ae5c7fdee090c729763425e59bf5f7c11fe573e08abad43b1ada02ac77065a17

Sharing

Copy URL Twitter E-mail

General

Target

ae5c7fdee090c729763425e59bf5f7c11fe573e08abad43b1ada02ac77065a17
Size

378KB
MD5

5bb8c929587d8d816385559819a15ca6
SHA1

704ed7d143bbcf075062bfdae7fe953dd8581d8e
SHA256

ae5c7fdee090c729763425e59bf5f7c11fe573e08abad43b1ada02ac77065a17
SHA512

a00057b9f192d16b4d68e463ad46442329ed78f516f4047fa2ca3a4b95bc88d657254b38f2981292e036f14194358ea46ef93704f4c6979996378de9397b27fd
SSDEEP

6144:3Keomw6jqfAJ7ui9WkrQVKIpDiYMSsQMDiZdIEXyaAKqB2Fuje1lT/HR:34bIJ7ucWk10DGSySXXyAkWDx

Score

N/A

Malware Config

Signatures

Files

ae5c7fdee090c729763425e59bf5f7c11fe573e08abad43b1ada02ac77065a17
.exe windows x86

ae788bb9e895dc0dc567bf96f009370e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwExtendSection
NtSuspendProcess
NtSetQuotaInformationFile
RtlGetControlSecurityDescriptor
ZwQuerySystemTime
ZwImpersonateThread
NtOpenThreadToken
NtMakeTemporaryObject
RtlLookupElementGenericTableAvl
RtlRegisterWait
strpbrk
RtlUnicodeToOemN
LdrShutdownThread
ZwDeleteValueKey
_wcsupr
NtSetInformationThread
NtQueryMutant
NtAllocateUserPhysicalPages
strlen
NtCreateEvent
_strnicmp
strrchr
RtlGetCompressionWorkSpaceSize
LdrVerifyImageMatchesChecksum
RtlDosSearchPath_Ustr
NtNotifyChangeDirectoryFile
ZwGetPlugPlayEvent
ZwConnectPort
RtlQueueApcWow64Thread
NtSetEaFile
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlOemStringToUnicodeSize
_CIsin
KiUserApcDispatcher
ZwFreeUserPhysicalPages
RtlDeleteCriticalSection
strcat
RtlSubAuthoritySid
LdrUnloadAlternateResourceModule
ZwQueryBootEntryOrder
cos
RtlFillMemoryUlong
CsrIdentifyAlertableThread
ZwQuerySymbolicLinkObject
RtlIsActivationContextActive
RtlAppendPathElement
DbgQueryDebugFilterState
wcscspn
ZwCancelTimer
ZwStopProfile
NtDeleteObjectAuditAlarm
ZwEnumerateValueKey
RtlGetActiveActivationContext
LdrFindEntryForAddress
_fltused
RtlInitializeGenericTable
NtUnlockVirtualMemory
RtlAdjustPrivilege
RtlGetSecurityDescriptorRMControl
NtEnumerateSystemEnvironmentValuesEx
DbgUiRemoteBreakin
RtlLocalTimeToSystemTime
NtResumeProcess
_ultow
islower
RtlAssert
RtlFindClearBitsAndSet
_wcslwr
RtlIpv6AddressToStringA
ZwSetInformationJobObject
RtlIpv6StringToAddressA
ZwCreateTimer
RtlNtStatusToDosErrorNoTeb
memset
NtAlertResumeThread
RtlSetSecurityObject
ZwQueryIntervalProfile
RtlxUnicodeStringToOemSize

msvcrt

_wspawnv
_setjmp
_fpreset
__mb_cur_max
??4exception@@QAEAAV0@ABV0@@Z
_mbsncmp
_swab
wcstombs
__setlc_active
_strnicmp
_unlock
fgetpos
_toupper
_chdir
_atodbl
isspace
_spawnle
rewind
_setmbcp
_wtoi64
_CIcosh
fwrite
_wcsicmp
wcscat
___lc_codepage_func
fputwc
_safe_fdiv
strlen
??_Gbad_cast@@UAEPAXI@Z
strstr
_strtoui64
_mbsrev
fclose
_mbsnbcpy
towupper
fwprintf
__badioinfo
_strrev
__p__osver
_itow
_except_handler2
__CxxUnregisterExceptionObject
_tzname
_fullpath
sinh

kernel32

LocalFree
TransmitCommChar
InitAtomTable
EnumDateFormatsA
GetSystemTimeAsFileTime
FindFirstFileW
GetSystemInfo
LZInit
GetLocaleInfoW
SetConsoleActiveScreenBuffer
HeapLock
GlobalHandle
GetLastError
DebugActiveProcess
SetFileShortNameW
GetNumaProcessorNode
VirtualAlloc
OutputDebugStringW
CancelTimerQueueTimer
lstrcatA
LoadLibraryA
ShowConsoleCursor
VerLanguageNameA
SetConsoleCursorInfo
RestoreLastError
CreateMemoryResourceNotification
FindVolumeMountPointClose
SetTimerQueueTimer
HeapCreate
MulDiv
GetAtomNameW
WriteProfileStringA
ReadFileEx
GetCommProperties
SetFileValidData
SetVolumeMountPointW
SetConsoleDisplayMode
LocalAlloc
EnumCalendarInfoA
SetSystemTime
GetExitCodeThread
RemoveLocalAlternateComputerNameW
GetCalendarInfoW
FindNextFileW
GetNumberOfConsoleFonts
DebugBreak
RaiseException

winsta

WinStationEnumerate_IndexedW
WinStationActivateLicense
ServerLicensingGetAvailablePolicyIds
ServerLicensingClose
ServerLicensingFreePolicyInformation
ServerSetInternetConnectorStatus
WinStationFreeMemory
_WinStationUpdateSettings
WinStationShadow
WinStationVirtualOpen
_WinStationNotifyDisconnectPipe
WinStationUnRegisterConsoleNotification
ServerLicensingGetPolicyInformationW
WinStationGetLanAdapterNameA
WinStationCloseServer
ServerLicensingSetPolicy
WinStationSetInformationW
_NWLogonSetAdmin
WinStationOpenServerA
WinStationRemoveLicense
_WinStationUpdateUserConfig
ServerQueryInetConnectorInformationA
ServerLicensingOpenW
WinStationGenerateLicense
_WinStationBreakPoint
ServerLicensingLoadPolicy
_WinStationNotifyLogon
ServerLicensingDeactivateCurrentPolicy
ServerLicensingOpenA
WinStationWaitSystemEvent
WinStationBroadcastSystemMessage
LogonIdFromWinStationNameW
ServerLicensingUnloadPolicy
_WinStationWaitForConnect
_WinStationCheckForApplicationName
WinStationIsHelpAssistantSession
WinStationReset
WinStationConnectW
WinStationNameFromLogonIdW
_WinStationShadowTargetSetup
ServerGetInternetConnectorStatus
LogonIdFromWinStationNameA
WinStationSendMessageW
WinStationFreeGAPMemory

crtdll

_ftol
_get_osfhandle
_mbcjistojms
_toupper
isdigit
vfwprintf
tan
_filelength
_ismbcupper
exit
_setmode
wcsftime
_mbsrev
_CIacos
_mbsnbicmp
__iscsymf
_unlink
_ultoa
_chsize
acos
isprint
strncat
??3@YAXPAX@Z
_ismbcl2
_mbschr
puts
_mbscspn
_mbctombb
strncpy
_cwait

user32

EndDialog

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae788bb9e895dc0dc567bf96f009370e

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

msvcrt

kernel32

winsta

crtdll

user32

Sections

.text Size: 136KB - Virtual size: 136KB

.rdata Size: 120KB - Virtual size: 120KB

.data Size: 1KB - Virtual size: 547KB

.rsrc Size: 119KB - Virtual size: 119KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 136KB - Virtual size: 136KB

.rdata
Size: 120KB - Virtual size: 120KB

.data
Size: 1KB - Virtual size: 547KB

.rsrc
Size: 119KB - Virtual size: 119KB

.reloc
Size: 1024B - Virtual size: 1024B