2023-04-11_0b9d538ff0aa5da9d3b62b593ff3b077_destroyer_kangaroo

Sharing

Copy URL Twitter E-mail

General

Target

2023-04-11_0b9d538ff0aa5da9d3b62b593ff3b077_destroyer_kangaroo
Size

19KB
MD5

0b9d538ff0aa5da9d3b62b593ff3b077
SHA1

c77416dd95c2d4d2dec0a4913cd2fa259ba913f8
SHA256

4ccca185e45c38a8ef4344e8de14adbe031765d18866259f0d5fa9c3ba5a012d
SHA512

efa49965ce902f39e975f824036a3ab0d128e5fa512b947b7e158ef556ddee87aea60e101868da33b62c38304c03ec1fc0f86d173e5b6795665a6898600374bc
SSDEEP

384:19uTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zssWOhWSWKGWZQhWY:19u9CaxEovcm/BCvXsInip

Score

1^/10

Malware Config

Signatures

Files

2023-04-11_0b9d538ff0aa5da9d3b62b593ff3b077_destroyer_kangaroo
.exe windows x86

745d7f50636fb2b25f5ec7f180ef6ab7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

CryptEncrypt
CryptHashData
CloseEventLog
RegSetValueExW
RegCloseKey
ClearEventLogW
CryptAcquireContextW
OpenEventLogW
CryptDeriveKey
CryptReleaseContext
RegDisableReflectionKey
CryptCreateHash
RegOpenKeyExW
CryptDestroyKey
CryptDestroyHash

wtsapi32

WTSDisconnectSession
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
WTSLogoffSession

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

kernel32

GetFileTime
GetFileAttributesW
ExpandEnvironmentStringsW
CreateThread
GetVolumeInformationW
SetFileAttributesW
GetCurrentProcessId
DeleteFileW
CloseHandle
FindNextFileW
UpdateResourceW
lstrcatW
WTSGetActiveConsoleSessionId
GetSystemDefaultLangID
ExitProcess
GetFileSize
CreateMutexW
FindFirstFileW
SetFilePointer
FreeResource
lstrlenA
GetDriveTypeW
SetEndOfFile
FindResourceW
LoadResource
CreateProcessW
EndUpdateResourceW
GetLogicalDriveStringsW
GlobalLock
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualFree
SetFileTime
WriteFile
GlobalAlloc
Sleep
CopyFileW
SizeofResource
WaitForMultipleObjects
ReadFile
GetModuleFileNameW
CreateFileW
ExitThread
lstrcmpW
MultiByteToWideChar
lstrlenW
GlobalUnlock
GetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
MoveFileW
GetSystemDefaultLocaleName
GlobalFree
FindClose
ProcessIdToSessionId
LockResource
GetCurrentThreadId

user32

CloseClipboard
GetMessageW
PostQuitMessage
LoadCursorW
wsprintfW
DispatchMessageW
DefWindowProcW
SetWindowTextW
SetClipboardData
GetSystemMetrics
MessageBoxW
OpenClipboard
CreateWindowExW
ShowWindow
EmptyClipboard
GetWindowTextW
GetWindowLongW
LoadIconW
RegisterClassExW
TranslateMessage

gdi32

CreateSolidBrush

shell32

CommandLineToArgvW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

745d7f50636fb2b25f5ec7f180ef6ab7

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

version

advapi32

wtsapi32

mpr

kernel32

user32

gdi32

shell32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 7KB - Virtual size: 6KB