62ff833f65b3d74b3620f2c4f297d48a59eed523b2b2179ad6ff278a2b1518b8

Sharing

Copy URL

Twitter E-mail

General

Target

62ff833f65b3d74b3620f2c4f297d48a59eed523b2b2179ad6ff278a2b1518b8
Size

22.0MB
MD5

b16a665434e2c67df696ea47a9ecab4c
SHA1

d6cfb34b3d1d5a1e937d6db7bd5de0b04994a26a
SHA256

62ff833f65b3d74b3620f2c4f297d48a59eed523b2b2179ad6ff278a2b1518b8
SHA512

ce33571d607c3469cc6f1d028840ffb1c83d04f02600873f2d29a698f71b9b1c755fe69245032623dba5303bd8696e550d6f3405e075a3f8339811ba69bece9e
SSDEEP

393216:CKG8/V3Pexo9LGSaLXQr5aWZ97SV1DZOVxbrWL2bRYYiWlbX0:h9/9NaLXQVaWZ9uvDZCGoRYYbX0

Score

1^/10

Malware Config

Signatures

Files

62ff833f65b3d74b3620f2c4f297d48a59eed523b2b2179ad6ff278a2b1518b8
.exe windows x86

6b356d2950e39e695a0e59f99af7cd7e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

IsProcessorFeaturePresent
CreateDirectoryW
GetCurrentProcessId
GetSystemDefaultLangID
GetUserDefaultLangID
GetCommandLineW
MoveFileW
GlobalFree
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CopyFileW
FreeLibrary
InterlockedExchange
LoadLibraryExW
FindNextFileW
FindFirstFileW
MoveFileExW
RemoveDirectoryW
SetFileAttributesW
CreateProcessW
FindClose
GetLocalTime
Sleep
DeleteFileW
GetCurrentProcess
DuplicateHandle
SetPriorityClass
GetPriorityClass
GetProcAddress
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LocalFree
GetTempPathW
GetFileAttributesW
WideCharToMultiByte
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
ProcessIdToSessionId
FormatMessageW
lstrlenW
LocalAlloc
ExpandEnvironmentStringsW
OpenProcess
GetExitCodeProcess
WaitForSingleObject
WTSGetActiveConsoleSessionId
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
CloseHandle
GetTickCount
MultiByteToWideChar
GetLastError
SetStdHandle
ReadConsoleW
GetFileType
GetOEMCP
WriteConsoleW
FormatMessageA
QueryDosDeviceW
SetFilePointer
ReadFile
GetFileSize
SetLastError
GetCurrentThreadId
SetErrorMode
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
RaiseException
LeaveCriticalSection
lstrcmpiW
GetACP
IsValidCodePage
GetStdHandle
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
LoadLibraryExA
GetFileAttributesExW
SetFileTime
VirtualFree
VirtualAlloc
GetVersionExW
GetSystemInfo
SetEvent
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
CreateEventW
WaitForMultipleObjects
EncodePointer
DecodePointer
GetStringTypeW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCurrentThread
VerSetConditionMask
VerifyVersionInfoW
GetProcessTimes
CreateFileW
FlushFileBuffers
SetEndOfFile
WriteFile
lstrcpyW
LoadLibraryW
GetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
TryEnterCriticalSection
IsDebuggerPresent
CreateThread
SetThreadPriority
GetThreadPriority
ExitThread
TerminateThread
SuspendThread
ResumeThread
OpenEventW
PulseEvent
WaitForMultipleObjectsEx
OutputDebugStringW
OpenSemaphoreW
ReadProcessMemory
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
lstrlenA
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
EnumUILanguagesW
TerminateProcess
GetThreadContext
SetUnhandledExceptionFilter
VirtualQuery
lstrcmpA
lstrcmpW
GetSystemTimeAsFileTime
VirtualProtect
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale

advapi32

QueryServiceStatusEx
OpenThreadToken
RegEnumValueW
RegQueryValueExW
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorDacl
LookupPrivilegeNameW
MapGenericMask
DuplicateToken
CheckTokenMembership
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
LsaNtStatusToWinError
StartServiceW
ConvertSidToStringSidW
ConvertSecurityDescriptorToStringSecurityDescriptorW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
GetSecurityDescriptorControl
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetAce
GetAclInformation
AddAce
InitializeAcl
IsValidSid
GetLengthSid
CopySid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
TraceMessage
SetNamedSecurityInfoW
SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoW
FreeSid
AllocateAndInitializeSid
CreateProcessAsUserW
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
GetTokenInformation
EqualSid

ole32

CoInitializeEx
CreateStreamOnHGlobal
OleLoadFromStream
OleSaveToStream
CLSIDFromString
GetHGlobalFromStream
CoUninitialize
PropVariantClear
IIDFromString
CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateGuid
StringFromIID

oleaut32

SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayCreate
SafeArrayRedim
SafeArrayLock
SafeArrayUnlock
SafeArrayGetElement
SafeArrayPutElement
VarUI4FromStr
SafeArrayAccessData
SysAllocStringByteLen
SysStringByteLen
VariantCopyInd
VariantInit
VariantClear
SysAllocStringLen
SafeArrayPtrOfIndex

shlwapi

SHDeleteEmptyKeyW
PathIsDirectoryW
PathFileExistsW
PathAddBackslashW
UrlCanonicalizeW
PathRemoveFileSpecW
PathQuoteSpacesW
PathIsUNCServerW
SHDeleteKeyW
PathIsUNCW
PathSkipRootW
PathFindFileNameW
PathAppendW

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW

crypt32

CertGetEnhancedKeyUsage
CryptQueryObject
CertFindCertificateInStore
CertCloseStore
CertNameToStrW
CryptMsgClose
CertFreeCertificateContext
CryptMsgGetParam
CertGetNameStringW

wintrust

CryptCATAdminReleaseContext
WintrustGetRegPolicyFlags
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext

Sections

.text
Size: 758KB - Virtual size: 758KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b356d2950e39e695a0e59f99af7cd7e

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

advapi32

ole32

oleaut32

shlwapi

comctl32

psapi

crypt32

wintrust

Sections

.text Size: 758KB - Virtual size: 758KB

.rdata Size: 291KB - Virtual size: 290KB

.data Size: 14KB - Virtual size: 39KB

.rsrc Size: 253KB - Virtual size: 253KB

.reloc Size: 125KB - Virtual size: 124KB

.text
Size: 758KB - Virtual size: 758KB

.rdata
Size: 291KB - Virtual size: 290KB

.data
Size: 14KB - Virtual size: 39KB

.rsrc
Size: 253KB - Virtual size: 253KB

.reloc
Size: 125KB - Virtual size: 124KB