da1cbe7babc99e3fc8dc3b1287bb5e73d4db8ce020dd99dab22b067d109d3fd0

Sharing

Copy URL Twitter E-mail

General

Target

da1cbe7babc99e3fc8dc3b1287bb5e73d4db8ce020dd99dab22b067d109d3fd0
Size

3.8MB
MD5

5bc8474304e8141a5e8e503c8e59a859
SHA1

f12110c9dc90a43dbeb64b59a2337506b85108a7
SHA256

da1cbe7babc99e3fc8dc3b1287bb5e73d4db8ce020dd99dab22b067d109d3fd0
SHA512

f13fd50060cf7e308c0b69cba56e05add0069198ff6054325c3f2c6220f937a916af2219483240ce05591225673eafb76f0c43d82cdacec590062b6c2bf8eedc
SSDEEP

49152:Czry5T+SAUrOIUBG117oaECgFZ7wGVrGzO5UxB1kSerrF7rLq2MRFMJE:CzXSG7afgFZsxzeEhMJE

Score

1^/10

Malware Config

Signatures

Files

da1cbe7babc99e3fc8dc3b1287bb5e73d4db8ce020dd99dab22b067d109d3fd0
.exe windows x64

b8f6d0b0e04ca86e6419db0eea257de8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysFreeString
SafeArrayUnaccessData
SysAllocStringLen
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
SafeArrayAccessData
SafeArrayDestroy

kernel32

SetThreadStackGuarantee
AddVectoredExceptionHandler
GlobalFree
SetHandleInformation
GlobalAlloc
Sleep
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
HeapReAlloc
GlobalUnlock
CreateFileW
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
GlobalLock
GlobalSize
GetTimeZoneInformation
SystemTimeToFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
SystemTimeToTzSpecificLocalTime
CreateEventW
CancelIo
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
RtlCaptureContext
CopyFileExW
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
PostQueuedCompletionStatus
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetProcessHeap
GetFileInformationByHandle
ReleaseSRWLockExclusive
SwitchToThread
SetLastError
GetFinalPathNameByHandleW
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
UnhandledExceptionFilter
RtlVirtualUnwind
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
ReleaseSRWLockShared
AcquireSRWLockShared
CreateIoCompletionPort
GetCurrentDirectoryW
SetUnhandledExceptionFilter
GetExitCodeProcess
SetFileCompletionNotificationModes
WaitForSingleObject
TerminateProcess
IsProcessorFeaturePresent
GetOverlappedResult
GetModuleFileNameW
GetSystemInfo
GetLastError
WaitForMultipleObjects
FindClose
CloseHandle
AcquireSRWLockExclusive
HeapFree
InitializeSListHead
IsDebuggerPresent
GetTempPathW
ReadFile

crypt32

CertOpenStore
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertFreeCertificateContext
CryptUnprotectData
CertDuplicateStore

ole32

CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx

advapi32

RegQueryValueExW
RegOpenKeyExW
SystemFunction036
FreeSid
RegCloseKey
CheckTokenMembership
AllocateAndInitializeSid

user32

EnumDisplaySettingsExW
OpenClipboard
GetClipboardData
GetMonitorInfoW
CloseClipboard
SetClipboardData
EnumDisplayMonitors

gdi32

CreateDCW
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
DeleteObject

bcrypt

BCryptGenRandom

ws2_32

WSAStartup
getaddrinfo
WSAIoctl
recv
setsockopt
shutdown
getsockname
WSAGetLastError
getpeername
closesocket
bind
WSASend
getsockopt
connect
WSACleanup
freeaddrinfo
send
WSASocketW
ioctlsocket

ntdll

RtlNtStatusToDosError
NtCreateFile
NtDeviceIoControlFile
NtCancelIoFileEx

secur32

DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
EncryptMessage
AcceptSecurityContext
AcquireCredentialsHandleA
InitializeSecurityContextW
QueryContextAttributesW
DecryptMessage
ApplyControlToken

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
strrchr
memmove
__CxxFrameHandler3
memset
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

strncmp
strcspn
strcmp
strlen

api-ms-win-crt-utility-l1-1-0

qsort
_rotl64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_msize
realloc

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log
__setusermatherr
_dclass

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_beginthreadex
_endthreadex
_c_exit
_seh_filter_exe
_set_app_type
_register_onexit_function
_crt_atexit
_initialize_onexit_table
_configure_narrow_argv
__p___argc
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
__p___argv
terminate
_exit
exit
_cexit
_initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8f6d0b0e04ca86e6419db0eea257de8

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

kernel32

crypt32

ole32

advapi32

user32

gdi32

bcrypt

ws2_32

ntdll

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 24KB - Virtual size: 27KB

.pdata Size: 63KB - Virtual size: 62KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 24KB - Virtual size: 27KB

.pdata
Size: 63KB - Virtual size: 62KB

.reloc
Size: 26KB - Virtual size: 25KB