cf488e5013dbf6a4871f930b96eac7ece2d5c74a19fb6583c88fab8bcd720afc

Sharing

Copy URL Twitter E-mail

General

Target

cf488e5013dbf6a4871f930b96eac7ece2d5c74a19fb6583c88fab8bcd720afc
Size

247KB
MD5

628f0cf2826350ffc2a7c01d7f4dce10
SHA1

95b628085e5eb2dfbe86d487a097a53b42b51aa3
SHA256

cf488e5013dbf6a4871f930b96eac7ece2d5c74a19fb6583c88fab8bcd720afc
SHA512

caf96ff112a4ac0fdb618f637c9c626c661cc19f6851dde112c6fcb611accd9ec6ae4df4f2affc4b3572731740a075a3abe8fd4901708b3acf924ad175d48b1c
SSDEEP

6144:4cbX4/yWYDMsEB/dy5kFZ0b7ZtSjOyuqI7QetT8WpBCWZxG2:FX8yWYDMsEB/dyyFZivSSLC49xG

Score

N/A

Malware Config

Signatures

Files

cf488e5013dbf6a4871f930b96eac7ece2d5c74a19fb6583c88fab8bcd720afc
.dll windows x86

d9569d068354ef902b0e5751bf3e96e3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
GetVersionExA
GetLastError
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryA

user32

CreateWindowExA
RegisterClassA
wsprintfA
DestroyWindow
PostQuitMessage
DispatchMessageA
PeekMessageA
UnregisterClassA
PostMessageA
SendMessageA
RegisterWindowMessageA
DefWindowProcA
SetWindowLongA
SendMessageTimeoutA
GetWindowLongA

msvcr90

sprintf
strrchr
tolower
isupper
memmove
_vsnprintf
_purecall
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
isdigit
strncpy
atoi
strtol
strtoul
memset
??_V@YAXPAX@Z
??_U@YAPAXI@Z
memcpy
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
_stricmp
_time32
sscanf
_unlock
atol
_putenv

Exports

Exports

CanUnload2
RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 76KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d9569d068354ef902b0e5751bf3e96e3

Headers

File Characteristics

Imports

kernel32

user32

msvcr90

Exports

Exports

Sections

.text Size: 122KB - Virtual size: 122KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 5KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 10KB

.rmnet Size: 76KB - Virtual size: 80KB

.text
Size: 122KB - Virtual size: 122KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 5KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB

.rmnet
Size: 76KB - Virtual size: 80KB