bf5cbf1461628122197f90484707576e32f65d5302bf2e16a6265823fc90d441

Sharing

Copy URL Twitter E-mail

General

Target

bf5cbf1461628122197f90484707576e32f65d5302bf2e16a6265823fc90d441
Size

490KB
MD5

aabe3a1f254cc7d708b3ffd367224d82
SHA1

812276b1fdda4c54cf635793f90541fd3c4f6787
SHA256

bf5cbf1461628122197f90484707576e32f65d5302bf2e16a6265823fc90d441
SHA512

1be674a4675267f8bd3f26e464733cf5c36fce0ea754f2d2f584f8fc1e29bcad6d48c6181329c056b46910b2eab6a146550128406c03740c8a22e8b139911b6b
SSDEEP

12288:HVVPikncqjV7bCJWqGbg8hisRqINGf1vr6mtsaQFOPK3fYCaEB3/F1X:H/nD7bCJWqGJNu1vGisbb3gCx3N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf5cbf1461628122197f90484707576e32f65d5302bf2e16a6265823fc90d441

Files

bf5cbf1461628122197f90484707576e32f65d5302bf2e16a6265823fc90d441
.exe windows:6 windows x86 arch:x86

c6b1f4ea70b448eac6e61b474ffe416d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Webhost\28-02-2023\WindowsBuilds\ACP_AGENT\6057307\appctrlbuild\SA_SRC\ACP\Release\Privilager.pdb

Imports

kernel32

GetModuleFileNameW
GlobalAlloc
GlobalFree
WTSGetActiveConsoleSessionId
K32EnumProcesses
K32GetModuleFileNameExW
GetProcessId
FreeEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
Process32Next
Process32First
MoveFileW
WideCharToMultiByte
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetLocalTime
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WaitNamedPipeW
SetNamedPipeHandleState
SetLastError
WriteFile
FlushFileBuffers
CreateFileW
GetEnvironmentStringsW
GetCurrentThreadId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MultiByteToWideChar
QueryFullProcessImageNameW
FormatMessageW
LocalFree
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetWindowsDirectoryW
OpenProcess
ProcessIdToSessionId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
ReadConsoleW
GetLastError
RaiseException
CloseHandle
DecodePointer
SetEnvironmentVariableW
GetFileSizeEx
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
FileTimeToLocalFileTime
QueryPerformanceCounter
FormatMessageA
WaitForSingleObjectEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
GetModuleHandleExW
IsProcessorFeaturePresent
EncodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetTimeZoneInformation
DeleteFileW
GetFileType
GetConsoleCP
GetConsoleMode
ExitProcess
GetStdHandle
WriteConsoleW

advapi32

AdjustTokenPrivileges
GetTokenInformation
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExW
ConvertStringSidToSidW
ConvertSidToStringSidA
LsaAddAccountRights
LsaEnumerateAccountsWithUserRight
LsaOpenPolicy
LsaClose
LookupPrivilegeNameW
LookupPrivilegeNameA
LookupAccountSidW
LookupAccountSidA
SetTokenInformation
FreeSid
EqualSid
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid
LsaNtStatusToWinError
RegDeleteTreeW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
OpenProcessToken
RevertToSelf
ImpersonateLoggedOnUser
GetLengthSid
CreateProcessAsUserW
RegGetValueW
RegGetValueA
RegSetValueExW
RegQueryValueExW

shlwapi

StrStrIA

userenv

CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 371KB - Virtual size: 371KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6b1f4ea70b448eac6e61b474ffe416d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shlwapi

userenv

wtsapi32

Sections

.text Size: 371KB - Virtual size: 371KB

.rdata Size: 91KB - Virtual size: 91KB

.data Size: 7KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 371KB - Virtual size: 371KB

.rdata
Size: 91KB - Virtual size: 91KB

.data
Size: 7KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 18KB - Virtual size: 18KB