c36b7bc3d074bbd03913b1e8c41898f090fbdea2a16a87105311b8c9280a99c0

General

Target

c36b7bc3d074bbd03913b1e8c41898f090fbdea2a16a87105311b8c9280a99c0
Size

176KB
MD5

343108444ef03de6b1cad5c0281d7abc
SHA1

7a5428c937d70d42a9dd48629c60067fcf76a228
SHA256

c36b7bc3d074bbd03913b1e8c41898f090fbdea2a16a87105311b8c9280a99c0
SHA512

6ce098785cb99408074d0ce98590161bbaa671ea2bd64f176dab5bf352064afecab8765dbf12ae07bc826e4421fdd8d5d884a1f2be10eb7cd3b7cc33f709c4ff
SSDEEP

3072:tQ3/K7YKLxw6y6B64g0QKv4WiMj0QtH/PF9cLtoxAUARFWZcMJ1cEWiB9VO7HXFS:t0y7bLuBDfbMjRtV9cLSx78FWZca1cJw

Score

N/A

Malware Config

Signatures

Files

c36b7bc3d074bbd03913b1e8c41898f090fbdea2a16a87105311b8c9280a99c0
.dll windows x86

6b22d64f2436c175b0bf5f7c0c14601d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcscpy
_adjust_fdiv
malloc
_initterm
free
_except_handler3
wcslen
wcscat

ntdll

NtDeviceIoControlFile
NtWaitForSingleObject
RtlAllocateHeap
RtlInitUnicodeString
NtCreateFile
RtlFreeHeap
RtlNtStatusToDosError
DbgPrint
NtFsControlFile

kernel32

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
CloseHandle
DisableThreadLibraryCalls
GetLastError
QueryPerformanceCounter
VirtualAlloc
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
VirtualProtect
GetCurrentProcess
TerminateProcess
CreateFileW

Exports

Exports

ServiceMain
FilterAttachAtAltitude
FilterClose
FilterConnectCommunicationPort
FilterCreate
FilterDetach
FilterFindClose
FilterFindFirst
FilterFindNext
FilterGetDosName
FilterGetInformation
FilterGetMessage
FilterInstanceClose
FilterInstanceCreate
FilterInstanceFindClose
FilterInstanceFindFirst
FilterInstanceFindNext
FilterInstanceGetInformation
FilterLoad
FilterReplyMessage
FilterSendMessage
FilterUnload
FilterVolumeClose
FilterVolumeFindClose
FilterVolumeFindFirst
FilterVolumeFindNext
FilterVolumeInstanceFindClose
FilterVolumeInstanceFindFirst
FilterVolumeInstanceFindNext

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 474B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b22d64f2436c175b0bf5f7c0c14601d

Headers

File Characteristics

Imports

msvcrt

ntdll

kernel32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 84B

.rsrc Size: 157KB - Virtual size: 157KB

.reloc Size: 512B - Virtual size: 474B

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 84B

.rsrc
Size: 157KB - Virtual size: 157KB

.reloc
Size: 512B - Virtual size: 474B