5f0ae746c79c32d9d0ac27cdf7a086a6e3eae01fd32b1dd73d6a5db13fa32040

Sharing

Copy URL Twitter E-mail

General

Target

5f0ae746c79c32d9d0ac27cdf7a086a6e3eae01fd32b1dd73d6a5db13fa32040
Size

45KB
MD5

625df702c07a5f70ca7b99646633a1e4
SHA1

dc1450beeedba26c435eeaca7cc57804b752c8bf
SHA256

5f0ae746c79c32d9d0ac27cdf7a086a6e3eae01fd32b1dd73d6a5db13fa32040
SHA512

7682da194da06123ea0d6864b0c09b86a3d14ac9414e446734ee5b70b5c9e21c5d4683f89e6671255ea32c63d6ac4afd440b851d86aaa8948d2108a204d63261
SSDEEP

768:gy+OaF+oAKr90mihkv0EX8eZqb0qzPf6He5yUUWFFiotkK4x1GLMdlg/:L+OaYo7rim+gHMeZqb0OX6qiop4xE0le

Score

N/A

Malware Config

Signatures

Files

5f0ae746c79c32d9d0ac27cdf7a086a6e3eae01fd32b1dd73d6a5db13fa32040
.exe windows x86

e4846d46b09e18fe4642cf1f305ac6ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_mbsrchr
_aligned_offset_realloc
_lrotl
_fstat64
strtol
_wunlink
_purecall
_ismbbkprint
_cabs
_wcsicoll
?what@exception@@UBEPBDXZ
isupper
_ismbcalnum
_winminor
localtime
strncpy
??_7__non_rtti_object@@6B@
isspace
_strerror
__DestructExceptionObject
_setjmp3
_ismbcsymbol
ferror
_wspawnvp
??_7exception@@6B@
_localtime64
_fstati64
_CItan

query

?VT_VARIANT_LE@@YGHABUtagPROPVARIANT@@0@Z
DllGetClassObject
?SetProperty@CDbColId@@QAEHPBG@Z
?SetWeight@CDbCmdTreeNode@@QAEXJ@Z
??1CContentRestriction@@QAE@XZ
??1CFwEventItem@@QAE@XZ
?GetDWORDParam@CMachineAdmin@@QAEHPBGAAK@Z
??0CPhysStorage@@IAE@AAVPStorage@@AAVPStorageObject@@KPAVPMmStream@@W4EOpenMode@1@HIH@Z
??1CCatState@@QAE@XZ
??0CImpersonateRemoteAccess@@QAE@PAVCImpersonationTokenCache@@@Z
??0CiStorage@@QAE@PBGAAUICiCAdviseStatus@@KKH@Z
?MakeISearch@@YGJPAPAUISearchQueryHits@@PAVCDbRestriction@@PBG@Z
?CiNtOpenNoThrow@@YGJAAPAXPBGKKK@Z
?VT_VARIANT_EQ@@YGHABUtagPROPVARIANT@@0@Z
?Marshall@CPropNameArray@@QBEXAAVPSerStream@@@Z
??1CDbSortSet@@QAE@XZ
?OpenRecordForWrites@CPropStoreManager@@QAEPAVCCompositePropRecordForWrites@@KPAE@Z
?StrLen@CKey@@QBEIXZ
?Release@CImpersonateRemoteAccess@@QAEXXZ
??0CFullPath@@QAE@PBG@Z
??1CDbColumns@@QAE@XZ
?AppendListElement@CDbListAnchor@@IAEHPAVCDbCmdTreeNode@@@Z
?Flush@CDynStream@@QAEXXZ
?ReadProperty@CPropertyStore@@QAEHAAVCPropRecordNoLock@@KPAUtagPROPVARIANT@@PAI@Z
?DetermineDriveType@CiStorage@@SGIPBG@Z
?FormFullTree@CTextToTree@@QAEPAUtagDBCOMMANDTREE@@XZ
?GetPropType@CEmptyPropertyList@@SGGI@Z
?AddRef@CEnumString@@UAGKXZ
?GetFILETIME@CAllocStorageVariant@@QBE?AU_FILETIME@@I@Z
?GetDATE@CAllocStorageVariant@@QBENI@Z
??0CDbSelectNode@@QAE@XZ
?SkipLong@CMemDeSerStream@@UAEXXZ
?PutValue@CValueNormalizer@@QAEXKAAKABVCStorageVariant@@@Z
?ReleaseRead@CPropertyStore@@AAEXAAVCReadWriteLockRecord@@@Z
?GetNumber@CQueryScanner@@QAEHAA_KAAH@Z
?Marshall@CBaseStorageVariant@@QBEXAAVPSerStream@@@Z

kernel32

ResetWriteWatch
NlsGetCacheUpdateCount
CreateToolhelp32Snapshot
HeapReAlloc
GetCurrentThread
LocalAlloc
PurgeComm
SetSystemTimeAdjustment
QueryActCtxW
DnsHostnameToComputerNameA
HeapDestroy
GetSystemTimeAdjustment
SetMessageWaitingIndicator
lstrcpyn
SetVolumeLabelW
SetCommConfig
WriteConsoleInputVDMA
VirtualFreeEx
CreateEventA
GetFileInformationByHandle
FindAtomW
TryEnterCriticalSection
ConvertFiberToThread
GetEnvironmentStringsW
QueryPerformanceCounter
UnmapViewOfFile
LockFileEx
VirtualAlloc
CreateMemoryResourceNotification
OpenMutexW
SetLocaleInfoW
GetShortPathNameW
WaitForMultipleObjectsEx
SetConsoleTextAttribute
SetCalendarInfoA
SetCriticalSectionSpinCount
AllocateUserPhysicalPages
OpenWaitableTimerW
LoadLibraryA
FindResourceW
lstrcpynW
GetConsoleCommandHistoryA
GetProfileStringA
VerLanguageNameA
Process32Next
CreateDirectoryExW
CreateNamedPipeA
WriteProfileSectionW
GetDateFormatW
ReadConsoleOutputCharacterA
AddLocalAlternateComputerNameW
ExpungeConsoleCommandHistoryW
SetThreadIdealProcessor
ClearCommError
SetupComm
SetComputerNameExW
ReadConsoleW
VirtualQuery
UnregisterWait
RaiseException
GetExpandedNameA
GetCurrentDirectoryW
GetNumaHighestNodeNumber
CreateWaitableTimerW
SwitchToThread
SetConsoleOS2OemFormat

ole32

CoRevokeMallocSpy
CoMarshalHresult
CoQueryProxyBlanket
CoGetApartmentID
GetClassFile
CoRegisterMallocSpy
HENHMETAFILE_UserFree
CoRegisterChannelHook
CoQueryClientBlanket
StgOpenStorageEx
HWND_UserMarshal
CoUnloadingWOW
CoGetComCatalog
STGMEDIUM_UserSize
CoRegisterPSClsid
CreateClassMoniker
StgIsStorageFile
CoFreeUnusedLibrariesEx
CoReleaseServerProcess
StgCreateStorageEx
HICON_UserFree
OleDraw
HPALETTE_UserFree
HMENU_UserFree
DllGetClassObjectWOW
GetHGlobalFromStream
SetDocumentBitStg
MkParseDisplayName
OleCreateFromFileEx
HGLOBAL_UserSize
OleRegEnumVerbs
CoGetCancelObject
WriteClassStg
OleCreateEx
PropSysAllocString
OleSetMenuDescriptor
CoTaskMemRealloc
GetConvertStg
StgGetIFillLockBytesOnILockBytes
WdtpInterfacePointer_UserMarshal
HENHMETAFILE_UserSize

dnsapi

DnsModifyRecordsInSet_W
DnsValidateName_UTF8
DnsRecordBuild_UTF8
DnsApiRealloc
DnsUtf8ToUnicode
NetInfo_IsForUpdate
Dns_SkipToRecord
GetCurrentTimeInSeconds
DnsCopyStringEx
DnsGetBufferLengthForStringCopy
Dns_WriteDottedNameToPacket
DnsValidateName_A
DnsFree
DnsStringCopyAllocateEx
Dns_RecvTcp
DnsReplaceRecordSetA
DnsQuery_A
DnsFlushResolverCacheEntry_UTF8
Dns_AddRecordsToMessage
DnsExtractRecordsFromMessage_UTF8
Dns_ReadPacketNameAllocate
DnsApiSetDebugGlobals
DnsNotifyResolverClusterIp
DnsRecordStringForWritableType
DnsFindAuthoritativeZone
Dns_AllocateMsgBuf
Dns_WriteRecordStructureToPacketEx
DnsCreateStringCopy
Query_Main
DnsUpdate
DnsApiFree

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4846d46b09e18fe4642cf1f305ac6ec

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

query

kernel32

ole32

dnsapi

Sections

.text Size: 32KB - Virtual size: 32KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 41KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 1024B

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 41KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 1024B