71a6087f898a12864684e773ed9e8aa6b7b116a6ade773490b2173279dc1836c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

71a6087f898a12864684e773ed9e8aa6b7b116a6ade773490b2173279dc1836c
Size

144KB
MD5

41846035f83f42b2f8f6d9109f3cc720
SHA1

41c86e5945668e4a376aaa62a3f254b0bbfb4700
SHA256

71a6087f898a12864684e773ed9e8aa6b7b116a6ade773490b2173279dc1836c
SHA512

90f8b5eae2c932304804421664ab3ce05d8b2b5026dec435e77333d30baba478b42c913bdb031b833ecbfa1b0b5e9a209af3869ed636ab46e0f431212d7389d3
SSDEEP

3072:dBunY8I80IxTHs2qmRlixXaKa0qMW2pVol3IFEyKwLR:zlo/wguJpVopIh

Score

N/A

Malware Config

Signatures

Files

71a6087f898a12864684e773ed9e8aa6b7b116a6ade773490b2173279dc1836c
.exe windows x86

e945e2407d932901e8d817c0a7c39a5c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFiberEx
lstrlen
GetACP
LoadLibraryExA
lstrcmpi
ReadProcessMemory
OpenEventA
RtlZeroMemory
DosPathToSessionPathA
SetLastConsoleEventActive
OpenEventW
ValidateLocale
BeginUpdateResourceA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.brdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE