83b0aad6725b800206ebb89b04865da8e8c811269afd5cafda1f718a2b923408

Sharing

Copy URL Twitter E-mail

General

Target

83b0aad6725b800206ebb89b04865da8e8c811269afd5cafda1f718a2b923408
Size

72KB
MD5

bfbb6af48723e70c742119c2baf8db6f
SHA1

1bc8fcce08ba98840655902cb6152f212cb839d0
SHA256

83b0aad6725b800206ebb89b04865da8e8c811269afd5cafda1f718a2b923408
SHA512

49551322dc9061ea46abf81d2c228becdfc7cf2041a37205dc83edce6048a4c3488df0a7a846e796d219000c5c8448b176e73a83ea32d726f5a92b66a3a04039
SSDEEP

1536:U5fnGXYxKTUtmPe0cGsI+1bFZTpKnekq02WkpAufWIrz9+oxpNFowNh:UjBIsbFR6Hq02WkDf+MzFo

Score

N/A

Malware Config

Signatures

Files

83b0aad6725b800206ebb89b04865da8e8c811269afd5cafda1f718a2b923408
.exe windows x86

9dcbf6851631fcc0d50034d7282c766b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_acmdln
_cexit
_exit
_XcptFilter
_ismbblead
wcsncmp
_vsnprintf
_vscwprintf
_wcsnicmp
_wcsicmp
exit
__getmainargs
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler3
_wtoi64
_wtoi
memset
_vsnwprintf
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type

advapi32

RevertToSelf
IsValidSid
GetLengthSid
CopySid
RegGetValueW
OpenProcessToken
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
CreateProcessAsUserW
ImpersonateLoggedOnUser
ConvertSidToStringSidW
RegQueryValueExW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW

kernel32

ReadProcessMemory
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
UnmapViewOfFile
CloseHandle
CreateProcessW
SetEvent
GetLastError
MapViewOfFile
Wow64RevertWow64FsRedirection
GetSystemDirectoryW
Wow64DisableWow64FsRedirection
IsWow64Process
GlobalFree
GetCommandLineW
HeapSetInformation
DeleteFileW
OpenProcess
GetSystemDefaultLCID
InterlockedIncrement
lstrlenW
InterlockedDecrement
CreateEventW
LocalFree
OutputDebugStringA
GetProcAddress
OpenMutexW
HeapFree
OpenPrivateNamespaceW
HeapAlloc
GetProcessHeap
WaitForSingleObject
GetModuleHandleW
OpenFileMappingW
ClosePrivateNamespace
CreateFileMappingW
GetApplicationRecoveryCallback

ole32

StringFromGUID2
CoInitialize
CoCreateInstance
CoCreateGuid
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize

oleaut32

SysAllocString
LoadRegTypeLi
SysFreeString
SysAllocStringLen
LoadTypeLibEx

shell32

CommandLineToArgvW
ShellExecuteExW

wer

WerpAddRegisteredDataToReport
WerpSetCallBack
WerReportSubmit
WerReportCloseHandle
WerReportAddDump
WerpEnumerateStoreStart
WerpEnumerateStoreNext
WerpOpenMachineQueue
WerpSubmitReportFromStore
WerpOpenUserQueue
WerpCloseStore
WerpShowNXNotification
WerpIsTransportAvailable
WerpSetReportInformation
WerpGetReportInformation
WerpGetReportType
WerpLoadReport

user32

CloseWindowStation
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
CloseDesktop

ntdll

RtlAllocateAndInitializeSid
RtlCreateBoundaryDescriptor
RtlCreateServiceSid
RtlAddSIDToBoundaryDescriptor
RtlDeleteBoundaryDescriptor
NtQueryInformationProcess
RtlInitUnicodeString
NtQueryInformationToken
NtClose
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9dcbf6851631fcc0d50034d7282c766b

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

ole32

oleaut32

shell32

wer

user32

ntdll

Sections

.text Size: 45KB - Virtual size: 45KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 26KB

.text
Size: 45KB - Virtual size: 45KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 26KB