fd51f599ad106e398e2cb5100bd7b67b1758e30f2e9b86beaa323c70d5ef5981

Sharing

Copy URL Twitter E-mail

General

Target

fd51f599ad106e398e2cb5100bd7b67b1758e30f2e9b86beaa323c70d5ef5981
Size

4.7MB
MD5

46096e83d2434af327b3298350a82d52
SHA1

02fea122e18f033d9019a667d86cb846a0cc0e4f
SHA256

fd51f599ad106e398e2cb5100bd7b67b1758e30f2e9b86beaa323c70d5ef5981
SHA512

86b6738d236078237e33d8dda1fb8deda167c4ce12409a8f8e7c4f8990f5b067e5219447f534cd7778cc1630809fa4332394cd9019d880051c658405f63b569c
SSDEEP

49152:PVJWSWwj/hhJhBY7el9910dFeU9Diy8iyAyHtZTZJW3xBW5BSZMe4Qkm5E6m7nN3:tu+T7y4CZf6V5Bq99u1iUhiB7Shrx

Score

N/A

Malware Config

Signatures

Files

fd51f599ad106e398e2cb5100bd7b67b1758e30f2e9b86beaa323c70d5ef5981
.exe windows x64

b10a023b9428093f0dc3ba68fd3278ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetDateFormatW
SetConsoleCtrlHandler
GetFileType
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ResumeThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
SetPriorityClass
GetCurrentThread
GetTimeFormatW
GetStartupInfoW
UnhandledExceptionFilter
ResetEvent
InitializeCriticalSectionAndSpinCount
__C_specific_handler
GetCPInfo
CompareStringEx
GetLocaleInfoEx
SwitchToThread
WaitForSingleObjectEx
IsProcessorFeaturePresent
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
CompareStringW
FlsAlloc
QueryPerformanceFrequency
LCMapStringEx
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
CreateSymbolicLinkW
GetModuleFileNameW
CreateHardLinkW
MoveFileExW
CreateDirectoryExW
AreFileApisANSI
GetTempPathW
SetFileTime
SetFilePointerEx
SetFileInformationByHandle
SetFileAttributesW
FlushFileBuffers
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileAttributesExW
GetDiskFreeSpaceExW
CreateDirectoryW
SetCurrentDirectoryW
GetStringTypeW
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
FormatMessageA
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
Heap32ListNext
OutputDebugStringW
IsDebuggerPresent
K32GetPerformanceInfo
GetVersionExW
GetWindowsDirectoryA
GetDriveTypeW
TerminateJobObject
QueryInformationJobObject
GetExitCodeThread
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
FlsGetValue
EnumSystemLocalesW
GetWindowsDirectoryW
GetSystemDirectoryW
QueryDosDeviceW
GetLogicalDrives
WriteFile
ReadProcessMemory
FindClose
FindNextFileW
FindFirstFileExW
VirtualQueryEx
Module32NextW
Module32FirstW
CreateFileW
WritePrivateProfileStructW
GetPrivateProfileStructW
GetSystemTimeAsFileTime
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileStringW
Process32FirstW
GetPrivateProfileIntW
Process32NextW
GetFileAttributesW
FormatMessageW
IsWow64Process
GetPriorityClass
LocalFree
K32EnumProcessModulesEx
IsProcessInJob
K32GetModuleFileNameExW
CopyFileW
GetFileInformationByHandle
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
DeleteFileW
lstrlenW
LoadLibraryW
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
HeapQueryInformation
WriteConsoleW
lstrcmpiW
ExitThread
SetUnhandledExceptionFilter
GetCurrentDirectoryW
GetComputerNameW
GetThreadTimes
GetThreadId
GetFileSizeEx
GetCurrentDirectoryA
GetModuleHandleExW
GetModuleFileNameA
DecodePointer
DebugBreak
LoadLibraryExW
WaitForMultipleObjects
CreateEventW
SetEvent
ExpandEnvironmentStringsW
TerminateProcess
SetEndOfFile
Heap32ListFirst
CreateToolhelp32Snapshot
K32GetMappedFileNameW
GetNativeSystemInfo
QueryFullProcessImageNameW
OpenProcess
CreateMutexW
FreeLibrary
GetProcessIdOfThread
OpenThread
GetCurrentProcessId
FreeResource
GetProcessId
GetActiveProcessorCount
GetCurrentProcess
QueryPerformanceCounter
GetProcAddress
GetModuleHandleW
GlobalLock
GlobalUnlock
GlobalAlloc
MulDiv
TerminateThread
SetThreadPriority
CreateThread
WaitForSingleObject
CloseHandle
VerifyVersionInfoW
SetLastError
VerSetConditionMask
RaiseException
WideCharToMultiByte
MultiByteToWideChar
VirtualFree
VirtualAlloc
GetTickCount64
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetLastError
Sleep
FindResourceW
DuplicateHandle
SizeofResource
DeviceIoControl
LockResource
HeapCreate
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetProcessTimes
lstrcmpW
VirtualQuery
EncodePointer
GlobalMemoryStatusEx
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileInformationByHandleEx
RtlUnwind

user32

GetWindowRect
MapWindowPoints
GetWindowLongW
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
LoadStringW
SendMessageW
PostMessageW
CallWindowProcW
UnregisterClassW
IsWindowVisible
LoadMenuW
DestroyMenu
GetSubMenu
TrackPopupMenu
MessageBoxW
GetCursorPos
DefWindowProcW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
ShowWindow
MoveWindow
GetDlgItem
SetDlgItemTextW
SetFocus
GetMenuItemInfoW
SetMenuItemInfoW
SetMenuDefaultItem
BeginPaint
EndPaint
ScreenToClient
GetSysColor
OffsetRect
GetWindowLongPtrW
GetClientRect
SetWindowLongPtrW
CheckMenuRadioItem
LoadCursorW
IsWindow
DestroyWindow
SetDlgItemInt
InvalidateRect
RedrawWindow
SetWindowTextW
SetWindowLongW
LoadImageW
GetDialogBaseUnits
OpenClipboard
EnumDesktopsW
EnumWindows
EnumChildWindows
GetDesktopWindow
IsZoomed
IsIconic
FlashWindowEx
GetClassLongPtrW
SendMessageTimeoutW
SystemParametersInfoW
DestroyIcon
GetGuiResources
GetWindowThreadProcessId
SetRectEmpty
FrameRect
GetSysColorBrush
WindowFromPoint
SetCursorPos
GetWindowDC
GetMenuItemID
LoadAcceleratorsW
CharNextW
CharLowerW
GetMessagePos
EndDialog
DispatchMessageW
SetWindowPos
CheckRadioButton
TranslateMessage
GetMessageW
DrawFrameControl
DrawEdge
ChangeWindowMessageFilterEx
ClientToScreen
SetActiveWindow
GetFocus
IsWindowEnabled
SetDlgItemTextA
GetAncestor
CloseClipboard
EndDeferWindowPos
SetClipboardData
EmptyClipboard
DeferWindowPos
BeginDeferWindowPos
wsprintfW
FindWindowW
SetForegroundWindow
SetMenuInfo
EnumDesktopWindows
IsDialogMessageW
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
UpdateWindow
DeleteMenu
ModifyMenuW
GetMenuStringW
GetMenu
TranslateAcceleratorW
GetDlgCtrlID
CreateDialogParamW
BringWindowToTop
IsMenu
InflateRect
DrawTextW
RegisterWindowMessageW
SetScrollInfo
SetCaretPos
ShowCaret
HideCaret
DestroyCaret
SetCaretBlinkTime
CreateCaret
ReleaseDC
GetDC
GetWindowTextLengthW
GetWindowTextW
IsDlgButtonChecked
CheckDlgButton
GetScrollInfo
EnableWindow
MonitorFromPoint
GetClassNameW
PtInRect
MessageBeep
TrackPopupMenuEx
RemoveMenu
AppendMenuW
GetMenuItemCount
CreatePopupMenu
PostQuitMessage
PeekMessageW
LoadStringA
EnableMenuItem
DialogBoxParamW
DefMDIChildProcW
FillRect
SetCursor
AdjustWindowRect
GetScrollPos
GetSystemMetrics
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetKeyState
LockWindowUpdate
SetScrollRange
SetScrollPos
KillTimer
SetLayeredWindowAttributes
GetActiveWindow
TrackMouseEvent

gdi32

SetBrushOrgEx
PatBlt
CreatePatternBrush
CreateBitmap
GetNearestColor
CreatePen
CreateSolidBrush
GetObjectW
CreateDIBSection
DPtoLP
PolyTextOutW
GetDeviceCaps
CreateFontIndirectW
TextOutW
GetTextExtentPoint32W
GetCurrentObject
ExtTextOutW
ExtTextOutA
MoveToEx
GetTextMetricsW
SetTextAlign
SetTextColor
SetBkMode
SetBkColor
LineTo
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SetDCPenColor
SetDCBrushColor
SelectObject
Rectangle
GetStockObject
DeleteObject
DeleteDC

comdlg32

GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ReplaceTextW
ChooseColorW

advapi32

ConvertStringSidToSidW
PrivilegeCheck
LookupPrivilegeNameW
SetTokenInformation
IsWellKnownSid
CreateProcessWithTokenW
SetThreadToken
OpenServiceW
StartServiceW
ControlService
DeleteService
OpenSCManagerW
QueryServiceStatus
CreateServiceW
CreateProcessAsUserW
RegDeleteKeyW
RegSaveKeyExW
RegLoadMUIStringW
RegSaveKeyW
RegRestoreKeyW
LookupAccountSidW
GetSidSubAuthority
CloseServiceHandle
GetSecurityInfo
SetKernelObjectSecurity
GetKernelObjectSecurity
RegRenameKey
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegConnectRegistryW
OpenProcessToken
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
ConvertSidToStringSidW
IsValidSid
GetLengthSid
CopySid
RegCopyTreeW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteTreeW
RegCloseKey
LookupAccountNameW
QueryServiceStatusEx
QueryServiceConfig2W
QueryServiceConfigW
EnumServicesStatusExW
ChangeServiceConfig2W
GetSidSubAuthorityCount
OpenTraceW
ControlTraceW
TraceSetInformation
CloseTrace
ProcessTrace
StartTraceW
AdjustTokenPrivileges
LookupPrivilegeValueW
LsaOpenPolicy
DuplicateTokenEx
GetTokenInformation

shell32

ShellExecuteW
Shell_NotifyIconW
SHGetStockIconInfo
SHGetFileInfoW
ShellExecuteExW
SHGetFolderPathW
ExtractIconExW

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoInitializeEx
StgCreateStorageEx
StgOpenStorageEx
CoTaskMemAlloc
CoUninitialize
StringFromGUID2

oleaut32

SysFreeString
VarUI4FromStr

shlwapi

SHAutoComplete

comctl32

ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_DrawIndirect
CreateStatusWindowW
InitCommonControlsEx
ord381
ImageList_Draw

uxtheme

IsAppThemed
SetWindowTheme
BufferedPaintUnInit
IsThemeActive
EndBufferedPaint
BufferedPaintInit
BeginBufferedPaint

msimg32

GradientFill

ntdll

RtlIpv6AddressToStringW
NtSuspendProcess
NtQueryMutant
RtlNtStatusToDosError
NtOpenKey
NtGetNextThread
NtResumeProcess
NtQueryInformationProcess
NtQueryDirectoryObject
NtQuerySystemInformation
RtlIpv4AddressToStringW
NtQueryObject
NtTerminateProcess
NtOpenMutant
NtOpenSymbolicLinkObject
NtOpenEvent
NtOpenSemaphore
NtOpenEventPair
NtOpenJobObject
NtOpenIoCompletion
NtQueryKey
NtOpenDirectoryObject
NtQueryEvent
NtCreateKey
NtQuerySection
NtQuerySemaphore
NtOpenSection
NtQuerySymbolicLinkObject
NtQueryTimer
NtQueryInformationWorkerFactory
NtOpenFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryInformationThread

fltlib

FilterFindNext
FilterFindClose
FilterFindFirst

setupapi

SetupDiGetClassDescriptionExW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassRegistryPropertyW
SetupDiGetClassImageIndex
SetupDiGetClassDevsExW
SetupDiGetClassPropertyKeys
SetupDiGetClassImageList
SetupDiLoadDeviceIcon
SetupDiDestroyDeviceInfoList

version

VerQueryValueW
GetFileVersionInfoW

ws2_32

htons

tdh

TdhFormatProperty
TdhGetEventInformation
TdhGetEventMapInformation
TdhGetPropertySize

sspicli

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesW

iphlpapi

GetOwnerModuleFromUdp6Entry
GetExtendedUdpTable
GetOwnerModuleFromUdpEntry
GetOwnerModuleFromTcp6Entry
GetExtendedTcpTable
GetOwnerModuleFromTcpEntry

aclui

ord2

wininet

InternetQueryOptionW
HttpQueryInfoA
HttpSendRequestW
HttpOpenRequestA
InternetSetOptionA
InternetOpenA
InternetReadFile
InternetOpenUrlA
InternetConnectA
InternetCloseHandle

dbghelp

SymFromAddr
SymGetSymFromName64
SymSetOptions
SymInitialize
ImageRvaToVa
UnDecorateSymbolName
ImageNtHeader
SymGetTypeInfo
SymFromIndex
SymGetTypeFromName
SymCleanup
SymLoadModuleEx
SymGetModuleInfo64
SymFromName

fwpuclnt

FwpmEngineClose0
FwpmFilterDeleteById0
FwpmEngineOpen0
FwpmFilterDestroyEnumHandle0
FwpmFilterCreateEnumHandle0
FwpmLayerGetByKey0
FwpmFreeMemory0
FwpmFilterEnum0

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640KB - Virtual size: 640KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b10a023b9428093f0dc3ba68fd3278ae

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

uxtheme

msimg32

ntdll

fltlib

setupapi

version

ws2_32

tdh

sspicli

wtsapi32

iphlpapi

aclui

wininet

dbghelp

fwpuclnt

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 640KB - Virtual size: 640KB

.data Size: 89KB - Virtual size: 121KB

.pdata Size: 125KB - Virtual size: 124KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 640KB - Virtual size: 640KB

.data
Size: 89KB - Virtual size: 121KB

.pdata
Size: 125KB - Virtual size: 124KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 11KB - Virtual size: 11KB