SecuriteInfo[.]com[.]Trojan[.]GenericKD[.]66410738[.]28815[.]28750[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.GenericKD.66410738.28815.28750.exe
Size

3.8MB
MD5

59f7602b250387b31bfc481f3efb9517
SHA1

0595cef0fca0e8c941a4d7b09a4ac8a50c7e0080
SHA256

49771182f73d733abe396700d5f30b1f0b29f94044b0c8158a5c3a4564305523
SHA512

70eb26be17e653b60e287334c26118e4ef7c5a5f2c92fd3b5a6b1178ca4c1a9bc8ecd4662958fb335de2e4f12f618efebe8aabe9448989d00747b723879dadee
SSDEEP

49152:deFHZuHw5+sQ/A+g+aOxadb6wq0RxyU24hkpBFwzpJKl4OLHMqEPeYc70Kjvw0:deMa+RsL5VxObM/Kjvw0

Score

1^/10

Malware Config

Signatures

Files

SecuriteInfo.com.Trojan.GenericKD.66410738.28815.28750.exe
.exe windows x64

e150b9efb9d2a6e9763fe1ee5bd9c0e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysFreeString
SafeArrayUnaccessData
SysAllocStringLen
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
SafeArrayAccessData
SafeArrayDestroy

kernel32

SetThreadStackGuarantee
AddVectoredExceptionHandler
GlobalFree
SetHandleInformation
GlobalAlloc
Sleep
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
WriteConsoleW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GlobalUnlock
FormatMessageW
GlobalLock
GetModuleFileNameW
CreateFileW
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
GlobalSize
GetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
FileTimeToSystemTime
CancelIo
ReadFile
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
RtlCaptureContext
CopyFileExW
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
PostQueuedCompletionStatus
GetSystemTimeAsFileTime
GetProcessHeap
GetFileInformationByHandle
ReleaseSRWLockExclusive
SwitchToThread
SetLastError
GetFinalPathNameByHandleW
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
UnhandledExceptionFilter
ReleaseSRWLockShared
RtlVirtualUnwind
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
WideCharToMultiByte
FreeLibrary
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
AcquireSRWLockShared
CreateIoCompletionPort
GetCurrentDirectoryW
SetUnhandledExceptionFilter
GetExitCodeProcess
WaitForSingleObject
SetFileCompletionNotificationModes
TerminateProcess
IsProcessorFeaturePresent
GetOverlappedResult
WaitForMultipleObjects
HeapReAlloc
GetSystemInfo
GetLastError
GetTempPathW
FindClose
CloseHandle
AcquireSRWLockExclusive
HeapFree
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
CreateEventW

crypt32

CryptUnprotectData
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertCloseStore
CertGetCertificateChain
CertOpenStore
CertDuplicateCertificateContext
CertDuplicateStore

advapi32

CheckTokenMembership
FreeSid
GetUserNameW
RegCloseKey
RegCreateKeyExA
RegOpenKeyExW
RegSetValueExA
RegQueryValueExW
AllocateAndInitializeSid
SystemFunction036

ole32

CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx

user32

EnumDisplaySettingsExW
OpenClipboard
GetClipboardData
GetMonitorInfoW
CloseClipboard
SetClipboardData
EnumDisplayMonitors

gdi32

CreateDCW
GetDeviceCaps
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
DeleteObject

bcrypt

BCryptGenRandom

ws2_32

WSAStartup
getaddrinfo
WSAIoctl
recv
setsockopt
shutdown
getsockname
WSAGetLastError
getpeername
closesocket
bind
WSASend
getsockopt
connect
WSACleanup
freeaddrinfo
send
WSASocketW
ioctlsocket

ntdll

RtlNtStatusToDosError
NtCreateFile
NtDeviceIoControlFile
NtCancelIoFileEx

secur32

DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
EncryptMessage
AcceptSecurityContext
AcquireCredentialsHandleA
InitializeSecurityContextW
QueryContextAttributesW
DecryptMessage
ApplyControlToken

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
strrchr
__CxxFrameHandler3
memmove
memset
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

strncmp
strcspn
strlen
strcmp

api-ms-win-crt-utility-l1-1-0

qsort
_rotl64

api-ms-win-crt-heap-l1-1-0

malloc
free
realloc
_set_new_mode
_msize

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log
__setusermatherr
_dclass

api-ms-win-crt-runtime-l1-1-0

_endthreadex
_seh_filter_exe
_set_app_type
_beginthreadex
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_initialize_narrow_environment
_get_initial_narrow_environment
_crt_atexit
_initterm
_initterm_e
__p___argc
terminate
_exit
exit
__p___argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e150b9efb9d2a6e9763fe1ee5bd9c0e4

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

kernel32

crypt32

advapi32

ole32

user32

gdi32

bcrypt

ws2_32

ntdll

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 24KB - Virtual size: 27KB

.pdata Size: 63KB - Virtual size: 62KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 24KB - Virtual size: 27KB

.pdata
Size: 63KB - Virtual size: 62KB

.reloc
Size: 26KB - Virtual size: 25KB