6c257c7ae910cb78c4a446cb01d9935851eb3e959812da5278a5f3e378c6c341

Sharing

Copy URL Twitter E-mail

General

Target

6c257c7ae910cb78c4a446cb01d9935851eb3e959812da5278a5f3e378c6c341
Size

240KB
MD5

3bcf3720c2e7e2d97c6d9933424d00e4
SHA1

37286cd370a8162a91b8d409c33dbd8568725a5a
SHA256

6c257c7ae910cb78c4a446cb01d9935851eb3e959812da5278a5f3e378c6c341
SHA512

3a4bbc36d2dd0d5e499f1b6ad8b7151042b9c059de9f6d29ee8c7d8ea8ca6e5e59926e9b455e7ca1f1bdf3e9620ade5e60f07b53bb78ba600edcbd30da59cd1a
SSDEEP

3072:eZQ4PWyc8Sh+gPUUbrY7Kjv/57E99fk7DiuAwE0ZwY2oyI0qm1KLA3lBtZO8Lowg:ZueH569c7xD1mOIBtZOsBnWt3P

Score

N/A

Malware Config

Signatures

Files

6c257c7ae910cb78c4a446cb01d9935851eb3e959812da5278a5f3e378c6c341
.exe windows x86

9d5455f99797f08bd4c1793879f44b8a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wswitch

ord146
ord61
ord152
ord148
ord139
ord15
ord120
ord87
ord45
ord150
ord142
ord155
ord3
ord29
ord192
ord195
ord117
ord200
ord197
ord196
ord193
ord75
ord144
ord145
ord116
ord76
ord77
ord86

kernel32

GetStartupInfoA
IsBadReadPtr
SetUnhandledExceptionFilter
GetModuleFileNameA
LoadLibraryA
IsBadCodePtr
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
WriteFile
GetEnvironmentStrings
UnhandledExceptionFilter
HeapSize
TerminateProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
RaiseException
ExitProcess
GetVersion
GetModuleHandleA
FreeEnvironmentStringsA
HeapAlloc
DeleteCriticalSection
EnterCriticalSection
CloseHandle
ResumeThread
CreateThread
InterlockedDecrement
SetEvent
HeapDestroy
WaitForSingleObject
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
Sleep
GetCurrentThreadId
GetCommandLineW
FreeLibrary
MultiByteToWideChar
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
InitializeCriticalSection
LeaveCriticalSection
HeapReAlloc
HeapFree
RtlUnwind
LocalFree

advapi32

RegCloseKey

ole32

CoRegisterClassObject
CLSIDFromString
CoCreateInstance
CoUninitialize
CoSuspendClassObjects
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeEx
CoRevokeClassObject
CoResumeClassObjects

ws2_32

WSAGetLastError
WSAStartup

oleaut32

VariantClear
VariantInit
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
LoadRegTypeLi
SysAllocString
SysFreeString
VariantCopy
SetErrorInfo
SysStringLen
VariantChangeType
SysAllocStringLen
CreateErrorInfo
DispCallFunc

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9d5455f99797f08bd4c1793879f44b8a

Headers

File Characteristics

Imports

wswitch

kernel32

advapi32

ole32

ws2_32

oleaut32

Sections

.text Size: 52KB - Virtual size: 52KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 44KB - Virtual size: 44KB

.text Size: 128KB - Virtual size: 128KB

.text
Size: 52KB - Virtual size: 52KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 44KB - Virtual size: 44KB

.text
Size: 128KB - Virtual size: 128KB