b620e36b43181cc7759e16ef34dbdbc1cf9ccd00ec57d2e95934034dbd14fa19

Sharing

Copy URL

Twitter E-mail

General

Target

b620e36b43181cc7759e16ef34dbdbc1cf9ccd00ec57d2e95934034dbd14fa19
Size

609KB
MD5

60404da21a737ded92c5bf41c60926b0
SHA1

d252d04c4756a5bc92edfb822052ba7d0e24985a
SHA256

b620e36b43181cc7759e16ef34dbdbc1cf9ccd00ec57d2e95934034dbd14fa19
SHA512

a2c3520087eba3d97a62aa2bc9ea26106f08d36fb5b9339b0146b8e9c15963ac8d35916746935d969660cb69841309311e7bf1e1881515ef115fd63762922996
SSDEEP

12288:zMNn67aQEwhT94OGIAoIFOTDO6qfHlvcAkZnZ9PQLrNOr:ANnHSObTo46DxqfFvxkZnILpO

Score

N/A

Malware Config

Signatures

Files

b620e36b43181cc7759e16ef34dbdbc1cf9ccd00ec57d2e95934034dbd14fa19
.exe windows x64

b7fa4abb68ef3572d98591c0ac1496c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetSystemTimeAsFileTime
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FreeLibrary
EncodeSystemPointer
LoadLibraryW
GetLastError
GetProcAddress
GetModuleFileNameW
CloseHandle
SetCurrentDirectoryW
RaiseException
QueryPerformanceCounter
Sleep

msvcrt

?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
??2@YAPEAX_K@Z
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
??3@YAXPEAX@Z
__set_app_type
??_U@YAPEAX_K@Z
free
malloc
??_V@YAXPEAX@Z
memset

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

shlwapi

PathRemoveFileSpecW

mscoree

CorBindToCurrentRuntime

advapi32

IsValidSid
CreateWellKnownSid
GetSecurityDescriptorDacl
GetLengthSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorOwner
InitializeAcl
LookupAccountSidW
GetAce
SetSecurityDescriptorDacl
LookupAccountNameW
InitializeSecurityDescriptor
CopySid
GetAclInformation
GetTokenInformation
SetSecurityDescriptorGroup
OpenProcessToken

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b7fa4abb68ef3572d98591c0ac1496c6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ole32

oleaut32

shlwapi

mscoree

advapi32

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 540B

.rsrc Size: 86KB - Virtual size: 85KB

.reloc Size: 512B - Virtual size: 20B

.vmp0 Size: 508KB - Virtual size: 1.8MB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 540B

.rsrc
Size: 86KB - Virtual size: 85KB

.reloc
Size: 512B - Virtual size: 20B

.vmp0
Size: 508KB - Virtual size: 1.8MB