e93dfe97cdd0a9bcd8cc42063fb14cef4e4e0d588871614c3cea18e4c4ba77d7

Sharing

Copy URL Twitter E-mail

General

Target
e93dfe97cdd0a9bcd8cc42063fb14cef4e4e0d588871614c3cea18e4c4ba77d7
Size 848KB
Sample220405-gyrb2aadf3
SHA256 e93dfe97cdd0a9bcd8cc42063fb14cef4e4e0d588871614c3cea18e4c4ba77d7
MD5 8ced802761e3f10bd0ebef073f19e55d
SHA1 3ebb8367414a3cd3ed5229638761cea66395bc22
SHA512 d7b4ab571421d97e133b80f5705b63d131629d13dc696fb71ce199679350e21c6c7c0a0b3ac7d7f17d998c5035f95f09f1756a26a3ab7199c36fb8f3b67b4d16
SSDEEP 12288:LDdsu7O1aJJ1G4aYzgqjRvElPm7o220Wgsaj/ElwcUEOdfTdkIJ4U198unnwR:f5O181vOqjpElVT0fbcUEgbW09/wR
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

e93dfe97cdd0a9bcd8cc42063fb14cef4e4e0d588871614c3cea18e4c4ba77d7

.exe 848KB

e93dfe97cdd0a9bcd8cc42063fb14cef4e4e0d588871614c3cea18e4c4ba77d7

IMPHASH 1d384a144b31e371d44c4ad755c6d7a8
SHA256 e93dfe97cdd0a9bcd8cc42063fb14cef4e4e0d588871614c3cea18e4c4ba77d7
MD5 8ced802761e3f10bd0ebef073f19e55d
SHA1 3ebb8367414a3cd3ed5229638761cea66395bc22
SHA512 d7b4ab571421d97e133b80f5705b63d131629d13dc696fb71ce199679350e21c6c7c0a0b3ac7d7f17d998c5035f95f09f1756a26a3ab7199c36fb8f3b67b4d16
SSDEEP 12288:LDdsu7O1aJJ1G4aYzgqjRvElPm7o220Wgsaj/ElwcUEOdfTdkIJ4U198unnwR:f5O181vOqjpElVT0fbcUEgbW09/wR
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19691

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesExA LocalFlags GetConsoleAliasesA GlobalAlloc LoadLibraryW GetProcessHandleCount InterlockedPopEntrySList LeaveCriticalSection WriteConsoleW GetMailslotInfo lstrlenW GetShortPathNameA GetCPInfoExW FillConsoleOutputCharacterW SetLastError GetLongPathNameA CreateDirectoryW WriteProfileSectionA SetStdHandle LoadLibraryA MoveFileA GetModuleFileNameA FindFirstChangeNotificationA GetConsoleTitleW VirtualProtect SetCalendarInfoA CloseHandle HeapSize WriteConsoleOutputCharacterA SetConsoleTextAttribute GetConsoleAliasesLengthW UnregisterWait SetFilePointer FlushFileBuffers GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess GetCurrentProcess HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent EnterCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetProcAddress GetModuleHandleW ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RtlUnwind LCMapStringW MultiByteToWideChar GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode CreateFileW

user32

ClientToScreen

gdi32

GetTextExtentExPointA

advapi32

ClearEventLogW

ole32

CoFileTimeNow

Name

.text

Size

696KB

Virtual Size

695KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

289KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nalih

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.muzomo

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pibeco

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.yixaruh

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ