0bf91bbbf50a5429cd52c038fdf6fc6f32bda5fd3b055907e158ed4a11e57fad

Sharing

Copy URL Twitter E-mail

General

Target

0bf91bbbf50a5429cd52c038fdf6fc6f32bda5fd3b055907e158ed4a11e57fad
Size

124KB
MD5

4eeace0ffc98bd6b486bc984af15c5b0
SHA1

3939f269a27977c437a0db5aba37e20a4936f8c8
SHA256

0bf91bbbf50a5429cd52c038fdf6fc6f32bda5fd3b055907e158ed4a11e57fad
SHA512

e38ba0071f17a6db3929428b5daebcc3ed6c056e4519f2dfe3fa0a66d5657141a30a412c8eebdf7c741e7764d266fbfd07a7af2cf3ae55595bac8cc6cda3c671
SSDEEP

3072:bJnXxbUyOlvOhr2nLocDJQM3b6qxz5dkcu44s01zj:bJnhoyONOhanPJ1r75dkVrJ

Score

N/A

Malware Config

Signatures

Files

0bf91bbbf50a5429cd52c038fdf6fc6f32bda5fd3b055907e158ed4a11e57fad
.dll windows x86

7a1bc2a6cb0de576148995b93784d471

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
SetLastError
lstrlenA
MapViewOfFile
CreateFileMappingA
QueryPerformanceFrequency
WideCharToMultiByte
MultiByteToWideChar
CreateEventA
InterlockedIncrement
SetEvent
InterlockedDecrement
ResetEvent
FormatMessageA
GetSystemDefaultLCID
LocalAlloc
LocalFree
GetLastError
LoadLibraryExA
FreeLibrary
GetLocalTime
ExpandEnvironmentStringsA
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateMutexA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
FlushViewOfFile
UnmapViewOfFile
HeapFree
SetHandleCount
HeapAlloc
RtlUnwind
DeleteCriticalSection
GetTimeZoneInformation
GetSystemTime
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
VirtualAlloc
HeapReAlloc
WriteFile
FlushFileBuffers
SetFilePointer
ReadFile
GetStringTypeA
GetStringTypeW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetEnvironmentVariableA
DeleteFileA
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
SetStdHandle
CreateFileA
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetEndOfFile
CompareStringA
CompareStringW

user32

wsprintfA
GetKeyboardType

advapi32

RegCreateKeyExA
RegSetValueExA
ClearEventLogA
ReadEventLogA
GetOldestEventLogRecord
GetNumberOfEventLogRecords
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCloseKey
RegEnumKeyA
ReportEventA
CloseEventLog
OpenEventLogA
DeregisterEventSource
RegisterEventSourceA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Exports

Exports

DumpData
DumpDataAsAnsi
DumpDataPrint1
DumpDataPrint2
DumpDataPrintToBuffer
DumpDataPrintToBufferAsAnsi
FgwAnsiCharToUnicodeChar
FgwEventLog_clear
FgwEventLog_close
FgwEventLog_deregister
FgwEventLog_formatMessage
FgwEventLog_getManageStruct
FgwEventLog_getRecordByIndex
FgwEventLog_loadLibraryForMessage
FgwEventLog_lockunlock
FgwEventLog_open
FgwEventLog_openRegistryByName
FgwEventLog_register
FgwEventLog_report
FgwGen_checkEndian
FgwGen_convertSystemDwordToNetDword
FgwGen_createAllAccessSecurityAttributes
FgwGen_destroySecurityAttributes
FgwGen_getInstalledPath
FgwLptstrToAnsiString
FgwPerform_calculate
FgwPerform_init
FgwPlatformInfo_getPlatformId
FgwPlatformInfo_isNECPC98
FgwProfile_readDword
FgwProfile_readExpandString
FgwProfile_writeDword
FgwProfile_writeExpandString
FgwProfile_writeString
FgwRingFile_clear
FgwRingFile_close
FgwRingFile_create
FgwRingFile_get
FgwRingFile_getCurrentHeader
FgwRingFile_open
FgwRingFile_put
FgwShmem_delete
FgwShmem_flush
FgwShmem_getName
FgwShmem_lock
FgwShmem_new
FgwShmem_unlock
FgwStringToNumeric
FgwStringToXfrData
FgwSyncMonitor_delete
FgwSyncMonitor_enter
FgwSyncMonitor_exit
FgwSyncMonitor_new
FgwSyncReaderWriter_delete
FgwSyncReaderWriter_lockRead
FgwSyncReaderWriter_lockWrite
FgwSyncReaderWriter_new
FgwSyncReaderWriter_unlockRead
FgwSyncReaderWriter_unlockWrite
FgwSync_delete
FgwSync_exitExclusiveApplication
FgwSync_new
FgwSync_startExclusiveApplication
FgwVersionCompatible_get
FgwVersionCompatible_set
VarData_add
VarData_add_char
VarData_add_nstring
VarData_changebias
VarData_clear
VarData_delete
VarData_new

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7a1bc2a6cb0de576148995b93784d471

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

.rmnet
Size: 60KB - Virtual size: 60KB