1ce5e870656a9cd7b9fcd6d7f63a7771

Sharing

Copy URL

Twitter E-mail

General

Target

1ce5e870656a9cd7b9fcd6d7f63a7771
Size

60KB
MD5

1ce5e870656a9cd7b9fcd6d7f63a7771
SHA1

eac1b59298b16d1f298c445b4599d1f3810e858e
SHA256

7560e4554d08d0123b38ea06136c212354eb37245bb31fe6d92a2ea12c687169
SHA512

f2074797c9a5e8769bd0690dad4b6e5046d5bf98b209b0a50f7c4a014b7b61ad11dd2332053160895a06dcb20a9b3b5c9d871019b5d605dae916cc36589f7c19
SSDEEP

1536:htuRhGHxIAc6ioPuynlqupGyUi5w6BMgKbj59K6tFFJL:hoGRIAc6VhJjUQzMTbj59J3FJL

Score

1^/10

Malware Config

Signatures

Files

1ce5e870656a9cd7b9fcd6d7f63a7771
.exe windows:5 windows x64 arch:x64

a3a0e3c6f43313419364c7527338205f

Code Sign

9d:37:74:e7:00:45:85:f5:b9:bd:8f:f2:b3:9c:52:ea:c0:1c:6d:d9
Signer

Actual PE Digest

9d:37:74:e7:00:45:85:f5:b9:bd:8f:f2:b3:9c:52:ea:c0:1c:6d:d9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
VirtualFreeEx
VirtualAllocEx
OpenProcess
GetModuleFileNameA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentProcess
GetLastError
WriteProcessMemory
CloseHandle
GetCommandLineA
HeapAlloc
RaiseException
RtlPcToFileHeader
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
RtlUnwindEx
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
FlushFileBuffers

advapi32

RegisterServiceCtrlHandlerA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetServiceStatus
StartServiceCtrlDispatcherA

Exports

Exports

?SetAccessPriv@@YAKXZ

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3a0e3c6f43313419364c7527338205f

Code Sign

9d:37:74:e7:00:45:85:f5:b9:bd:8f:f2:b3:9c:52:ea:c0:1c:6d:d9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 5KB - Virtual size: 13KB

.pdata Size: 2KB - Virtual size: 2KB

9d:37:74:e7:00:45:85:f5:b9:bd:8f:f2:b3:9c:52:ea:c0:1c:6d:d9
Signer

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 5KB - Virtual size: 13KB

.pdata
Size: 2KB - Virtual size: 2KB