8b2f28171ac92b771af695975089b6c595e8020abf5f9e9b7b8d744e76715fc5

Sharing

Copy URL Twitter E-mail

General

Target

8b2f28171ac92b771af695975089b6c595e8020abf5f9e9b7b8d744e76715fc5
Size

1.0MB
MD5

63a6718cc9fe7bcbcb57571cff2182d8
SHA1

cbdf039f376f549a31a9884b53de999de307c0d0
SHA256

8b2f28171ac92b771af695975089b6c595e8020abf5f9e9b7b8d744e76715fc5
SHA512

86681882deaf03162152e63f06aee409371d18187b9c132902fb89232570b806fb65d4e744808f5af40c627d4b4dda2e30092f81541b14181dac3e907de4d0d2
SSDEEP

12288:GRQUC5A1a7+aGANskcgiesCvaDK/CuEjKtjkxlg5QXS9MX:gQUwYaaauK9vaDKKvjmkxlg5Qi9MX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b2f28171ac92b771af695975089b6c595e8020abf5f9e9b7b8d744e76715fc5

Files

8b2f28171ac92b771af695975089b6c595e8020abf5f9e9b7b8d744e76715fc5
.exe windows:6 windows x86 arch:x86

24bbe0bfaf1028355da5ace282104fb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

vssvc.pdb

Imports

advapi32

GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
LookupAccountSidW
ConvertSidToStringSidW
GetLengthSid
FreeSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
LookupAccountNameW
GetSidSubAuthorityCount
EqualDomainSid
IsValidSid
CreateWellKnownSid
AccessCheck
AdjustTokenPrivileges
LookupPrivilegeValueW
PrivilegeCheck
CheckTokenMembership
DuplicateToken
EqualSid
ConvertStringSidToSidW
AddAccessAllowedAceEx
AddAccessDeniedAceEx
GetAclInformation
GetAce
AddAce
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
CopySid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenThreadToken
OpenProcessToken
GetTokenInformation

kernel32

InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetLastError
EncodePointer
GetComputerNameW
GetComputerNameExW
GetVolumeInformationW
GetVolumePathNamesForVolumeNameW
GetModuleHandleW
GetTimeZoneInformation
SetErrorMode
GetDiskFreeSpaceW
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
Sleep
EnterCriticalSection
LeaveCriticalSection
DefineDosDeviceW
ReadFile
CreateDirectoryW
SetFileAttributesW
GetEnvironmentVariableW
GetSystemWindowsDirectoryW
LoadLibraryW
GetProcAddress
CreateThread
FindFirstVolumeW
FindNextVolumeW
FindFirstFileW
FindNextFileW
ExpandEnvironmentStringsW
FindClose
FindVolumeClose
SetLastError
GetVersionExW
LoadLibraryExW
FormatMessageW
FreeLibrary
GetCurrentThread
MultiByteToWideChar
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WriteFile
DeleteFileW
MoveFileExW
GetFileAttributesW
GetProcessHeap
HeapAlloc
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
WaitForSingleObject
CloseHandle
SetWaitableTimer
CancelWaitableTimer
GetCurrentThreadId
SetEvent
CreateEventW
CreateWaitableTimerW
OpenThread
CompareStringW
GetCommandLineW
HeapSetInformation
LocalAlloc
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetSystemDirectoryW
LocalFree
ResetEvent
DeviceIoControl
CreateFileW
GetDriveTypeW
HeapFree
GetSystemTimeAsFileTime
GetTickCount64
FlushFileBuffers
GetOverlappedResult
SetThreadPriority
WaitForMultipleObjects
ResumeThread
DeleteVolumeMountPointW
RaiseException
lstrlenW
QueryDosDeviceW
SetVolumeMountPointW

user32

RegisterDeviceNotificationW
LoadStringW
UnregisterDeviceNotification

msvcrt

memset
_snwscanf_s
_wcsupr
strncmp
wcsnlen
_ultow_s
wcscpy_s
wcscat_s
swprintf_s
__CxxFrameHandler3
_purecall
_vsnwprintf
_CxxThrowException
_wcsicmp
free
_controlfp
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
wcschr
_vscwprintf
realloc
memmove
wcsncmp
_errno
_beginthreadex
memcpy
malloc
_wcsnicmp
wcsstr
qsort
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
wcstoul
wcsrchr
iswspace
__set_app_type
towupper
iswdigit
_vsnprintf
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_wcslwr
memcpy_s
memmove_s
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_callnewh
??0exception@@QAE@XZ

atl

ord16
ord23
ord17
ord20
ord30
ord32
ord58

ole32

CoRevertToSelf
CoImpersonateClient
CoDisconnectContext
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CLSIDFromString
CoFreeUnusedLibraries
CoGetObjectContext
StringFromCLSID
CoSetProxyBlanket
CoTaskMemRealloc

shlwapi

SHDeleteKeyW

oleaut32

VariantClear
SysAllocStringLen
SysAllocString
SysFreeString
VariantChangeType
GetErrorInfo
VariantCopy
VariantInit
LoadRegTypeLi
SysStringLen

rpcrt4

I_RpcBindingInqLocalClientPID
UuidToStringW
RpcStringFreeW

ntdll

NtThawTransactions
NtFreezeTransactions
NtQueryVolumeInformationFile
RtlNtStatusToDosErrorNoTeb
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlNtStatusToDosError
NtUnloadKey
NtLoadKey
NtAdjustPrivilegesToken
NtOpenProcessToken
NtOpenThreadToken
EtwTraceMessage
RtlFreeSid
RtlSetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAceEx
NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
NtSetSecurityObject
NtCreateKey
NtDeleteValueKey
NtQueryValueKey
NtSetValueKey
NtFreezeRegistry
NtThawRegistry
NtQuerySystemInformation
RtlFreeHeap
RtlAllocateHeap
NtOpenFile
RtlGUIDFromString
RtlFreeUnicodeString
RtlStringFromGUID
NtWaitForSingleObject
NtDeviceIoControlFile
NtCreateEvent
NtAllocateUuids
LdrGetProcedureAddress
RtlInitAnsiString
LdrGetDllHandle
NtResetEvent
RtlGetVersion
NtOpenKey
NtEnumerateKey
NtQueryKey
NtQueryAttributesFile
NtDeleteKey

vssapi

?CreateVssSnapshotSetDescription@@YGJU_GUID@@JPAPAVIVssSnapshotSetDescription@@@Z
?LoadVssSnapshotSetDescription@@YGJPBGPAPAVIVssSnapshotSetDescription@@U_GUID@@@Z
VssFreeSnapshotPropertiesInternal
CreateWriter
CreateWriterEx

netapi32

NetApiBufferFree
NetShareEnum
NetLocalGroupGetMembers
NetShareGetInfo
NetShareDel
NetShareAdd

clusapi

OpenCluster
ClusterResourceControl
GetClusterResourceState
CloseClusterResource
CloseCluster
OpenClusterResource
GetNodeClusterState

xolehlp

ord9
ord8

resutils

ResUtilEnumResourcesEx
ResUtilGetResourceName

setupapi

SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
CM_Get_Parent

vsstrace

ord7
ord9
ord4
ord10
ord11
ord8
ord2
ord1
ord3
ord5
ord6

authz

AuthzReportSecurityEventFromParams
AuthzUnregisterSecurityEventSource
AuthzRegisterSecurityEventSource

virtdisk

GetStorageDependencyInformation

Sections

.text
Size: 901KB - Virtual size: 901KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 102KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

24bbe0bfaf1028355da5ace282104fb1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

atl

ole32

shlwapi

oleaut32

rpcrt4

ntdll

vssapi

netapi32

clusapi

xolehlp

resutils

setupapi

vsstrace

authz

virtdisk

Sections

.text Size: 901KB - Virtual size: 901KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 102KB - Virtual size: 103KB

.text
Size: 901KB - Virtual size: 901KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 102KB - Virtual size: 103KB