800603f2606ed60d024ac6223fed02a0186dec74128524b9a8454bf4375b4889

Sharing

Copy URL Twitter E-mail

General

Target

800603f2606ed60d024ac6223fed02a0186dec74128524b9a8454bf4375b4889
Size

13.3MB
MD5

a457ef517994f30b02b4b52a19a26f29
SHA1

6f915e0d3cbc5babf6947d130eeb90660c9d63c2
SHA256

800603f2606ed60d024ac6223fed02a0186dec74128524b9a8454bf4375b4889
SHA512

b3e9b0ef0f25b7fc0d06a52addaa854cd2f5a3fba0af75a5bf138e923c984769b74cf08a5cfde2c45f4d69a819780418fdb4c7949272cef350f070ddf4dcc9de
SSDEEP

98304:Hq4jMT5dqxQ7uO5DZSv0KsFKN2GQRPQXP3KJ2grs8GPxTrlWheJDHKYEJwcdo:K4jsMv0KsQPrdPxTIUm

Score

1^/10

Malware Config

Signatures

Files

800603f2606ed60d024ac6223fed02a0186dec74128524b9a8454bf4375b4889
.exe windows x64

d23077f7c0f33c283be753954c058d94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

__WSAFDIsSet
WSASetLastError
socket
ntohs
htons
WSACreateEvent
select
send
getsockname
getpeername
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
getsockopt
connect
shutdown
WSAIoctl
recv
WSASend
WSAGetOverlappedResult
WSARecv
WSASocketW
closesocket
accept
bind
WSAGetLastError
ioctlsocket
setsockopt
htonl
listen
WSACloseEvent

crypt32

CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFindCertificateInStore
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertDuplicateStore
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenStore

ntdll

RtlNtStatusToDosError
NtQueryInformationProcess
RtlVirtualUnwind
NtQuerySystemInformation
RtlUnwindEx
RtlPcToFileHeader
NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlGetVersion
VerSetConditionMask
RtlGetNtVersionNumbers

secur32

DecryptMessage
QueryContextAttributesW
FreeContextBuffer
FreeCredentialsHandle
AcceptSecurityContext
ApplyControlToken
DeleteSecurityContext
AcquireCredentialsHandleA
EncryptMessage
InitializeSecurityContextW

kernel32

TzSpecificLocalTimeToSystemTime
GetProcessIoCounters
GetSystemTimes
VirtualQueryEx
ReadProcessMemory
GetProcessTimes
ExitProcess
SetConsoleTextAttribute
CreateEventW
GetOverlappedResult
WaitForMultipleObjects
CreateThread
GetFileAttributesW
CreateProcessW
GetWindowsDirectoryW
LoadLibraryExW
GetHandleInformation
InitializeSRWLock
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
InitializeCriticalSectionEx
GetSystemDirectoryA
GetTickCount
MultiByteToWideChar
MoveFileExA
GetEnvironmentVariableA
VerifyVersionInfoW
CreateFileA
GetCurrentThreadId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CancelIo
GetFileSizeEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
IsDebuggerPresent
InitializeSListHead
GetSystemDirectoryW
CompareStringOrdinal
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileW
GetFinalPathNameByHandleW
GetFullPathNameW
GetFileInformationByHandle
GetCommandLineW
GetModuleFileNameW
GetTempPathW
GetProcessHeap
HeapAlloc
HeapFree
CloseHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetSystemInfo
GetStdHandle
HeapReAlloc
FindNextFileW
GetLastError
DeleteFileW
FindClose
GetCurrentProcess
GetComputerNameExW
GetTickCount64
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
Sleep
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileW
GetConsoleMode
SetConsoleMode
SleepConditionVariableSRW
GetConsoleScreenBufferInfo
AddVectoredExceptionHandler
SetThreadStackGuarantee
ReleaseMutex
GetCurrentThread
WaitForSingleObjectEx
LoadLibraryA
GetProcAddress
CreateMutexA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
WakeAllConditionVariable
GetModuleHandleW
GetCurrentProcessId
LocalAlloc
CreateNamedPipeW
LocalFree
WaitForSingleObject
GetExitCodeProcess
SwitchToThread
ReadFile
WriteConsoleW
ReadConsoleW
CancelIoEx
OpenProcess
lstrlenW
WakeConditionVariable
UnmapViewOfFile
GetFileInformationByHandleEx
TryAcquireSRWLockExclusive
CreateFileMappingW
MapViewOfFile
DuplicateHandle
VirtualProtect
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
PostQueuedCompletionStatus
SetHandleInformation
FreeLibrary
GetModuleHandleA
SleepEx
ReadFileEx
ReleaseSRWLockShared
AcquireSRWLockShared
TerminateProcess
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
DeviceIoControl
SetLastError
WriteFileEx
GetNativeSystemInfo
SetFilePointerEx
GetCurrentDirectoryW
GetEnvironmentVariableW
FormatMessageW

oleaut32

SafeArrayDestroy
SysFreeString
SysAllocString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
GetErrorInfo
SysStringLen
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocStringLen

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree

pdh

PdhCollectQueryData
PdhGetFormattedCounterValue
PdhCloseQuery
PdhOpenQueryA
PdhRemoveCounter
PdhAddEnglishCounterW

bcrypt

BCryptCloseAlgorithmProvider
BCryptGenRandom
BCryptOpenAlgorithmProvider

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW
SHGetKnownFolderPath

advapi32

CryptAcquireContextA
CryptGetHashParam
GetUserNameW
GetTokenInformation
OpenProcessToken
CryptCreateHash
CryptHashData
IsWellKnownSid
DuplicateTokenEx
CheckTokenMembership
CreateWellKnownSid
CryptDestroyHash
LookupAccountSidW
SystemFunction036
AccessCheck
MapGenericMask
RegOpenKeyExW
RegQueryValueExW
DuplicateToken
RegCloseKey
GetFileSecurityW
EqualSid
CryptReleaseContext
OpenThreadToken
GetNamedSecurityInfoW

user32

MessageBoxW
GetSystemMetrics

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList

shlwapi

PathIsNetworkPathW

iphlpapi

GetIfEntry2

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW
GetPerformanceInfo

api-ms-win-crt-string-l1-1-0

strspn
strpbrk
strcmp
strlen
wcsncmp
_strdup
strncmp
strncpy
strcspn
strcpy_s
wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr
round
roundf
fmod
_fdopen
log

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_beginthreadex
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
__sys_nerr
__sys_errlist
_register_thread_local_exe_atexit_callback
abort
_errno
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
_c_exit
_wassert

api-ms-win-crt-heap-l1-1-0

realloc
malloc
calloc
_set_new_mode
_aligned_free
_aligned_malloc
free

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
wcstombs
strtoll
atoi

api-ms-win-crt-stdio-l1-1-0

_read
_write
_set_fmode
__p__commode
_close
_lseeki64
fgets
__acrt_iob_func
fread
fseek
fwrite
_open
fopen
fclose
fputs
__stdio_common_vsscanf
fflush
__stdio_common_vsprintf
feof
ftell
fputc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_gmtime64
strftime
_time64

api-ms-win-crt-filesystem-l1-1-0

_stat64
_fstat64
_unlink
_access

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 9.8MB - Virtual size: 9.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 367KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d23077f7c0f33c283be753954c058d94

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

ntdll

secur32

kernel32

oleaut32

ole32

pdh

bcrypt

shell32

advapi32

user32

setupapi

shlwapi

iphlpapi

powrprof

psapi

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 9.8MB - Virtual size: 9.8MB

.rdata Size: 3.0MB - Virtual size: 3.0MB

.data Size: 13KB - Virtual size: 17KB

.pdata Size: 367KB - Virtual size: 367KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 39KB - Virtual size: 39KB

.reloc Size: 52KB - Virtual size: 51KB

.text
Size: 9.8MB - Virtual size: 9.8MB

.rdata
Size: 3.0MB - Virtual size: 3.0MB

.data
Size: 13KB - Virtual size: 17KB

.pdata
Size: 367KB - Virtual size: 367KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 39KB - Virtual size: 39KB

.reloc
Size: 52KB - Virtual size: 51KB