fe33d6345b79245d6ed098bf651b4471a7962bee2d3ac6557f43d50fb687b3ae

Sharing

Copy URL Twitter E-mail

General

Target

fe33d6345b79245d6ed098bf651b4471a7962bee2d3ac6557f43d50fb687b3ae
Size

154KB
MD5

68423208e89112536b2e49a314047d10
SHA1

5e3f28996dbe1466148a47e2ad4646d5f25ee951
SHA256

fe33d6345b79245d6ed098bf651b4471a7962bee2d3ac6557f43d50fb687b3ae
SHA512

02c65a12adee583b152a5fc07f0df621a527176185fcb15165855c05498f62c6b9239f8df60cfbd4d816e50927b10298d1beb735dc095fe44c1c21b0a7b2c9e5
SSDEEP

3072:qWr8Y9LvXkwEbofxO+TfP772h3emAYZ+ysn+2KJ+aTaWPZ:qwdNkwoofxjTuhRZ+yEeDPZ

Score

N/A

Malware Config

Signatures

Files

fe33d6345b79245d6ed098bf651b4471a7962bee2d3ac6557f43d50fb687b3ae
.dll windows x86

e86f874509593f6d83262efe026bc58a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CreateProcessAsUserW
CryptAcquireContextA
CryptGetProvParam
CryptReleaseContext
CryptGetUserKey
CryptGetKeyParam
CryptDestroyKey
OpenThreadToken
GetTokenInformation
ImpersonateLoggedOnUser
RegOpenKeyExW
RegQueryValueExW
LookupAccountNameW
GetFileSecurityW
MakeAbsoluteSD
SetSecurityDescriptorOwner
SetFileSecurityW
RegDeleteKeyW
OpenProcessToken
RegOpenCurrentUser
InitializeSecurityDescriptor
IsValidAcl
SetSecurityDescriptorDacl
GetNamedSecurityInfoW
AllocateAndInitializeSid
GetSecurityDescriptorControl
InitializeAcl
AddAccessAllowedAce
GetAce
EqualSid
AddAccessDeniedAce
AddAccessAllowedAceEx
SetNamedSecurityInfoW
FreeSid
GetLengthSid
CopySid
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegDeleteValueW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
CryptAcquireContextW
CryptGenRandom
ConvertSidToStringSidW
RegQueryValueExA
RegCloseKey
RevertToSelf
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
RegOpenKeyA

crypt32

CertOpenStore
I_CryptFindSmartCardCertInStore
CertFreeCertificateContext
I_CryptAddSmartCardCertToStore
CertCloseStore
CryptBinaryToStringW

kernel32

CloseHandle
WaitForSingleObject
GetModuleHandleW
LoadLibraryW
GetCurrentThread
CreateEventW
DuplicateHandle
GetCurrentProcess
OpenProcess
IsBadStringPtrW
GetModuleHandleA
lstrlenA
MultiByteToWideChar
QueueUserWorkItem
SetEvent
LocalFree
LocalAlloc
ResumeThread
SuspendThread
CreateThread
WaitForMultipleObjectsEx
CreateEventA
LeaveCriticalSection
EnterCriticalSection
SetTermsrvAppInstallMode
GetVersionExW
TerminateProcess
lstrcmpiW
OutputDebugStringW
CreateNamedPipeW
CreateProcessW
WriteFile
DisconnectNamedPipe
FlushFileBuffers
ReadFile
ConnectNamedPipe
VerifyVersionInfoW
DeviceIoControl
HeapReAlloc
InterlockedDecrement
InterlockedIncrement
SetLastError
LoadLibraryA
GetOverlappedResult
CreateFileW
lstrcpyW
TerminateThread
WaitForMultipleObjects
FormatMessageW
QueryDosDeviceW
DefineDosDeviceW
SetWaitableTimer
lstrcpynW
DeleteFileW
GetFileSize
GetTempFileNameW
GetTempPathW
CancelWaitableTimer
CreateWaitableTimerW
lstrlenW
UnregisterWait
RegisterWaitForSingleObject
lstrcatW
ExpandEnvironmentStringsW
OpenEventW
FreeLibraryAndExitThread
FindClose
FindNextFileW
FindFirstFileW
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
GetDriveTypeW
RemoveDirectoryW
GetComputerNameW
lstrcmpW
Sleep
GetLastError
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
DisableThreadLibraryCalls
GetProcessHeap
InterlockedCompareExchange
FreeLibrary
GetProcAddress
DelayLoadFailureHook
GetCurrentProcessId
ResetEvent
ProcessIdToSessionId
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetACP

mpr

WNetCancelConnection2W
WNetAddConnection2W

msvcrt

wcscpy
_snwprintf
free
wcscat
wcstok
memmove
swprintf
time
wcsncat
wcsncpy
_wcsicmp
wcschr
malloc
_initterm
_adjust_fdiv
_wcsdup
_vsnprintf
sprintf
__CxxFrameHandler
wcslen
_except_handler3
wcscmp
_wcsnicmp

ntdll

RtlInitializeCriticalSection
RtlDeleteCriticalSection
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlEqualSid
RtlNtStatusToDosError
RtlAllocateAndInitializeSid
RtlFreeHeap
RtlAllocateHeap
NtQueryInformationToken
NtSetInformationThread
NtClose
NtDuplicateToken
NtDuplicateObject
RtlFreeSid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
VerSetConditionMask
RtlCopyLuid
NtOpenProcessToken
NtQuerySystemInformation
RtlOpenCurrentUser
NtQueryInformationProcess
RtlInitUnicodeString
NtCreateSymbolicLinkObject
NtOpenSymbolicLinkObject
RtlLengthRequiredSid
NtMakePermanentObject
NtMakeTemporaryObject
NtQuerySymbolicLinkObject
RtlSetEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlSubAuthoritySid
RtlInitializeSid

ole32

CoCreateInstance
CoInitializeEx
CoCreateGuid
CoUninitialize
CoInitialize

rpcrt4

NdrClientCall2
RpcStringBindingComposeW
RpcStringFreeW
RpcImpersonateClient
NdrServerCall2
RpcBindingSetAuthInfoExW
RpcServerRegisterIfEx
RpcServerUseAllProtseqsIf
RpcServerRegisterAuthInfoW
RpcBindingFree
RpcBindingFromStringBindingW

setupapi

SetupCloseInfFile
SetupFindNextLine
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindFirstLineW

shell32

SHChangeNotify

shlwapi

wnsprintfW
ord24
SHDeleteKeyW

user32

GetSystemMetrics
SetThreadDesktop
OpenDesktopW
CloseDesktop
wsprintfW
LoadIconA
DestroyIcon
LoadStringW
MessageBoxW
ExitWindowsEx

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

winmm

PlaySoundA

winscard

SCardReleaseContext
SCardFreeMemory
SCardGetCardTypeProviderNameA
SCardListCardsA
SCardGetStatusChangeA
SCardListReadersA
SCardEstablishContext
SCardCancel

winspool.drv

DeletePrinter
ord203
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
GetPrinterW
FreePrinterNotifyInfo
OpenPrinterW
FindClosePrinterChangeNotification
SetPrinterDataW
ord204
EnumPrintersW
EnumPrinterDriversW
GetPrinterDataW
ClosePrinter
SetPrinterW

Exports

Exports

RegisterTicketExpiredNotificationEvent
SCardResumeCertProp
SCardStartCertProp
SCardStopCertProp
SCardSuspendCertProp
SchedEventLogOff
SchedStartShell
SensDisconnectEvent
SensLockEvent
SensLogoffEvent
SensLogonEvent
SensPostShellEvent
SensReconnectEvent
SensShutdownEvent
SensStartScreenSaverEvent
SensStartShellEvent
SensStartupEvent
SensStopScreenSaverEvent
SensUnlockEvent
ShowNotificationBalloonW
TSEventDisconnect
TSEventLogoff
TSEventLogon
TSEventPostShell
TSEventReconnect
TSEventShutdown
TSEventStartShell
TSEventStartup
TermsrvCreateTempDir
UnregisterTicketExpiredNotificationEvent

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e86f874509593f6d83262efe026bc58a

Headers

File Characteristics

Imports

advapi32

crypt32

kernel32

mpr

msvcrt

ntdll

ole32

rpcrt4

setupapi

shell32

shlwapi

user32

userenv

winmm

winscard

winspool.drv

Exports

Exports

Sections

.text Size: 67KB - Virtual size: 67KB

.data Size: 65KB - Virtual size: 68KB

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 67KB - Virtual size: 67KB

.data
Size: 65KB - Virtual size: 68KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 4KB - Virtual size: 4KB