476230a1dcfc463dd03aebc70f81cec8fe7614f44db4c3e1f7150d1d040d60ec

Sharing

Copy URL

Twitter E-mail

General

Target

476230a1dcfc463dd03aebc70f81cec8fe7614f44db4c3e1f7150d1d040d60ec
Size

253KB
MD5

048677411f4e809243c139987b4dfbb0
SHA1

7c112e34f0663dd08518ef5b75ce7d0b211c08cb
SHA256

476230a1dcfc463dd03aebc70f81cec8fe7614f44db4c3e1f7150d1d040d60ec
SHA512

f801a3f285b9b4049de6f9614a69fb2e1ca1791ad2f5c6e951a36215a3687ec661db664c2369ba604a784e8c41e0897585d72af138eff6eeab748ee3291106cb
SSDEEP

6144:VaTNpjXNWAqGKm349igT3Oquk5Gye9hqUrzeqqU8pPuZ7i:ATNNdWA0kDqM9WqqH9

Score

N/A

Malware Config

Signatures

Files

476230a1dcfc463dd03aebc70f81cec8fe7614f44db4c3e1f7150d1d040d60ec
.exe windows x64

25713d74d695985d0f50dbc71686b46c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExA

kernel32

FreeLibrary
GetModuleHandleW
VirtualFree
WideCharToMultiByte
LoadLibraryW
MultiByteToWideChar
GetLastError
GetProcAddress
VirtualAlloc
ProcessIdToSessionId
LocalAlloc
HeapSetInformation
GetCurrentProcessId
LocalFree
ExpandEnvironmentStringsW
Sleep
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
CreateActCtxW
ReleaseActCtx
GetModuleFileNameW
DeactivateActCtx
ActivateActCtx

msvcrt

_stricmp
_wcsicmp
strstr
printf
_vsnprintf
exit
__wgetmainargs
__C_specific_handler
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
memset
_cexit
_exit
_XcptFilter

ntdll

NtQuerySystemInformation
RtlInitUnicodeString
NtClose
NtOpenFile
DbgPrint
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

rasapi32

RasGetAutodialAddressW
RasGetAutodialParamW
DwRasUninitialize
RasEnumAutodialAddressesW

rasdlg

RasPhonebookDlgW
RasAutodialQueryDlgW
RasDialDlgW

tapi32

lineGetTranslateCapsW
lineShutdown
lineInitialize

ws2_32

WSAStartup

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 236KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25713d74d695985d0f50dbc71686b46c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

rasapi32

rasdlg

tapi32

ws2_32

Sections

.text Size: 11KB - Virtual size: 11KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 512B - Virtual size: 360B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 236KB - Virtual size: 460KB

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 360B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 236KB - Virtual size: 460KB