2023-04-12_adce417e5f349929f5297648e2c5eadf_destroyer_kangaroo

Sharing

Copy URL

Twitter E-mail

General

Target

2023-04-12_adce417e5f349929f5297648e2c5eadf_destroyer_kangaroo
Size

17KB
MD5

adce417e5f349929f5297648e2c5eadf
SHA1

a562f328331dd76ff5aeee2856f2dd711d8b7cde
SHA256

dd93e2b91ece58bd229ca9cc3c5c4f7f0d6ba37440105d746c81f37462bd3d2f
SHA512

0c7a61967fb75add1bb4375c0ebf4af2148eeb56ee0b212a49d6d737ef2f111327663f640a4ba743791fdf54590775c018e9d773dcdc27a5051ae99b0263e64e
SSDEEP

384:1duTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99z3WMQhW3WMv5:1du9CaxEovcm/BCvXwO5

Score

1^/10

Malware Config

Signatures

Files

2023-04-12_adce417e5f349929f5297648e2c5eadf_destroyer_kangaroo
.exe windows x86

745d7f50636fb2b25f5ec7f180ef6ab7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

CryptEncrypt
CryptHashData
CloseEventLog
RegSetValueExW
RegCloseKey
ClearEventLogW
CryptAcquireContextW
OpenEventLogW
CryptDeriveKey
CryptReleaseContext
RegDisableReflectionKey
CryptCreateHash
RegOpenKeyExW
CryptDestroyKey
CryptDestroyHash

wtsapi32

WTSDisconnectSession
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
WTSLogoffSession

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

kernel32

GetFileTime
GetFileAttributesW
ExpandEnvironmentStringsW
CreateThread
GetVolumeInformationW
SetFileAttributesW
GetCurrentProcessId
DeleteFileW
CloseHandle
FindNextFileW
UpdateResourceW
lstrcatW
WTSGetActiveConsoleSessionId
GetSystemDefaultLangID
ExitProcess
GetFileSize
CreateMutexW
FindFirstFileW
SetFilePointer
FreeResource
lstrlenA
GetDriveTypeW
SetEndOfFile
FindResourceW
LoadResource
CreateProcessW
EndUpdateResourceW
GetLogicalDriveStringsW
GlobalLock
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualFree
SetFileTime
WriteFile
GlobalAlloc
Sleep
CopyFileW
SizeofResource
WaitForMultipleObjects
ReadFile
GetModuleFileNameW
CreateFileW
ExitThread
lstrcmpW
MultiByteToWideChar
lstrlenW
GlobalUnlock
GetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
MoveFileW
GetSystemDefaultLocaleName
GlobalFree
FindClose
ProcessIdToSessionId
LockResource
GetCurrentThreadId

user32

CloseClipboard
GetMessageW
PostQuitMessage
LoadCursorW
wsprintfW
DispatchMessageW
DefWindowProcW
SetWindowTextW
SetClipboardData
GetSystemMetrics
MessageBoxW
OpenClipboard
CreateWindowExW
ShowWindow
EmptyClipboard
GetWindowTextW
GetWindowLongW
LoadIconW
RegisterClassExW
TranslateMessage

gdi32

CreateSolidBrush

shell32

CommandLineToArgvW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

745d7f50636fb2b25f5ec7f180ef6ab7

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

version

advapi32

wtsapi32

mpr

kernel32

user32

gdi32

shell32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 5KB - Virtual size: 4KB