89c3775aedf94e5ac1a2cbdea889aa54195e5fcd03b28fa0723842704907ab4a

Sharing

Copy URL Twitter E-mail

General

Target

89c3775aedf94e5ac1a2cbdea889aa54195e5fcd03b28fa0723842704907ab4a
Size

107KB
MD5

41efab21b718de11891e145c9fef9df5
SHA1

5c424a51ebf20bf5fcbf91364869814876738954
SHA256

89c3775aedf94e5ac1a2cbdea889aa54195e5fcd03b28fa0723842704907ab4a
SHA512

98ea45abcf30c2ac18777237820bfedb4d0708c7a66273e8c1bbc5761a92bb63fafd0f4111942619fb91444ce934df18aa5913f82ee81666d76d2ad5f8db4358
SSDEEP

3072:6F173eJ3dZol3NEqWeA/DCK41T/guf717KVvO:6Tupbi6qy/DN6m

Score

N/A

Malware Config

Signatures

Files

89c3775aedf94e5ac1a2cbdea889aa54195e5fcd03b28fa0723842704907ab4a
.dll windows x86

4e55e410dd9d4c97e98971d241aeaf37

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtProtectVirtualMemory
RtlLeaveCriticalSection
RtlFreeUnicodeString
RtlCompareUnicodeString
RtlGetSaclSecurityDescriptor
RtlCreateUnicodeString
RtlEnterCriticalSection
RtlUnwind
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlLengthSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
NtSetSecurityObject
NtRestoreKey
NtDeleteValueKey
NtSetInformationKey
NtDeleteKey
RtlCopyLuid
NtQueryObject
NtCreateFile
RtlFreeAnsiString
strrchr
strchr
_strnicmp
strncpy
NtOpenFile
RtlFormatCurrentUserKeyPath
NtEnumerateKey
wcscmp
NtQueryKey
RtlDosPathNameToNtPathName_U
NtQueryFullAttributesFile
toupper
memmove
NtReadFile
NtWaitForSingleObject
NtWriteFile
towupper
NtQueryAttributesFile
RtlOpenCurrentUser
NtCreateKey
RtlTimeToSecondsSince1970
NtSetValueKey
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlNtStatusToDosError
RtlQueryEnvironmentVariable_U
RtlCopyUnicodeString
NtEnumerateValueKey
_wcsnicmp
RtlInitAnsiString
RtlAnsiStringToUnicodeString
wcschr
wcsncpy
_wcslwr
wcsstr
RtlAllocateHeap
wcscat
RtlFreeHeap
wcsrchr
_wcsicmp
RtlAllocateAndInitializeSid
RtlLengthSid
RtlCopySid
NtQuerySecurityObject
RtlGetDaclSecurityDescriptor
RtlCreateAcl
wcsncmp
RtlAddAce
RtlUnicodeStringToAnsiString
DbgPrint
wcslen
wcscpy
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
RtlImageNtHeader
NtClose

kernel32

SetCurrentDirectoryW
InterlockedCompareExchange
DelayLoadFailureHook
LoadLibraryExA
LoadLibraryExW
CreateEventA
CreateEventW
OpenEventA
OpenEventW
CreateSemaphoreA
CreateSemaphoreW
OpenSemaphoreA
OpenSemaphoreW
CreateMutexA
CreateMutexW
OpenMutexA
OpenMutexW
CreateFileMappingA
CreateFileMappingW
OpenFileMappingA
OpenFileMappingW
GetSystemInfo
RemoveDirectoryW
DeleteFileW
MoveFileW
ReadFile
GetProcAddress
FindFirstFileW
FindNextFileW
FindClose
FileTimeToSystemTime
GetFileAttributesW
GetCurrentProcess
MoveFileExW
GetSystemWindowsDirectoryW
GetShortPathNameW
GetSystemTimeAsFileTime
CreateDirectoryW
GetLastError
SetLastError
lstrcpyW
lstrlenW
GetEnvironmentVariableW
CreateFileW
WriteFile
CloseHandle
LoadLibraryW
FreeLibrary
TlsSetValue
DisableThreadLibraryCalls
TlsAlloc
TermsrvAppInstallMode
LocalAlloc
LocalFree
LoadLibraryA

msvcrt

??2@YAPAXI@Z
??3@YAXPAX@Z
_wfopen
fclose
fflush
fwprintf
wcstok

advapi32

RegCreateKeyExW
OpenProcessToken
GetTokenInformation
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shlwapi

SHDeleteKeyW

Exports

Exports

GetTermsrCompatFlags
GetTermsrCompatFlagsEx
TermServPrepareAppInstallDueMSI
TermServProcessAppInstallDueMSI
TermsrvAdjustPhyMemLimits
TermsrvBuildIniFileName
TermsrvBuildSysIniPath
TermsrvCORIniFile
TermsrvCheckNewIniFiles
TermsrvConvertSysRootToUserDir
TermsrvCopyIniFile
TermsrvCreateRegEntry
TermsrvDeleteKey
TermsrvDeleteValue
TermsrvFormatObjectName
TermsrvGetComputerName
TermsrvGetPreSetValue
TermsrvGetString
TermsrvGetWindowsDirectoryA
TermsrvGetWindowsDirectoryW
TermsrvLogInstallIniFile
TermsrvLogInstallIniFileEx
TermsrvOpenRegEntry
TermsrvOpenUserClasses
TermsrvRemoveClassesKey
TermsrvRestoreKey
TermsrvSetKeySecurity
TermsrvSetValueKey
TermsrvUpdateAllUserMenu

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e55e410dd9d4c97e98971d241aeaf37

Headers

File Characteristics

Imports

ntdll

kernel32

msvcrt

advapi32

shlwapi

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 43KB

.data Size: 58KB - Virtual size: 61KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 43KB - Virtual size: 43KB

.data
Size: 58KB - Virtual size: 61KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB