLocallyUniqueId
RtlInitializeGenericTable
RtlNtStatusToDosError
RtlAnsiStringToUnicodeString
RtlVerifyVersionInfo
RtlFreeAnsiString
RtlTimeToTimeFields
RtlEqualDomainName
RtlCompareUnicodeString
RtlInsertElementGenericTable
NtOpenProcessToken
RtlAppendUnicodeStringToString
RtlCreateTimerQueue
RtlInitializeSid
RtlRunDecodeUnicodeString
RtlInitializeGenericTableAvl
NtQuerySystemTime
RtlLookupElementGenericTableAvl
RtlAcquireResourceShared
RtlConvertSidToUnicodeString
RtlOemStringToUnicodeString
RtlRegisterWait
RtlInitUnicodeString
RtlPrefixUnicodeString
RtlLookupElementGenericTable
NtOpenThreadToken
NtSetSecurityObject
DbgPrint
RtlReleaseResource
NtCreateEvent
RtlValidSid
NtAllocateVirtualMemory
RtlEraseUnicodeString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlInitializeCriticalSection
RtlSystemTimeToLocalTime
RtlCopySid
RtlUniform
RtlLengthSid
RtlCreateTimer
RtlAddAccessAllowedAce
RtlEnterCriticalSection
NtQueryInformationToken
NtWaitForSingleObject
RtlCopyLuid
RtlInitializeResource
RtlAcquireResourceExclusive
NtQuerySystemInformation
RtlAllocateAndInitializeSid
RtlCopyUnicodeString
RtlSubAuthorityCountSid
NtOpenEvent
RtlConvertSharedToExclusive
RtlTimeFieldsToTime
RtlDowncaseUnicodeString

cryptdll

CDBuildIntegrityVect
MD5Final
MD5Init
CDFindCommonCSystemWithKey
CDGenerateRandomBits
CDLocateCheckSum
CDLocateCSystem
MD5Update

msasn1

ASN1BERDecEndOfContents
ASN1_CreateDecoder
ASN1BERDecSXVal
ASN1BERDecS32Val
ASN1_CreateEncoder
ASN1BERDecSkip
ASN1BERDecCharString
ASN1intx2int32
ASN1_Encode
ASN1BERDecNotEndOfContents
ASN1intxisuint32
ASN1BERDecExplicitTag
ASN1intx_free
ASN1BERDecOctetString
ASN1BEREncOctetString
ASN1_FreeDecoded
ASN1DecAlloc
ASN1_FreeEncoded
ASN1_CloseDecoder
ASN1BEREncBool
ASN1BEREncOpenType
ASN1BERDecBitString
ASN1BEREncObjectIdentifier
ASN1BEREncEndOfContents
ASN1BEREncExplicitTag
ASN1BERDecObjectIdentifier
ASN1_CreateModule
ASN1EncSetError
ASN1charstring_free
ASN1intx2uint32
ASN1BERDecBool
ASN1BERDecU32Val
ASN1DecSetError
ASN1octetstring_free
ASN1BERDecPeekTag
ASN1Free
ASN1BEREncS32
ASN1ztcharstring_free
ASN1BEREncBitString
ASN1BERDecGeneralizedTime
ASN1BERDecOpenType2
ASN1BEREncSX
ASN1BEREncCharString
ASN1CEREncGeneralizedTime
ASN1_Decode
ASN1_CloseEncoder
ASN1objectidentifier_free
ASN1BEREncU32
ASN1bitstring_free
ASN1BERDecZeroCharString
ASN1intx_setuint32

kernel32

GetACP
lstrlenA
OpenFileMappingW
GetComputerNameW
MapViewOfFileEx
EnterCriticalSection
GetModuleFileNameW
LoadLibraryA
lstrlenW
GetCurrentProcessId
lstrcmpW
CreateFileMappingW
CreateFileW
GetCurrentThreadId
InterlockedDecrement
GetProcAddress
GetEnvironmentVariableW
RegisterWaitForSingleObjectEx
lstrcmpiA
GetProfileStringA
GetLastError
OutputDebugStringA
FreeLibrary
MultiByteToWideChar
UnhandledExceptionFilter
GetCurrentProcess
LeaveCriticalSection
GetTickCount
CreateFileA
GetCurrentThread
CloseHandle
VirtualAlloc
InterlockedExchangeAdd
LocalAlloc
SetEvent
WriteFile
OpenEventW
InterlockedExchange
SetUnhandledExceptionFilter
LoadLibraryW
WideCharToMultiByte
TerminateProcess
Sleep
LocalFree
RaiseException
lstrcpyW
FileTimeToSystemTime
UnregisterWait
GetModuleFileNameA
DebugBreak
DeleteCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW
GetSystemInfo
DisableThreadLibraryCalls
GetComputerNameExW
QueryPerformanceCounter
GetLocalTime
InterlockedIncrement
InitializeCriticalSection
UnmapViewOfFile
FormatMessageW
CreateEventW
ExpandEnvironmentStringsW
InterlockedCompareExchange

advapi32

QueryServiceStatus
CredFree
AllocateAndInitializeSid
CloseServiceHandle
OpenProcessToken
RegDeleteValueW
CryptCreateHash
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegisterTraceGuidsW
CryptGetHashParam
DeregisterEventSource
SystemFunction006
RegQueryValueExW
TraceEvent
RegNotifyChangeKeyValue
CryptAcquireContextW
RegEnumKeyExW
GetTraceLoggerHandle
RegConnectRegistryW
SystemFunction007
QueryServiceConfigW
RegisterEventSourceW
CryptGetProvParam
CredUnmarshalCredentialW
OpenSCManagerW
RegOpenKeyW
CryptHashData
LookupAccountSidW
RegQueryInfoKeyW
CryptReleaseContext
RegOpenKeyExW
OpenThreadToken
GetTokenInformation
OpenServiceW
ReportEventW
CryptDestroyHash
RevertToSelf
FreeSid
CryptSetProvParam
SetThreadToken

user32

wsprintfW
CharLowerBuffW

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9db09835f3b01ebd778def08639b0730

Headers

DLL Characteristics

File Characteristics

Imports

secur32

msvcrt

ntdll

cryptdll

msasn1

kernel32

advapi32

user32

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 9KB - Virtual size: 1.4MB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 36KB - Virtual size: 36KB

.rdata Size: 264KB - Virtual size: 263KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 9KB - Virtual size: 1.4MB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 36KB - Virtual size: 36KB

.rdata
Size: 264KB - Virtual size: 263KB