4969b4f7e84b2f5a4c043e42290c8f7b5c8ba1dcd785af920b13310dddb37f32

Sharing

Copy URL

Twitter E-mail

General

Target

4969b4f7e84b2f5a4c043e42290c8f7b5c8ba1dcd785af920b13310dddb37f32
Size

3.9MB
MD5

0456e6d567e54140e8988a17cd12ed8b
SHA1

2df6fec9180b856d6b3ce6a912223c1e48bc146e
SHA256

4969b4f7e84b2f5a4c043e42290c8f7b5c8ba1dcd785af920b13310dddb37f32
SHA512

b5b9961209fcdc24310a60f2500d05c274bf6774064f809b13ce93824b4181f3543641900ed5ec2de0dca987e897609108185b4a714421f6a20d8e3359bee8cd
SSDEEP

49152:LadpFUx1nkQoqvUbvgXELEnAR0gXV/XB+7nZE1GhnuFnNeNMWoMCWgiV5omI05IR:gFUxeecao3yudFnNEDHIeWpAhQ1CNvi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4969b4f7e84b2f5a4c043e42290c8f7b5c8ba1dcd785af920b13310dddb37f32

Files

4969b4f7e84b2f5a4c043e42290c8f7b5c8ba1dcd785af920b13310dddb37f32
.exe windows:6 windows x64 arch:x64

7bcaa6f7c2a49f73d8165171f14f2bd5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

sppsvc.pdb

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
ConvertStringSidToSidW
RegSetKeySecurity
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW
RegSetValueExW
RegDeleteKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
ConvertSidToStringSidW
OpenProcessToken
EqualSid
GetTokenInformation
RegEnumKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptImportKey
CryptSignHashA
CryptVerifySignatureA
CryptExportKey
CryptGenKey
RegisterTraceGuidsA
LookupAccountNameW

kernel32

CreateEventW
RegisterWaitForSingleObject
CreateTimerQueue
CreateTimerQueueTimer
GetModuleHandleExW
UnregisterWaitEx
DeleteTimerQueue
DecodePointer
DeleteTimerQueueEx
EncodePointer
FileTimeToSystemTime
CreateMutexW
OpenMutexW
ReleaseMutex
GetTickCount
CreateSemaphoreW
GetDateFormatW
GetTimeFormatW
ExpandEnvironmentStringsW
MultiByteToWideChar
CreateFileW
GetFileSize
ReadFile
QueueUserWorkItem
GetCurrentProcessId
OpenProcess
WriteFile
GetFileAttributesW
SetFileAttributesW
ChangeTimerQueueTimer
CreateDirectoryW
GetFileSizeEx
GetSystemInfo
SystemTimeToFileTime
CompareFileTime
GetSystemTimeAsFileTime
lstrlenW
RaiseException
GetModuleHandleA
WaitForMultipleObjects
GetDevicePowerState
CreateSemaphoreA
GetPrivateProfileStringW
GetFullPathNameW
InitializeCriticalSection
GetVersion
VirtualAlloc
SetLastError
VirtualFree
GetLocalTime
DeleteFileW
FlushFileBuffers
CopyFileW
MoveFileExW
SetFilePointer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetVersionExA
WideCharToMultiByte
GetComputerNameW
DeviceIoControl
LCMapStringW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetSystemDirectoryW
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetProcAddress
LoadLibraryW
VirtualQuery
FreeLibrary
Sleep
GetVersionExW
WaitForSingleObject
SetEvent
ReleaseSemaphore
HeapSetInformation
LeaveCriticalSection
EnterCriticalSection
DeleteTimerQueueTimer
GetCurrentThreadId
LocalFree
DeleteCriticalSection
SetThreadPriority
GetThreadPriority
GetCurrentProcess
DuplicateHandle
GetCurrentThread
GetLastError
OpenThread
CloseHandle
LocalAlloc
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect

msvcrt

memmove
swscanf
_wcsicmp
wcschr
sscanf
_wtof
_wtoi
memcmp
_vsnwprintf
_itow
rand
srand
time
_vscwprintf
_beginthreadex
_ui64tow
malloc
free
?terminate@@YAXXZ
memset
memcpy
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
wcsncmp
_wcsnicmp
_purecall

rpcrt4

NdrServerCall2
RpcServerRegisterIfEx
RpcServerListen
RpcServerInqCallAttributesW
I_RpcBindingInqLocalClientPID
I_RpcMapWin32Status
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcRaiseException
RpcImpersonateClient
RpcRevertToSelfEx
UuidCreate
UuidFromStringW
RpcStringFreeW
UuidToStringW
RpcServerUseProtseqEpW

ntdll

NtQueryInformationThread
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlCopyUnicodeString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlDeleteFunctionTable
RtlInstallFunctionTableCallback
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtSetInformationThread

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity

Exports

Exports

?SPRevision@@3PADA
?SPVersion@@3PADA

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7bcaa6f7c2a49f73d8165171f14f2bd5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

rpcrt4

ntdll

ole32

Exports

Exports

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.data Size: 222KB - Virtual size: 222KB

.pdata Size: 57KB - Virtual size: 57KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 3.1MB - Virtual size: 3.1MB

.data
Size: 222KB - Virtual size: 222KB

.pdata
Size: 57KB - Virtual size: 57KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 576KB - Virtual size: 580KB