2023-02-12_86f734014a06d860549052fe2223d462_destroyer_kangaroo[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2023-02-12_86f734014a06d860549052fe2223d462_destroyer_kangaroo.exe
Size

17KB
MD5

86f734014a06d860549052fe2223d462
SHA1

896b92f754a758868bd1b2f2565aca2bb04719c5
SHA256

2b3865a354159aa3050788a81395fa7aab1d99765f0d87ac57823214cdbd6e4c
SHA512

3605d32fe6307dbcf10c2dbc1efd192a2f9674782a9b302df7f8e9450413a393db87cc22cf71c6191a5e1121967d998cb0ea0981103393d1ff4fce2492ac6d24
SSDEEP

384:19uTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zFXWVhWXWh3:19u9CaxEovcm/BCvXFSH3

Score

1^/10

Malware Config

Signatures

Files

2023-02-12_86f734014a06d860549052fe2223d462_destroyer_kangaroo.exe
.exe windows x86

745d7f50636fb2b25f5ec7f180ef6ab7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

CryptEncrypt
CryptHashData
CloseEventLog
RegSetValueExW
RegCloseKey
ClearEventLogW
CryptAcquireContextW
OpenEventLogW
CryptDeriveKey
CryptReleaseContext
RegDisableReflectionKey
CryptCreateHash
RegOpenKeyExW
CryptDestroyKey
CryptDestroyHash

wtsapi32

WTSDisconnectSession
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
WTSLogoffSession

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

kernel32

GetFileTime
GetFileAttributesW
ExpandEnvironmentStringsW
CreateThread
GetVolumeInformationW
SetFileAttributesW
GetCurrentProcessId
DeleteFileW
CloseHandle
FindNextFileW
UpdateResourceW
lstrcatW
WTSGetActiveConsoleSessionId
GetSystemDefaultLangID
ExitProcess
GetFileSize
CreateMutexW
FindFirstFileW
SetFilePointer
FreeResource
lstrlenA
GetDriveTypeW
SetEndOfFile
FindResourceW
LoadResource
CreateProcessW
EndUpdateResourceW
GetLogicalDriveStringsW
GlobalLock
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualFree
SetFileTime
WriteFile
GlobalAlloc
Sleep
CopyFileW
SizeofResource
WaitForMultipleObjects
ReadFile
GetModuleFileNameW
CreateFileW
ExitThread
lstrcmpW
MultiByteToWideChar
lstrlenW
GlobalUnlock
GetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
MoveFileW
GetSystemDefaultLocaleName
GlobalFree
FindClose
ProcessIdToSessionId
LockResource
GetCurrentThreadId

user32

CloseClipboard
GetMessageW
PostQuitMessage
LoadCursorW
wsprintfW
DispatchMessageW
DefWindowProcW
SetWindowTextW
SetClipboardData
GetSystemMetrics
MessageBoxW
OpenClipboard
CreateWindowExW
ShowWindow
EmptyClipboard
GetWindowTextW
GetWindowLongW
LoadIconW
RegisterClassExW
TranslateMessage

gdi32

CreateSolidBrush

shell32

CommandLineToArgvW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

745d7f50636fb2b25f5ec7f180ef6ab7

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

version

advapi32

wtsapi32

mpr

kernel32

user32

gdi32

shell32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 5KB - Virtual size: 4KB