e76931801db4d66a4d26e26c10db70c34c010fff25eec3f6885b074d254575aa

Sharing

Copy URL Twitter E-mail

General

Target

e76931801db4d66a4d26e26c10db70c34c010fff25eec3f6885b074d254575aa
Size

734KB
MD5

099ab10e1c74d64448eaf3a3247c45f0
SHA1

4d141c46319cf76b3f8212467e0557bd2c09f663
SHA256

e76931801db4d66a4d26e26c10db70c34c010fff25eec3f6885b074d254575aa
SHA512

62b93ed001b41e84f6372addc7d606153825769d8c6df94b98cc798e49b20aad86eb80984accf133c72d03dae05d5a9f3c1b86fda4b7729974c189768d74bdc0
SSDEEP

12288:a9G6DMzHMMHMMMyMMMZMMMVcR9bzOXmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMP:WGLbMMHMMMvMMZMMMKzb6XmMMMiMMMzd

Score

N/A

Malware Config

Signatures

Files

e76931801db4d66a4d26e26c10db70c34c010fff25eec3f6885b074d254575aa
.exe windows x86

34ab8235aec436c7a4f8e2509bdb2a1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EventWrite
GetTraceEnableFlags
RegQueryValueExW
EventUnregister
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
RegOpenKeyExW
EventRegister
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW

kernel32

Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
TerminateProcess
CreateFileW
lstrlenW
VerifyVersionInfoW
GetLastError
GetProcAddress
LocalAlloc
IsWow64Process
HeapSetInformation
GetFileTime
DeleteCriticalSection
CloseHandle
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
LoadLibraryW
GetModuleHandleW
GetCurrentProcess
VerSetConditionMask
SetDllDirectoryW
CreateProcessW
SetErrorMode
GetCommandLineW
RaiseException
LoadLibraryA
GetSystemDefaultLCID
GetUserDefaultLCID
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersionExA
FreeLibrary
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentDirectoryW
InitializeCriticalSection

user32

IsWindowEnabled
LoadStringW
CharNextW
GetWindowThreadProcessId
SendMessageTimeoutW
FindWindowExW
MessageBoxW
IsWindowVisible
AllowSetForegroundWindow

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
iswalpha
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
wcsncmp
iswspace
_vsnwprintf
memset

shlwapi

ord154
SHGetValueW
SHRegGetValueW
SHSetValueW
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
ord158
PathFindFileNameW
UrlCreateFromPathW
StrStrW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoInitialize

urlmon

ord410
ord111

iertutil

ord32
ord44
ord325
ord9
ord31
ord163
ord650
ord42
ord58

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 693KB - Virtual size: 693KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ngaut
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

34ab8235aec436c7a4f8e2509bdb2a1d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

shell32

ole32

urlmon

iertutil

Sections

.text Size: 26KB - Virtual size: 25KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 693KB - Virtual size: 693KB

.reloc Size: 1KB - Virtual size: 1KB

.ngaut Size: 4KB - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 25KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 693KB - Virtual size: 693KB

.reloc
Size: 1KB - Virtual size: 1KB

.ngaut
Size: 4KB - Virtual size: 4KB