15bf842e088d0f021245010b6557781b276b3131507f62200e9f9b33b4eb323a

Sharing

Copy URL Twitter E-mail

General

Target

15bf842e088d0f021245010b6557781b276b3131507f62200e9f9b33b4eb323a
Size

48KB
MD5

149c5fb4d976afe892455713e55a9d1f
SHA1

1d3966d0d6372b9d8fea8e2d5af9d4f3342afb27
SHA256

15bf842e088d0f021245010b6557781b276b3131507f62200e9f9b33b4eb323a
SHA512

40dcea9ef690add50d1ab81ae100f5e74c0f7f9680d291b1473b6b901933f13da844a9d01209e0a71dae6dfa091c6509f5a372a605863704b7096fcfee28957c
SSDEEP

768:QmOoEPq7DMTgTHil2WnGV1nI4xdzpEG7rKuQiei8N9brzdMv5poRdx7z3DKCrZhQ:LD1wOixGV1nIqJFJQXN9jWLyP7z3DO

Score

N/A

Malware Config

Signatures

Files

15bf842e088d0f021245010b6557781b276b3131507f62200e9f9b33b4eb323a
.exe windows x86

590ad1e6da8df09f5eb202ab136d89cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

vssapi

??1CVssWriter@@UAE@XZ
??0CVssJetWriter@@QAE@XZ
?OnPostRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?IsPathAffected@CVssWriter@@IBG_NPBG@Z
?OnFreezeEnd@CVssJetWriter@@UAG_N_N@Z
?OnPrepareSnapshotEnd@CVssJetWriter@@UAG_N_N@Z
?OnPrepareSnapshotBegin@CVssJetWriter@@UAG_NXZ
?OnVSSApplicationStartup@CVssWriter@@UAG_NXZ
?SetWriterFailure@CVssWriter@@IAGJJ@Z
?OnContinueIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?OnIdentify@CVssWriter@@UAG_NPAVIVssCreateWriterMetadata@@@Z
?Uninitialize@CVssJetWriter@@QAGXXZ
?OnPreRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?InstallAlternateWriter@CVssWriter@@QAGJU_GUID@@0@Z
?OnBackupCompleteBegin@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPostSnapshot@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnAbortBegin@CVssJetWriter@@UAGXXZ
?IsBootableSystemStateBackedUp@CVssWriter@@IBG_NXZ
?IsPartialFileSupportEnabled@CVssWriter@@IBG_NXZ
?GetCurrentSnapshotSetId@CVssWriter@@IBG?AU_GUID@@XZ
?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z
?OnVSSShutdown@CVssWriter@@UAG_NXZ
?OnBackupComplete@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnThawBegin@CVssJetWriter@@UAG_NXZ
?OnPrepareBackupEnd@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@_N@Z
?OnFreezeBegin@CVssJetWriter@@UAG_NXZ
?OnPreRestoreBegin@CVssJetWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPrepareBackup@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z

ntdll

isdigit
NtCreateJobObject
NtUnloadKey
RtlSetControlSecurityDescriptor
RtlAreBitsSet
RtlNumberGenericTableElementsAvl
DbgUiContinue
RtlQueryProcessHeapInformation
ZwRemoveProcessDebug
RtlImageRvaToVa
RtlLargeIntegerArithmeticShift
NlsAnsiCodePage
NtQuerySystemTime
NtSetTimerResolution
RtlSetEnvironmentVariable
RtlAddAuditAccessAceEx
_chkstk
LdrShutdownThread
NtAccessCheckByTypeAndAuditAlarm
LdrFlushAlternateResourceModules
ZwReadFileScatter
NtQueryDefaultUILanguage
RtlCheckForOrphanedCriticalSections
RtlGetLengthWithoutLastFullDosOrNtPathElement
NtLoadKey
RtlxAnsiStringToUnicodeSize
NtQueryInformationToken
RtlRunEncodeUnicodeString
RtlUnicodeToCustomCPN
NtAddBootEntry
DbgUiConvertStateChangeStructure
LdrFindResource_U
NtSetInformationDebugObject
NtQueryVirtualMemory
strpbrk
ZwReadVirtualMemory
ZwSetInformationToken
NtOpenSymbolicLinkObject
iswalpha
ZwSetTimer
NtReadVirtualMemory
ZwDeleteFile
RtlSystemTimeToLocalTime
ZwQueryVolumeInformationFile
NtSetTimer

kernel32

IsProcessorFeaturePresent
LoadLibraryW
ConvertDefaultLocale
GlobalHandle
GetTempPathW
DosPathToSessionPathA
GetModuleHandleA
FindNextFileA
lstrcat
DeleteVolumeMountPointW
GetBinaryTypeW
VDMConsoleOperation
FindResourceExA
RemoveDirectoryA
lstrcmpW
SetConsoleMaximumWindowSize
SetupComm
SetConsoleMode
SetCalendarInfoW
GetNativeSystemInfo
IsWow64Process
OpenProfileUserMapping
CreateActCtxW
GetOEMCP
GetProcessVersion
GlobalFree
GetLongPathNameW
DefineDosDeviceW
VerSetConditionMask
GlobalGetAtomNameA
LZStart
EnumResourceLanguagesW

msdart

?WriteUnlock@CReaderWriterLock2@@QAEXXZ
?SetDefaultSpinAdjustmentFactor@CReaderWriterLock2@@SGXN@Z
?_H1@CLKRLinearHashTable@@CGKKK@Z
?ConvertSharedToExclusive@CReaderWriterLock2@@QAEXXZ
?_ReadOrWriteLock@CLKRLinearHashTable@@ABE_NXZ
?Push@CLockedSingleList@@QAEXQAVCSingleListEntry@@@Z
??0CReaderWriterLock2@@QAE@XZ
?TryWriteLock@CReaderWriterLock3@@QAE_NXZ
?TryWriteLock@CSmallSpinLock@@QAE_NXZ
?SetSpinCount@CCritSec@@QAE_NG@Z

clusapi

GetClusterResourceNetworkName
ClusterNodeGetEnumCount
GetClusterFromGroup
DeleteClusterGroup
ClusterRegGetKeySecurity
SetClusterResourceName
ChangeClusterResourceGroup
ClusterRegQueryValue
ResumeClusterNode
ClusterNodeEnum
OfflineClusterGroup
GetClusterNetworkState
ClusterResourceTypeControl
ClusterNetworkControl
GetClusterNetInterfaceState
ClusterResourceGetEnumCount
PauseClusterNode
ClusterGroupOpenEnum
ClusterResourceTypeEnum
SetClusterName

cabinet

GetDllVersion
FDICopy
FCICreate
FCIFlushFolder
FCIAddFile
FDITruncateCabinet
FCIDestroy
FDIIsCabinet
Extract
FCIFlushCabinet
DllGetVersion
DeleteExtractedFiles
FDICreate
FDIDestroy

ifsutil

?Format@VOL_LIODPDRV@@QAE?AW4FORMAT_ERROR_CODE@@PBVWSTRING@@PAVMESSAGE@@KKK@Z
?GetData@TLINK@@QAEAAVBIG_INT@@PAX@Z
?DoesIntersectSet@NUMBER_SET@@QBEEVBIG_INT@@0@Z
??1SPARSE_SET@@UAE@XZ
?SetCache@IO_DP_DRIVE@@QAEXPAVDRIVE_CACHE@@@Z
?QueryDisjointRangeAndAssignBuffer@TLINK@@QAEPAXPAVBIG_INT@@PAG1PAXK2@Z
?GetCannedSecurity@IFS_SYSTEM@@SGPAVCANNED_SECURITY@@XZ
?DismountVolume@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EG@Z
??1LOG_IO_DP_DRIVE@@UAE@XZ
?QueryDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?AddVolumeName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

590ad1e6da8df09f5eb202ab136d89cf

Headers

DLL Characteristics

File Characteristics

Imports

vssapi

ntdll

kernel32

msdart

clusapi

cabinet

ifsutil

Sections

.text Size: 29KB - Virtual size: 29KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 152B

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 152B

.rsrc
Size: 8KB - Virtual size: 8KB