cc56aa98898672964537913f57ce11acde142ef6c57ddb3694bcbb524225b737

Sharing

Copy URL Twitter E-mail

General

Target

cc56aa98898672964537913f57ce11acde142ef6c57ddb3694bcbb524225b737
Size

857KB
MD5

492086cbedf9285e92dafa187a167ca7
SHA1

015678073e244a31adba200cc4fba9bd3451645a
SHA256

cc56aa98898672964537913f57ce11acde142ef6c57ddb3694bcbb524225b737
SHA512

f0b97981a615a4af29c0d0a340ccc22d9052c1de06f96b0d21a763c0240327d33e2cbb14d682835b96d0d9104cd159b735f2e4caad30cbf8ae966997fe0e17b4
SSDEEP

24576:M192FXEIBNfDMPe0tvfk6cEZ9nUjIus9:M192FXRfsptv8UXUi9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc56aa98898672964537913f57ce11acde142ef6c57ddb3694bcbb524225b737

Files

cc56aa98898672964537913f57ce11acde142ef6c57ddb3694bcbb524225b737
.exe windows:5 windows x86 arch:x86

e44806090e33a133f0cb13cf52b61d75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

clussvc.pdb

Imports

msvcrt

wcsrchr
wcschr
wcsncmp
wcscat
??3@YAXPAX@Z
??2@YAPAXI@Z
_c_exit
isalpha
printf
_vsnprintf
_wcsnicmp
wcslen
_wgetenv
swscanf
_exit
_XcptFilter
_cexit
__winitenv
mbstowcs
_wtoi
exit
_iob
fprintf
wcsncat
_snwprintf
_vsnwprintf
wcstoul
wcsstr
rand
srand
qsort
wcscmp
memmove
time
_wcsicmp
calloc
free
fflush
_snprintf
?terminate@@YAXXZ
wcstol
_i64tow
_itow
iswalpha
iswspace
wcscpy
strncpy
_mbstrlen
_wcsupr
strpbrk
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
strspn
isdigit
__CxxFrameHandler
??1type_info@@UAE@XZ
iswctype
wcsncpy

advapi32

SetSecurityDescriptorDacl
GetTraceEnableLevel
GetTraceEnableFlags
EqualSid
TraceMessage
RegisterEventSourceW
ReportEventW
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
RegisterTraceGuidsW
RegRestoreKeyW
CryptImportKey
CryptExportKey
CryptSetProvParam
DuplicateTokenEx
AdjustTokenPrivileges
SetThreadToken
CryptGetProvParam
GetSecurityDescriptorControl
MakeSelfRelativeSD
CryptGetUserKey
CryptGetKeyParam
RegSetKeySecurity
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegLoadKeyW
RegNotifyChangeKeyValue
RegFlushKey
RegGetKeySecurity
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
ChangeServiceConfigW
LsaNtStatusToWinError
CryptDecrypt
CryptSetKeyParam
CheckTokenMembership
CreateWellKnownSid
LookupPrivilegeValueW
LookupPrivilegeDisplayNameW
GetTokenInformation
DuplicateToken
OpenProcessToken
SetServiceStatus
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegSetValueExW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
IsValidSecurityDescriptor
GetSecurityDescriptorLength
ControlService
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegUnLoadKeyW
RegDeleteValueW
RegSaveKeyExW
RegSaveKeyW
CryptGetHashParam
CryptEncrypt
CryptDestroyKey
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptGenRandom
CryptAcquireContextW
AllocateAndInitializeSid
FreeSid
RegCreateKeyW
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
MapGenericMask
AccessCheck
ConvertStringSidToSidW
UnregisterTraceGuids
SetSecurityInfo
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
ConvertSidToStringSidW
GetAclInformation
SetSecurityDescriptorSacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AddAce
MakeAbsoluteSD
RegQueryValueExA
QueryTraceW
StartTraceW
EnableTrace
GetTraceLoggerHandle

kernel32

MoveFileExW
ExitProcess
ReleaseMutex
TerminateProcess
IsDebuggerPresent
SetProcessWorkingSetSize
GetProcessWorkingSetSize
SetUnhandledExceptionFilter
CreateMutexW
SetPriorityClass
QueryPerformanceCounter
DeleteFileW
UnhandledExceptionFilter
WaitForMultipleObjects
CreateProcessW
GetExitCodeProcess
InterlockedExchange
LocalReAlloc
UnmapViewOfFile
InterlockedDecrement
InterlockedIncrement
GetCurrentThread
TryEnterCriticalSection
OpenProcess
FlushFileBuffers
ReadFile
WriteFile
GetCurrentProcessId
GetModuleFileNameW
GetCurrentThreadId
GetOverlappedResult
CreateFileMappingW
GetProcessHeap
HeapFree
GetFileAttributesExW
SetFileAttributesW
DeviceIoControl
CreateFileW
lstrcmpW
InitializeCriticalSection
CreateThread
Sleep
DeleteCriticalSection
CancelWaitableTimer
EnterCriticalSection
LeaveCriticalSection
lstrcpyW
lstrcatW
SetLastError
GetComputerNameExW
SetErrorMode
GetLocalTime
GetTickCount
GetTempFileNameW
CopyFileExW
CreateEventA
LocalSize
VerSetConditionMask
VerifyVersionInfoW
PostQueuedCompletionStatus
CreateIoCompletionPort
HeapAlloc
VirtualQuery
SetCurrentDirectoryW
DuplicateHandle
UnregisterWaitEx
RegisterWaitForSingleObject
InterlockedExchangeAdd
OpenFileMappingW
DeleteTimerQueueTimer
CreateTimerQueue
CreateTimerQueueTimer
OutputDebugStringA
GetLocaleInfoW
DeleteTimerQueue
OutputDebugStringW
RaiseException
CopyFileW
GetFileAttributesW
MoveFileW
ExpandEnvironmentStringsW
HeapSize
GetWindowsDirectoryW
CompareFileTime
VirtualAlloc
VirtualFree
SetFilePointerEx
SetEndOfFile
lstrlenW
CreateEventW
SetConsoleCtrlHandler
SetEvent
lstrlenA
GetVersionExW
lstrcpynW
lstrcmpiW
WaitForSingleObject
LoadLibraryExW
FormatMessageW
FreeLibrary
WideCharToMultiByte
GetCurrentProcess
CloseHandle
LocalAlloc
LocalFree
GetLastError
MapViewOfFile
CompareStringW
SearchPathW
InterlockedCompareExchange
ResetEvent
OpenThread
CreateWaitableTimerW
SetFilePointer
GetFileSize
FormatMessageA
GetSystemTime
GetEnvironmentVariableW
GetSystemInfo
ResumeThread
SetThreadPriority
GetComputerNameW
FileTimeToSystemTime
SleepEx
WaitForSingleObjectEx
SetWaitableTimer
GetTempPathW
CreateSemaphoreW
ReleaseSemaphore
DebugBreak
GetFileSizeEx
GetDiskFreeSpaceExW
CreateDirectoryW
FindClose
FindNextFileW
FindFirstFileW
GetQueuedCompletionStatus
RemoveDirectoryW
GetProcAddress
LoadLibraryW
ExitThread
GetSystemTimeAsFileTime

user32

wsprintfA
wsprintfW

rpcrt4

UuidFromStringW
RpcBindingServerFromClient
UuidToStringW
RpcServerRegisterAuthInfoW
RpcServerUseProtseqW
RpcServerUseProtseqEpW
RpcServerListen
RpcSsDontSerializeContext
RpcServerInqBindings
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingVectorFree
RpcEpUnregister
RpcServerUnregisterIf
UuidHash
RpcServerRegisterIfEx
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
I_RpcMapWin32Status
RpcEpResolveBinding
RpcBindingSetAuthInfoW
RpcBindingFree
UuidCreate
RpcErrorEndEnumeration
RpcErrorGetNextRecord
RpcErrorStartEnumeration
RpcCancelThreadEx
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcRaiseException
RpcBindingSetOption
NdrClientCall2
NdrAsyncClientCall
NdrAsyncServerCall
NdrServerCall2
I_RpcExceptionFilter
I_RpcBindingInqLocalClientPID
RpcImpersonateClient
RpcRevertToSelf
RpcBindingInqAuthClientW
RpcEpRegisterW
RpcMgmtSetComTimeout

ole32

CoTaskMemFree
CoFreeUnusedLibrariesEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoUninitialize

imagehlp

MapFileAndCheckSumW

vssapi

?OnVSSShutdown@CVssWriter@@UAG_NXZ
?OnContinueIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?OnBackOffIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?OnVSSApplicationStartup@CVssWriter@@UAG_NXZ
?IsBootableSystemStateBackedUp@CVssWriter@@IBG_NXZ
?Unsubscribe@CVssWriter@@QAGJXZ
?Subscribe@CVssWriter@@QAGJK@Z
?Initialize@CVssWriter@@QAGJU_GUID@@PBGW4VSS_USAGE_TYPE@@W4VSS_SOURCE_TYPE@@W4_VSS_APPLICATION_LEVEL@@KW4VSS_ALTERNATE_WRITER_STATE@@_N1@Z
??1CVssWriter@@UAE@XZ
??0CVssWriter@@QAE@XZ
?OnPostSnapshot@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPostRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPreRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnBackupShutdown@CVssWriter@@UAG_NU_GUID@@@Z
?OnBackupComplete@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?SetWriterFailure@CVssWriter@@IAGJJ@Z

atl

ord32

crypt32

CryptProtectData
CryptUnprotectData

ntdll

NtDeviceIoControlFile
NtWaitForSingleObject
NtCreateFile
RtlFreeAnsiString
NtDuplicateToken
NtSetInformationThread
RtlAllocateAndInitializeSid
NtOpenFile
RtlFreeUnicodeString
RtlReleaseResource
NtOpenProcessToken
NtQueryInformationToken
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
NtClose
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
RtlAllocateHeap
RtlMakeSelfRelativeSD
RtlNtStatusToDosError
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
NtUnloadKey
RtlDosPathNameToRelativeNtPathName_U
NtLoadKey2
RtlReleaseRelativeName
RtlFreeHeap
RtlSetThreadErrorMode
NtRestoreKey
RtlAdjustPrivilege
RtlInitString
RtlCompareMemory
RtlExtendedIntegerMultiply
RtlInitUnicodeString
RtlUnicodeStringToInteger
RtlAcquireResourceExclusive
RtlValidRelativeSecurityDescriptor
RtlGetCallersAddress
RtlFreeSid
RtlInitializeResource
RtlAcquireResourceShared

netapi32

NetApiBufferFree
NetSessionDel
NetConnectionEnum
NetShareAdd
NetShareDel

ws2_32

WSAIoctl
bind
WSASocketW
WSAStartup
WSAGetLastError
WSACleanup
WSARecvFrom
closesocket
inet_ntoa
inet_addr
ntohs
htons
WSASendTo
ntohl
htonl

oleaut32

SysFreeString
SysAllocString

iphlpapi

IcmpCreateFile
GetTcpTable
GetIpForwardTable
GetAdaptersInfo
IcmpCloseHandle
IcmpSendEcho

secur32

LsaLookupAuthenticationPackage
LsaConnectUntrusted
LsaRegisterLogonProcess
GetUserNameExW
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
LsaGetLogonSessionData

dhcpcsvc

McastApiStartup
McastGenUID
McastRequestAddress
McastReleaseAddress
McastRenewAddress
McastApiCleanup
McastEnumerateScopes

psapi

GetModuleFileNameExW

netman

HrLanConnectionNameFromGuidOrPath
HrGetPnpDeviceStatus

Sections

.text
Size: 720KB - Virtual size: 720KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 129KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e44806090e33a133f0cb13cf52b61d75

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

rpcrt4

ole32

imagehlp

vssapi

atl

crypt32

ntdll

netapi32

ws2_32

oleaut32

iphlpapi

secur32

dhcpcsvc

psapi

netman

Sections

.text Size: 720KB - Virtual size: 720KB

.data Size: 7KB - Virtual size: 13KB

.rsrc Size: 129KB - Virtual size: 161KB

.text
Size: 720KB - Virtual size: 720KB

.data
Size: 7KB - Virtual size: 13KB

.rsrc
Size: 129KB - Virtual size: 161KB