0c5403cace2a1fa4134501439aec64381c6ba62120e7bbada8ce706bcc358076

Sharing

Copy URL Twitter E-mail

General

Target

0c5403cace2a1fa4134501439aec64381c6ba62120e7bbada8ce706bcc358076
Size

1.5MB
MD5

b9ff0b9cfe28765d55ab270dfa99333d
SHA1

ac18d48bda1b67ec620a325643cdef74cddb2eee
SHA256

0c5403cace2a1fa4134501439aec64381c6ba62120e7bbada8ce706bcc358076
SHA512

7aa2ba52bb2da7e65644ea4b92ed5488d8b00bb29539950525213cd537415bf67b59010a660812fea212e3c9a433a5546be4d3a910097d9ddd1d3ddded11f2cb
SSDEEP

24576:WCVmtMJA+elSNwq3ocAR+vrWndJ7ppnGcM7jM1W8MCwoqbarNQAfQQn652WOHv:Q6NwqYcgL7pgoLpT3QI

Score

1^/10

Malware Config

Signatures

Files

0c5403cace2a1fa4134501439aec64381c6ba62120e7bbada8ce706bcc358076
.exe windows x86

0ad73ebeafbf68cce24aed38662f5ea5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
RtlCaptureContext
NtCancelIoFileEx

kernel32

TerminateProcess
SetUnhandledExceptionFilter
SwitchToThread
CreateFileW
GetProcessHeap
GetModuleHandleA
GetProcAddress
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
CreateMutexA
ReleaseMutex
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetTempPathW
SetFilePointerEx
GetFileInformationByHandleEx
GetFullPathNameW
FindNextFileW
CreateDirectoryW
FindFirstFileW
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
WakeAllConditionVariable
UnhandledExceptionFilter
ReleaseSRWLockShared
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentDirectoryW
SleepConditionVariableSRW
SetHandleInformation
WakeConditionVariable
PostQueuedCompletionStatus
CreateThread
AcquireSRWLockShared
AcquireSRWLockExclusive
HeapReAlloc
GetSystemInfo
CopyFileExW
GetFileInformationByHandle
FindClose
SetLastError
SetFileInformationByHandle
GetModuleFileNameW
GetLastError
GetFinalPathNameByHandleW
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
FormatMessageW
GetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
GetQueuedCompletionStatusEx
GetEnvironmentVariableW
CloseHandle
HeapFree
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW

crypt32

CertOpenStore
CertCloseStore
CertDuplicateCertificateContext
CertDuplicateStore
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDuplicateCertificateChain

ws2_32

ioctlsocket
connect
getsockopt
WSASend
bind
setsockopt
getaddrinfo
freeaddrinfo
closesocket
WSAStartup
WSAIoctl
getsockname
WSAGetLastError
getpeername
WSACleanup
recv
send
shutdown
WSASocketW

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

secur32

FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
EncryptMessage
QueryContextAttributesW
AcquireCredentialsHandleA
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
ApplyControlToken

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

vcruntime140

_except_handler4_common
memcpy
__current_exception
__current_exception_context
memcmp
memset
memmove
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free

api-ms-win-crt-runtime-l1-1-0

exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_get_initial_narrow_environment
_set_app_type
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_seh_filter_exe
_configure_narrow_argv
_initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 500KB - Virtual size: 499KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ad73ebeafbf68cce24aed38662f5ea5

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

crypt32

ws2_32

bcrypt

secur32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 500KB - Virtual size: 499KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 500KB - Virtual size: 499KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 29KB - Virtual size: 29KB