8c4410896ba53c3780eeea83a3fd8c9340801e6fe8f27fc251abe5ab5617e951

Sharing

Copy URL Twitter E-mail

General

Target

8c4410896ba53c3780eeea83a3fd8c9340801e6fe8f27fc251abe5ab5617e951
Size

3.0MB
MD5

9a9de7a9bed6ac7e1a11c316571d5e3e
SHA1

9636e1cb876e8e37b6d748b0464ee81fa4b24640
SHA256

8c4410896ba53c3780eeea83a3fd8c9340801e6fe8f27fc251abe5ab5617e951
SHA512

b279ea8a70997ec23a10f448f2865abd767c4d8e22cdd1718b43284ee65469b719ee93abfed756f34688327f487f99edc217825d1d23f63c432aa4c11e0d25f1
SSDEEP

49152:zYMKqFH87EhgE40IZq74rKhELzKPCKb1Q50nNv+E:5K9AhgN0bnmZKb19

Score

1^/10

Malware Config

Signatures

Files

8c4410896ba53c3780eeea83a3fd8c9340801e6fe8f27fc251abe5ab5617e951
.exe windows x86

ccf095f2f212ae776815e2e56c3d8e35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegCreateKeyW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
RevertToSelf
OpenProcessToken
EqualSid
GetLengthSid
InitializeAcl
GetAclInformation
AddAce
GetAce
AddAccessAllowedAce
InitializeSecurityDescriptor
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetFileSecurityW
GetFileSecurityW
LookupAccountNameW
RegCreateKeyExW
RegDeleteKeyW
RegQueryValueExW
RegEnumKeyW
RegOpenKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueW
DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
GetSidSubAuthorityCount
GetSidSubAuthority
SetTokenInformation
GetTokenInformation
ImpersonateLoggedOnUser

ole32

CoUninitialize
CoInitialize
CoInitializeEx
CoCreateInstance

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW
SHFileOperationW

shlwapi

PathFileExistsW

user32

wsprintfA
MessageBoxW
GetProcessWindowStation
LoadStringW
wsprintfW
GetUserObjectInformationW

kernel32

GetSystemWow64DirectoryW
GetCurrentProcessId
LocalAlloc
LocalFree
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetLastError
GetModuleHandleW
FindClose
FindFirstFileW
FindNextFileW
lstrlenW
DeleteFileW
GetLogicalDriveStringsW
OutputDebugStringW
CopyFileW
MoveFileExW
GetLocalTime
GetModuleFileNameW
GetFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateFileW
GetFileSize
WriteFile
ReadFile
lstrcpyW
GetTempPathW
SetFileAttributesW
GetFileAttributesW
DecodePointer
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
WideCharToMultiByte
GetLongPathNameW
GetEnvironmentVariableW
CreateDirectoryW
RemoveDirectoryW
GetCurrentThreadId
GetSystemInfo
GetTickCount
GetSystemDirectoryW
GetVersionExW
OpenProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalAlloc
GetProcAddress
VirtualAlloc
VirtualFree
ReadProcessMemory
QueryDosDeviceW
GetPrivateProfileIntW
GetWindowsDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
ReleaseMutex
CreateMutexW
GetVolumeInformationW
DeviceIoControl
OutputDebugStringA
SetPriorityClass
GetFullPathNameW
GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
FormatMessageW
LoadLibraryW
EnterCriticalSection
InitializeCriticalSection
GetExitCodeThread
TerminateThread
CreateThread
OpenFileMappingW
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CloseHandle
WritePrivateProfileStringW
GetPrivateProfileStringW
GetDriveTypeW
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
FreeLibrary
CreateEventW
Sleep
WaitForSingleObject
SetEvent
DeleteCriticalSection
GlobalFree
LeaveCriticalSection
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
FormatMessageA
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
SetLastError
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind

oleaut32

SysAllocString
SysFreeString
SysStringLen

crypt32

CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CryptQueryObject

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcessModules
EnumProcesses

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wininet

InternetQueryOptionW
InternetCloseHandle
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetReadFile
InternetOpenUrlW

wldap32

ord143
ord46
ord211
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord60

ws2_32

ntohs
htons
getsockopt
setsockopt
getpeername
connect
closesocket
bind
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
send
recv
WSACleanup
WSAStartup
socket
WSAIoctl
getaddrinfo
gethostname
ioctlsocket
freeaddrinfo
recvfrom
sendto
accept
listen
getsockname

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 560KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 523KB - Virtual size: 523KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ccf095f2f212ae776815e2e56c3d8e35

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ole32

shell32

shlwapi

user32

kernel32

oleaut32

crypt32

psapi

userenv

wininet

wldap32

ws2_32

version

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 560KB - Virtual size: 560KB

.data Size: 21KB - Virtual size: 45KB

.gfids Size: 512B - Virtual size: 448B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 523KB - Virtual size: 523KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 560KB - Virtual size: 560KB

.data
Size: 21KB - Virtual size: 45KB

.gfids
Size: 512B - Virtual size: 448B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 523KB - Virtual size: 523KB