executable[.]3724[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

executable.3724.exe
Size

779KB
MD5

c50b8eb554a62fafee6d012f76458839
SHA1

f3e7de5629b953c68f0a6135b1942bcb0749717a
SHA256

410dff59ad641e343e9d81b6dc8fd80ee6b4970bcfd20e1becc57b36c3aa3cc1
SHA512

48be803a86f9372452a743916fc13503295484c1295ecdee058f3a9a6ec8fa200a9b36527f44b9e3c6ffff4a6a7d9befdc11fafff8a974f04d1ec7da64f27cd7
SSDEEP

3072:ZzfpUWS/4gO8u73UuSnJZodKhTKdYTKwpoHbtazFLXCmPe/pVHRoWPAcZzwUuUo7:ZViwXRSJas4dopsqUmuDHRnBuUG

Score

1^/10

Malware Config

Signatures

Files

executable.3724.exe
.exe windows x64

137de18e95c986ecbfc2e8fe6d2a26b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

DispatchMessageW
PeekMessageW
TranslateMessage
MsgWaitForMultipleObjects
UnregisterDeviceNotification
RegisterDeviceNotificationW
SendNotifyMessageW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification

msvcrt

_commode
_unlock
memcpy
__dllonexit
_onexit
_fmode
_lock
__CxxFrameHandler3
_strnicmp
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
wcsncmp
memmove
_XcptFilter
_wcsnicmp
_vsnwprintf
wcsstr
??3@YAXPEAX@Z
_purecall
?terminate@@YAXXZ
strchr
wcschr
towlower
_stricmp
_wcsicmp
??2@YAPEAX_K@Z
towupper
memset

ntdll

RtlIpv4AddressToStringW
NtOpenProcessToken
NtClose
NtSetInformationThread
NtOpenThreadToken
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
EtwEventEnabled
RtlReportException
TpAllocPool
TpReleaseAlpcCompletion
TpWaitForAlpcCompletion
TpReleaseIoCompletion
TpWaitForIoCompletion
TpReleaseTimer
TpWaitForTimer
TpReleaseWait
TpWaitForWait
TpReleaseWork
TpWaitForWork
TpAllocAlpcCompletion
TpStartAsyncIoOperation
TpAllocIoCompletion
TpSetTimer
TpAllocTimer
TpAllocWait
TpPostWork
TpAllocWork
RtlNtStatusToDosError
TpSimpleTryPost
TpSetWait
TpCallbackMayRunLong
TpReleasePool
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlValidRelativeSecurityDescriptor
EtwEventWrite
NtQuerySystemInformation
EtwGetTraceLoggerHandle
EtwUnregisterTraceGuids
EtwEventUnregister
WinSqmIsOptedIn
WinSqmSetDWORD
WinSqmAddToStreamEx
WinSqmIncrementDWORD
EtwRegisterTraceGuidsW
EtwTraceMessage
EtwEventRegister
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
RtlIpv6AddressToStringW

api-ms-win-core-synch-l1-2-0

ReleaseMutex
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSection
CreateMutexW
AcquireSRWLockShared
InitializeSRWLock
SetEvent
CreateEventW
OpenEventW
EnterCriticalSection
ReleaseSRWLockShared
LeaveCriticalSection
WaitForSingleObject
Sleep
InitializeCriticalSectionAndSpinCount

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentProcess
ExitThread
GetCurrentThreadId
TlsAlloc
CreateThread
TlsGetValue
CreateProcessAsUserW
TlsSetValue
SetPriorityClass
TlsFree
SetThreadToken
OpenProcess
GetCurrentProcessId
OpenProcessToken
GetCurrentThread
OpenThreadToken
ExitProcess

api-ms-win-core-errorhandling-l1-1-1

SetLastError
GetLastError
RaiseException
SetErrorMode
SetUnhandledExceptionFilter
GetErrorMode
UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-service-core-l1-1-1

SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW

api-ms-win-core-sysinfo-l1-2-1

GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
GetSystemTime
GetTickCount

api-ms-win-core-heap-l1-2-0

HeapDestroy
GetProcessHeap
HeapSetInformation
HeapCreate

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegGetKeySecurity
RegDeleteTreeW
RegDeleteKeyExW
RegCloseKey
RegCreateKeyExW
RegEnumValueW
RegOpenKeyExW
RegGetValueW
RegSetKeySecurity
RegOpenCurrentUser
RegDeleteValueW
RegQueryValueExW
RegDisablePredefinedCacheEx
RegSetValueExW
RegEnumKeyExW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
DebugBreak
IsDebuggerPresent

rpcrt4

RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
Ndr64AsyncClientCall
NdrClientCall3
RpcBindingServerFromClient
RpcBindingFree
RpcStringBindingParseW
RpcObjectSetType
RpcServerInqBindingHandle
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcServerInterfaceGroupDeactivate
RpcServerInterfaceGroupActivate
RpcServerInterfaceGroupCreateW
RpcEpRegisterW
RpcServerTestCancel
RpcServerRegisterAuthInfoW
RpcSsContextLockExclusive
RpcServerInqBindings
RpcImpersonateClient
RpcServerInqDefaultPrincNameW
RpcServerRegisterIf
RpcRevertToSelf
I_RpcSessionStrictContextHandle
I_RpcBindingIsClientLocal
RpcRaiseException
NdrServerCallAll
RpcStringFreeW
RpcMgmtSetServerStackSize
RpcServerRegisterIf2
RpcAsyncCompleteCall
RpcRevertToSelfEx
RpcSmDestroyClientContext
I_RpcBindingInqTransportType
RpcAsyncAbortCall
NdrAsyncServerCall
NdrServerCall2
Ndr64AsyncServerCallAll

api-ms-win-security-base-l1-2-0

CopySid
DuplicateToken
AddAccessDeniedAceEx
GetLengthSid
AddAce
GetSecurityDescriptorDacl
RevertToSelf
IsWellKnownSid
CreateWellKnownSid
InitializeAcl
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
GetAclInformation
AddAccessAllowedAceEx
SetTokenInformation
ImpersonateLoggedOnUser
GetSidSubAuthority
GetSidSubAuthorityCount
EqualSid
DuplicateTokenEx
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

GetProcAddress
LocalFree
SetThreadpoolTimer
AddVectoredExceptionHandler
ResetEvent
HeapAlloc
FreeLibrary
LoadLibraryExW
HeapFree
GetModuleHandleExW
DeleteCriticalSection
GetComputerNameW
lstrcmpiW
QueueUserWorkItem
ResolveDelayLoadedAPI
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
GetTickCount64
LoadLibraryW
LocalAlloc

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte

api-ms-win-core-file-l1-2-1

DeleteFileW
CreateFileW
ReadFile
GetTempFileNameW

api-ms-win-core-file-l2-1-1

MoveFileExW

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler

dnsapi

DnsQuery_W
DnsFree

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

powrprof

PowerDeterminePlatformRole

Exports

Exports

GetSpoolerTlsIndexes
PrvAbortPrinter
PrvAddFormW
PrvAddJobW
PrvAddMonitorW
PrvAddPerMachineConnectionW
PrvAddPortExW
PrvAddPortW
PrvAddPrintProcessorW
PrvAddPrintProvidorW
PrvAddPrinterConnectionW
PrvAddPrinterDriverExW
PrvAddPrinterDriverW
PrvAddPrinterExW
PrvAddPrinterW
PrvAdjustPointers
PrvAdjustPointersInStructuresArray
PrvAlignKMPtr
PrvAlignRpcPtr
PrvAllocSplStr
PrvAllowRemoteCalls
PrvAppendPrinterNotifyInfoData
PrvBuildOtherNamesFromMachineName
PrvCacheAddName
PrvCacheCreateAndAddNode
PrvCacheCreateAndAddNodeWithIPAddresses
PrvCacheDeleteNode
PrvCacheIsNameCluster
PrvCacheIsNameInNodeList
PrvCallDrvDevModeConversion
PrvCallRouterFindFirstPrinterChangeNotification
PrvCheckLocalCall
PrvClosePrinter
PrvConfigurePortW
PrvCreatePrinterIC
PrvDeleteFormW
PrvDeleteMonitorW
PrvDeletePerMachineConnectionW
PrvDeletePortW
PrvDeletePrintProcessorW
PrvDeletePrintProvidorW
PrvDeletePrinter
PrvDeletePrinterConnectionW
PrvDeletePrinterDataExW
PrvDeletePrinterDataW
PrvDeletePrinterDriverExW
PrvDeletePrinterDriverW
PrvDeletePrinterIC
PrvDeletePrinterKeyW
PrvDllAllocSplMem
PrvDllAllocSplStr
PrvDllFreeSplMem
PrvDllFreeSplStr
PrvDllReallocSplMem
PrvDllReallocSplStr
PrvEndDocPrinter
PrvEndPagePrinter
PrvEnumFormsW
PrvEnumJobsW
PrvEnumMonitorsW
PrvEnumPerMachineConnectionsW
PrvEnumPortsW
PrvEnumPrintProcessorDatatypesW
PrvEnumPrintProcessorsW
PrvEnumPrinterDataExW
PrvEnumPrinterDataW
PrvEnumPrinterDriversW
PrvEnumPrinterKeyW
PrvEnumPrintersW
PrvFindClosePrinterChangeNotification
PrvFlushPrinter
PrvFormatPrinterForRegistryKey
PrvFormatRegistryKeyForPrinter
PrvFreeOtherNames
PrvGetFormW
PrvGetJobAttributes
PrvGetJobAttributesEx
PrvGetJobW
PrvGetNetworkId
PrvGetPrintProcessorDirectoryW
PrvGetPrinterDataExW
PrvGetPrinterDataW
PrvGetPrinterDriverDirectoryW
PrvGetPrinterDriverExW
PrvGetPrinterDriverW
PrvGetPrinterW
PrvGetServerPolicy
PrvGetShrinkedSize
PrvGetSpoolerTlsIndexes
PrvImpersonatePrinterClient
PrvInitializeRouter
PrvIsNameTheLocalMachineOrAClusterSpooler
PrvIsNamedPipeRpcCall
PrvMIDL_user_allocate
PrvMIDL_user_allocate1
PrvMIDL_user_free
PrvMIDL_user_free1
PrvMarshallDownStructure
PrvMarshallDownStructuresArray
PrvMarshallUpStructure
PrvMarshallUpStructuresArray
PrvOldGetPrinterDriverW
PrvOpenPrinter2W
PrvOpenPrinterExW
PrvOpenPrinterPort2W
PrvOpenPrinterW
PrvPackStrings
PrvPartialReplyPrinterChangeNotification
PrvPlayGdiScriptOnPrinterIC
PrvPrinterHandleRundown
PrvPrinterMessageBoxW
PrvProvidorFindClosePrinterChangeNotification
PrvProvidorFindFirstPrinterChangeNotification
PrvReadPrinter
PrvReallocSplMem
PrvReallocSplStr
PrvRemoteFindFirstPrinterChangeNotification
PrvReplyClosePrinter
PrvReplyOpenPrinter
PrvReplyPrinterChangeNotification
PrvReplyPrinterChangeNotificationEx
PrvReportJobProcessingProgress
PrvResetPrinterW
PrvRevertToPrinterSelf
PrvRouterAddPrinterConnection2
PrvRouterAllocBidiMem
PrvRouterAllocBidiResponseContainer
PrvRouterAllocPrinterNotifyInfo
PrvRouterBroadcastMessage
PrvRouterCorePrinterDriverInstalled
PrvRouterCreatePrintAsyncNotificationChannel
PrvRouterDeletePrinterDriverPackage
PrvRouterFindCompatibleDriver
PrvRouterFindFirstPrinterChangeNotification
PrvRouterFindNextPrinterChangeNotification
PrvRouterFreeBidiMem
PrvRouterFreeBidiResponseContainer
PrvRouterFreePrinterNotifyInfo
PrvRouterGetCorePrinterDrivers
PrvRouterGetPrintClassObject
PrvRouterGetPrinterDriverPackagePath
PrvRouterInstallPrinterDriverFromPackage
PrvRouterInternalGetPrinterDriver
PrvRouterRefreshPrinterChangeNotification
PrvRouterRegisterForPrintAsyncNotifications
PrvRouterReplyPrinter
PrvRouterSpoolerSetPolicy
PrvRouterUnregisterForPrintAsyncNotifications
PrvRouterUploadPrinterDriverPackage
PrvScheduleJob
PrvSeekPrinter
PrvSendRecvBidiData
PrvSetFormW
PrvSetJobW
PrvSetPortW
PrvSetPrinterDataExW
PrvSetPrinterDataW
PrvSetPrinterW
PrvSplCloseSpoolFileHandle
PrvSplCommitSpoolData
PrvSplDriverUnloadComplete
PrvSplGetClientUserHandle
PrvSplGetSpoolFileInfo
PrvSplGetUserSidStringFromToken
PrvSplInitializeWinSpoolDrv
PrvSplIsSessionZero
PrvSplIsUpgrade
PrvSplProcessPnPEvent
PrvSplProcessSessionEvent
PrvSplPromptUIInUsersSession
PrvSplQueryUserInfo
PrvSplReadPrinter
PrvSplRegisterForDeviceEvents
PrvSplRegisterForSessionEvents
PrvSplShutDownRouter
PrvSplUnregisterForDeviceEvents
PrvSplUnregisterForSessionEvents
PrvSpoolerFindClosePrinterChangeNotification
PrvSpoolerFindFirstPrinterChangeNotification
PrvSpoolerFindNextPrinterChangeNotification
PrvSpoolerFreePrinterNotifyInfo
PrvSpoolerHasInitialized
PrvSpoolerInit
PrvSpoolerRefreshPrinterChangeNotification
PrvStartDocPrinterW
PrvStartPagePrinter
PrvUndoAlignKMPtr
PrvUndoAlignRpcPtr
PrvUpdateBufferSize
PrvUpdatePrinterRegAll
PrvUpdatePrinterRegUser
PrvWaitForPrinterChange
PrvWaitForSpoolerInitialization
PrvWritePrinter
PrvXcvDataW
PrvbGetDevModePerUser
PrvbSetDevModePerUser
RouterLogJobInfoForBranchOffice
ServerGetPrintClassObject
SplUalCollectData
YAbortPrinter
YAddJob
YDriverUnloadComplete
YEndDocPrinter
YEndPagePrinter
YFlushPrinter
YGetPrinter
YGetPrinterDriver2
YGetPrinterDriverDirectory
YReadPrinter
YSeekPrinter
YSetJob
YSetPort
YSetPrinter
YSplReadPrinter
YStartDocPrinter
YStartPagePrinter
YWritePrinter

Sections

.text
Size: 661KB - Virtual size: 660KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

137de18e95c986ecbfc2e8fe6d2a26b0

Headers

DLL Characteristics

File Characteristics

Imports

user32

msvcrt

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-1

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-debug-l1-1-1

rpcrt4

api-ms-win-security-base-l1-2-0

api-ms-win-core-profile-l1-1-0

kernel32

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-console-l1-1-0

dnsapi

api-ms-win-power-base-l1-1-0

powrprof

Exports

Exports

Sections

.text Size: 661KB - Virtual size: 660KB

.data Size: 9KB - Virtual size: 9KB

.pdata Size: 27KB - Virtual size: 27KB

.idata Size: 11KB - Virtual size: 11KB

.rsrc Size: 57KB - Virtual size: 56KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 661KB - Virtual size: 660KB

.data
Size: 9KB - Virtual size: 9KB

.pdata
Size: 27KB - Virtual size: 27KB

.idata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 57KB - Virtual size: 56KB

.reloc
Size: 12KB - Virtual size: 11KB