4dd6447fe4266303a5bd3294429f5b05af8f905b11ccabccdd1a21d93676af13

Sharing

Copy URL

Twitter E-mail

General

Target

4dd6447fe4266303a5bd3294429f5b05af8f905b11ccabccdd1a21d93676af13
Size

608KB
MD5

6163611856785877a146deeb1bc41e80
SHA1

c94e12406c2d66804a0a09ac1a885a6c8773e5d5
SHA256

4dd6447fe4266303a5bd3294429f5b05af8f905b11ccabccdd1a21d93676af13
SHA512

43aab5a51fe5084402467aed86ae0b716fdc4be57dec4f18cc193e3c33be0f94d5ab231f399ad9db814ab14b8c9d7b16672f227a158423c66f9305b88e2d0a5c
SSDEEP

12288:mD/Nefm+g3DsYhteDInvcfJEDl85aIxEgc5WbADMyh38sqUNxlKgRyaj:mDMxyDRhQDIvcfJPj4WbADJ3Nvlt

Score

N/A

Malware Config

Signatures

Files

4dd6447fe4266303a5bd3294429f5b05af8f905b11ccabccdd1a21d93676af13
.exe windows x64

b02c6488b00ce1620374c5cc5e463607

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

loadperf

SetServiceAsTrustedW
BackupPerfRegistryToFileW
RestorePerfRegistryFromFileW
LpAcquireInstallationMutex
LoadPerfCounterTextStringsW
UpdatePerfNameFilesA
LpReleaseInstallationMutex

shell32

CommandLineToArgvW

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegDeleteKeyW
RegQueryInfoKeyW
IsTextUnicode
RegEnumKeyW
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
RegSetValueExW
EventWrite
RegCreateKeyExW
RegQueryValueExW
EventUnregister
RegDeleteValueW
RegOpenKeyExW
EventRegister
RegEnumKeyExW
RegCloseKey

kernel32

SetUnhandledExceptionFilter
GetCommandLineW
SearchPathW
lstrlenA
HeapAlloc
HeapFree
GetProcessHeap
Sleep
MultiByteToWideChar
lstrlenW
SetThreadPreferredUILanguages
GetLastError
GetCurrentDirectoryW
SetLastError
SearchPathA
lstrcmpiW
HeapSetInformation
LocalFree
GetFileType
LocalAlloc
GetStdHandle
WriteConsoleW
FormatMessageW
WideCharToMultiByte
WriteFile
WaitForSingleObject
CreateMutexW
CloseHandle
CreateFileW
ReadFile
GetModuleHandleW
GetFileSize
HeapReAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ReleaseMutex

msvcrt

_wcsnicmp
memset
memcpy
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__getmainargs
_getmbcp
_iob
_vsnwprintf
fprintf
_wsplitpath_s
wcschr
_initterm
_wcsicmp
_wtof
floor

user32

LoadStringW

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 560KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b02c6488b00ce1620374c5cc5e463607

Headers

DLL Characteristics

File Characteristics

Imports

loadperf

shell32

advapi32

kernel32

msvcrt

user32

ntdll

Sections

.text Size: 43KB - Virtual size: 42KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 768B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 560KB - Virtual size: 1.9MB

.text
Size: 43KB - Virtual size: 42KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 768B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 560KB - Virtual size: 1.9MB