6fa4b4f1479147c1ff45b475f4ba75a7abf43c94959ebfc2afbfba51cd59be77

Sharing

Copy URL Twitter E-mail

General

Target

6fa4b4f1479147c1ff45b475f4ba75a7abf43c94959ebfc2afbfba51cd59be77
Size

32KB
MD5

6ecc21479d77de0d13efdc3fa2266520
SHA1

7d9e8b4dbe56bedbc20c62db0a277de673600514
SHA256

6fa4b4f1479147c1ff45b475f4ba75a7abf43c94959ebfc2afbfba51cd59be77
SHA512

0a8f58142efcf8d678a3568300e024403a887d4f6e67e98aa35f8b54672d51fb997916af1c7cd36ddc6fd93a17bf670037b023e6a9babf29d1bd4ee1fc535808
SSDEEP

768:I5EDkpG0VUE7ip/qatXf6ZJWiVkkZpPrY++0zd/jD:I5EwpL7kqYXgrZZRs05//

Score

N/A

Malware Config

Signatures

Files

6fa4b4f1479147c1ff45b475f4ba75a7abf43c94959ebfc2afbfba51cd59be77
.exe windows x86

5b6b488e09f3c1039a05ea7984d16737

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedCompareExchange
CreateThread
LocalFree
CloseHandle
WaitForSingleObject
FreeLibrary
FormatMessageW
LocalAlloc
GetConsoleScreenBufferInfo
GetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
InterlockedExchange
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
Sleep
ExitThread
GetCurrentProcessId
lstrlenW
GetLastError

msvcr80

_initterm
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__winitenv
exit
_XcptFilter
_exit
memset
_cexit
__wgetmainargs
_amsg_exit
wcstok
memcpy
_wtoi
_vsnwprintf_s
_wcsicmp
_initterm_e

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoUninitialize
CoInitializeEx

webengine

IsRegisteredInProc
RemoveAspnetFromIISKey
IsMatchingBitness
CheckIISState
RunningOn64Bit
AspnetLoadResourceDLL
GetExistingVersion
RunAspnetCA
LoadResourceString
ValidateIISPath
RegisterScriptMapsOnVista
GrantAccessToUserAccountOnVista
GrantAccessToUserAccount
RegisterAspNetEx
UnregisterAspNet
RemoveClientScriptFiles
CopyClientScriptFiles
PrintStringToStdOut
CallManagedProtectedConfigAction
IsVista
PrintResourceString
SetRemoteConfigDCOMRegKeys
DetectErrorAndGetLogfileName
ListAspnetInstalledVersions
ListAspnetInstalledIISKeys
RunPkgmgr
PrintResourceStringNoNewLine
GetXSPHeap

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b6b488e09f3c1039a05ea7984d16737

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr80

advapi32

ole32

webengine

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 2KB - Virtual size: 15KB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 2KB - Virtual size: 15KB

.rsrc
Size: 8KB - Virtual size: 8KB