d8f4c60df16481e41455f3261fb7f8785c8a0e928ffeeae46ad4ce4b2210bc95

Sharing

Copy URL Twitter E-mail

General

Target

d8f4c60df16481e41455f3261fb7f8785c8a0e928ffeeae46ad4ce4b2210bc95
Size

99KB
MD5

a3d47172ff59c3ff2900d3c02858d630
SHA1

7c53d5e4b0759e3164cfeb3abac28ac265c68c63
SHA256

d8f4c60df16481e41455f3261fb7f8785c8a0e928ffeeae46ad4ce4b2210bc95
SHA512

635b0c7f3b99194dd29d2e52558f76551469618491e23a2aa3f8684818cd655b15cb26b801c1cab18612d034f446764c322c937ab9df268769b5ae12d1a84b1d
SSDEEP

1536:r4m5x7z2OTzGxN1w0c8NyRHZ9btUvw58T9gbmO/48ZWq45GxL:rL77lee0cBxUo58T9pO3wq45GxL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8f4c60df16481e41455f3261fb7f8785c8a0e928ffeeae46ad4ce4b2210bc95

Files

d8f4c60df16481e41455f3261fb7f8785c8a0e928ffeeae46ad4ce4b2210bc95
.exe windows x86

c7babada68469e424553fc415145d7ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_ultow
wcscspn
memmove
__p__commode
wcsrchr
_itow
_wcsnicmp
wcscat
wcsncpy
_wcsicmp
wcslen
wcsncmp
_wtol
wcscpy
__p__fmode
__set_app_type
_except_handler3
time
_controlfp
wcschr

advapi32

LogonUserExW
RegOpenKeyW
ConvertSidToStringSidW
LsaStorePrivateData
LsaLookupNames
LsaQueryInformationPolicy
OpenThreadToken
RegNotifyChangeKeyValue
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
GetLengthSid
CopySid
InitializeAcl
SystemFunction005
SystemFunction029
AllocateAndInitializeSid
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
AddAce
SetSecurityDescriptorDacl
LsaOpenPolicy
LsaLookupSids
LsaFreeMemory
LsaClose
ImpersonateLoggedOnUser
CreateProcessAsUserW
RevertToSelf
InitiateSystemShutdownW
GetTokenInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

kernel32

GetCurrentProcessId
LoadLibraryW
GetDriveTypeW
OpenEventW
GetCurrentThread
CreateMutexW
ReleaseMutex
ExitThread
FormatMessageW
FreeLibrary
GetExitCodeThread
DelayLoadFailureHook
SetProcessShutdownParameters
SetConsoleCtrlHandler
SetErrorMode
SetUnhandledExceptionFilter
InterlockedCompareExchange
GetTickCount
LoadLibraryA
GetModuleHandleA
GetProcAddress
LocalAlloc
LocalFree
Sleep
LeaveCriticalSection
EnterCriticalSection
SetLastError
CloseHandle
CreateThread
GetLastError
CreateProcessW
ExpandEnvironmentStringsW
InitializeCriticalSection
HeapAlloc
HeapFree
TerminateProcess
WaitForSingleObject
HeapCreate
CreateNamedPipeW
ReadFile
CancelIo
GetOverlappedResult
WaitForMultipleObjects
ConnectNamedPipe
TransactNamedPipe
WriteFile
ResumeThread
GetSystemTimeAsFileTime
GetModuleHandleW
GetComputerNameW
CreateEventW
SetEvent
ResetEvent
DeviceIoControl
CreateFileW

user32

LoadStringW
wsprintfW
BroadcastSystemMessageW
MessageBoxW
RegisterServicesProcess

rpcrt4

RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcStringBindingComposeW
NdrClientCall2
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
NdrAsyncServerCall
RpcBindingFree
NdrAsyncClientCall
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcServerUnregisterIf
RpcServerListen
NdrServerCall2
RpcRevertToSelf
RpcImpersonateClient
I_RpcMapWin32Status
RpcServerUseProtseqEpW
RpcServerRegisterIf

ntdll

RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
NtCreateKey
NtQueryValueKey
NtSetValueKey
NtDeleteValueKey
NtEnumerateKey
NtQuerySecurityObject
RtlFreeHeap
NtOpenKey
NtDeleteKey
RtlSetControlSecurityDescriptor
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
NtAccessCheckAndAuditAlarm
NtSetInformationThread
NtAdjustPrivilegesToken
NtDuplicateToken
NtOpenProcessToken
NtQueryInformationToken
NtOpenThreadToken
RtlQuerySecurityObject
RtlSetSecurityObject
RtlValidRelativeSecurityDescriptor
NtPrivilegeObjectAuditAlarm
NtPrivilegeCheck
RtlMapGenericMask
RtlCopyUnicodeString
NtSetInformationFile
NtQueryInformationFile
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
NtWaitForSingleObject
NtQueryDirectoryFile
NtDeleteFile
NtSetInformationProcess
RtlUnhandledExceptionFilter
NtSetEvent
RtlGetAce
RtlQueryInformationAcl
RtlGetDaclSecurityDescriptor
RtlAllocateHeap
RtlSetDaclSecurityDescriptor
RtlConvertSharedToExclusive
RtlConvertExclusiveToShared
RtlRegisterWait
RtlGetNtProductType
RtlEqualUnicodeString
RtlLengthSid
RtlCopySid
NtOpenDirectoryObject
RtlUnicodeStringToAnsiString
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlNewSecurityObject
RtlAddAce
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlSubAuthorityCountSid
NtQueryDirectoryObject
RtlCompareUnicodeString
NtLoadDriver
NtUnloadDriver
RtlExpandEnvironmentStrings_U
RtlAdjustPrivilege
NtFlushKey
NtOpenFile
RtlDosPathNameToNtPathName_U
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlFreeUnicodeString
RtlAreAllAccessesGranted
NtDeleteObjectAuditAlarm
NtCloseObjectAuditAlarm
RtlQueueWorkItem
RtlCopyLuid
RtlDeregisterWait
RtlReleaseResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlInitializeResource
RtlDeleteSecurityObject
RtlLockBootStatusData
RtlGetSetBootStatusData
RtlUnlockBootStatusData
NtInitializeRegistry
NtQueryKey
NtClose
RtlInitUnicodeString
RtlNtStatusToDosError
NtShutdownSystem
NtSetSystemEnvironmentValue
RtlMakeSelfRelativeSD
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
NtSetSecurityObject

userenv

UnloadUserProfile
CreateEnvironmentBlock
LoadUserProfileW
DestroyEnvironmentBlock

scesrv

ScesrvInitializeServer
ScesrvTerminateServer

umpnpmgr

RegisterScmCallback
PNP_SetActiveService
PNP_GetDeviceRegProp
PNP_GetDeviceListSize
PNP_GetDeviceList
PNP_HwProfFlags
RegisterServiceNotification
DeleteServicePlugPlayRegKeys

ncobjapi

WmiEventSourceConnect
WmiSetAndCommitObject
WmiCreateObjectWithFormat

Sections

.text
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7babada68469e424553fc415145d7ce

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

user32

rpcrt4

ntdll

userenv

scesrv

umpnpmgr

ncobjapi

Sections

.text Size: 93KB - Virtual size: 93KB

.data Size: 2KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 4KB

.text
Size: 93KB - Virtual size: 93KB

.data
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 4KB