0f2a1994dc4bff7e71c274eae94a56aecf9e1a42a309de8f0f21568e4653e385

Sharing

Copy URL

Twitter E-mail

General

Target

0f2a1994dc4bff7e71c274eae94a56aecf9e1a42a309de8f0f21568e4653e385
Size

97KB
MD5

56c70dfbe52240852fade38829a5946a
SHA1

9252fc3cb78c2e9a04311785c60e70feaa9d4e74
SHA256

0f2a1994dc4bff7e71c274eae94a56aecf9e1a42a309de8f0f21568e4653e385
SHA512

6c6c3a81e9e4325be68ab39776f731b7f54572199de63ba53711f485392260e790f175b288fccade597d551964a6b3d7d38090c06643ee3532dfd3d7fd6b8f89
SSDEEP

1536:rGaxE0APIYlugm5DXa01lfVWpXKphF+hP5kusLuI53I1iODWAlX:rrO0OIjba2VWseP5nsLBZg

Score

N/A

Malware Config

Signatures

Files

0f2a1994dc4bff7e71c274eae94a56aecf9e1a42a309de8f0f21568e4653e385
.exe windows x86

27de2481a002903bf758833d84e47f38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
CreateWellKnownSid
CloseServiceHandle

kernel32

InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
CloseHandle
WaitForSingleObject
Sleep
CreateThread
CreateEventW
GetCurrentThreadId
SetEvent
GetCommandLineW
LocalAlloc
LocalFree
InterlockedCompareExchange
lstrcmpiW
GetVersionExA
WideCharToMultiByte
GetStartupInfoW
HeapAlloc
HeapFree
HeapReAlloc
VirtualProtect
GetLastError
GetProcAddress
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
OutputDebugStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
VirtualAlloc

user32

CharUpperW
PostThreadMessageW
GetMessageW
UnregisterClassA
DispatchMessageW
TranslateMessage
CharNextW

ntdll

RtlUnwind

oleaut32

RegisterTypeLi
SysFreeString
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi

ole32

CoTaskMemFree
CoInitializeEx
CoUninitialize
CoSuspendClassObjects
CoRevokeClassObject
CoRegisterClassObject
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoResumeClassObjects

rpcrt4

RpcStringFreeW
RpcBindingFree
RpcBindingFromStringBindingW
NdrClientCall2
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

27de2481a002903bf758833d84e47f38

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

ntdll

oleaut32

ole32

rpcrt4

Sections

.text Size: 66KB - Virtual size: 65KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 23KB - Virtual size: 26KB

.text
Size: 66KB - Virtual size: 65KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 23KB - Virtual size: 26KB