f644d0afe4c694b03c6acc4c00cc3d291cbeeb0e202ecaf6c599f3ceb5156bf8

Sharing

Copy URL Twitter E-mail

General

Target

f644d0afe4c694b03c6acc4c00cc3d291cbeeb0e202ecaf6c599f3ceb5156bf8
Size

2.9MB
MD5

451e9574134fff4703c31472977ff66c
SHA1

dc8d00379c39f041526c0cc878ca9cc47fbc0b5f
SHA256

f644d0afe4c694b03c6acc4c00cc3d291cbeeb0e202ecaf6c599f3ceb5156bf8
SHA512

a61ea33089c755a6248dd5b757bf43b6e403cf6869a3c123aab172ef757c75e90bb7a6c15a061a59bd96f31c6caea4de645376d464b1f10cdd0125b018c7eea3
SSDEEP

49152:VfP1upMjhtdnycmV6MORg7gGwAAI20Y6lw+lOIoWls3p4kJrmEXI7wv6FmxgqwCZ:zEMjhXInB0GN20nlwsT1yjJaaI7wv6Fk

Score

N/A

Malware Config

Signatures

Files

f644d0afe4c694b03c6acc4c00cc3d291cbeeb0e202ecaf6c599f3ceb5156bf8
.exe windows x86

e6eeba611096acae1ec55db5c14bcbe4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord4213
ord2570
ord4392
ord3577
ord3605

ole32

ReleaseStgMedium
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CoTaskMemFree
CoCreateInstance

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
InitializeSecurityDescriptor
CopySid
GetLengthSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
RegDeleteKeyW
RegEnumKeyExW
LsaOpenPolicy
LsaLookupNames
GetSidSubAuthorityCount
GetSidSubAuthority
LsaFreeMemory
LsaOpenAccount
LsaCreateAccount
LsaGetSystemAccessAccount
LsaSetSystemAccessAccount
LsaClose
GetSecurityDescriptorLength
GetSecurityDescriptorControl
AllocateAndInitializeSid
MakeSelfRelativeSD
FreeSid
MapGenericMask
ControlService
StartServiceW
EnumDependentServicesW
ChangeServiceConfigW
QueryServiceStatusEx
RevertToSelf
IsWellKnownSid
RegConnectRegistryW
QueryServiceStatus
GetUserNameW
RegDeleteValueW
EnumServicesStatusW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorDacl

shlwapi

ord437

gdi32

DeleteObject

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj5
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj50
Size: 512B - Virtual size: 222B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj51
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj52
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj53
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj54
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj55
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj56
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj57
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fhj58
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fhj59
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.1231
Size: 512B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.JAKS
Size: 512B - Virtual size: 246B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GAHS
Size: 512B - Virtual size: 198B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HAJS
Size: 512B - Virtual size: 458B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HnJS
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SKALS
Size: 512B - Virtual size: 242B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SKAkS
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SfAkS
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 322B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6eeba611096acae1ec55db5c14bcbe4

Headers

DLL Characteristics

File Characteristics

Imports

mfc42u

ole32

advapi32

shlwapi

gdi32

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 2KB - Virtual size: 2KB

.fhj5 Size: 512B - Virtual size: 196B

.fhj50 Size: 512B - Virtual size: 222B

.fhj51 Size: 512B - Virtual size: 228B

.fhj52 Size: 205KB - Virtual size: 204KB

.fhj53 Size: 205KB - Virtual size: 204KB

.fhj54 Size: 512B - Virtual size: 212B

.fhj55 Size: 512B - Virtual size: 214B

.fhj56 Size: 512B - Virtual size: 216B

.fhj57 Size: 512B - Virtual size: 214B

.fhj58 Size: 512B - Virtual size: 212B

.fhj59 Size: 512B - Virtual size: 212B

.1231 Size: 512B - Virtual size: 214B

.JAKS Size: 512B - Virtual size: 246B

.GAHS Size: 512B - Virtual size: 198B

.HAJS Size: 512B - Virtual size: 458B

.HnJS Size: 512B - Virtual size: 168B

.SKALS Size: 512B - Virtual size: 242B

.SKAkS Size: 512B - Virtual size: 260B

.SfAkS Size: 512B - Virtual size: 260B

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 512B - Virtual size: 322B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 2KB - Virtual size: 2KB

.fhj5
Size: 512B - Virtual size: 196B

.fhj50
Size: 512B - Virtual size: 222B

.fhj51
Size: 512B - Virtual size: 228B

.fhj52
Size: 205KB - Virtual size: 204KB

.fhj53
Size: 205KB - Virtual size: 204KB

.fhj54
Size: 512B - Virtual size: 212B

.fhj55
Size: 512B - Virtual size: 214B

.fhj56
Size: 512B - Virtual size: 216B

.fhj57
Size: 512B - Virtual size: 214B

.fhj58
Size: 512B - Virtual size: 212B

.fhj59
Size: 512B - Virtual size: 212B

.1231
Size: 512B - Virtual size: 214B

.JAKS
Size: 512B - Virtual size: 246B

.GAHS
Size: 512B - Virtual size: 198B

.HAJS
Size: 512B - Virtual size: 458B

.HnJS
Size: 512B - Virtual size: 168B

.SKALS
Size: 512B - Virtual size: 242B

.SKAkS
Size: 512B - Virtual size: 260B

.SfAkS
Size: 512B - Virtual size: 260B

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 512B - Virtual size: 322B