e9669a90521fb0a4d0317d2a53fa84cd48b0b3d03e755765c42f8881ba471204

Sharing

Copy URL Twitter E-mail

General

Target

e9669a90521fb0a4d0317d2a53fa84cd48b0b3d03e755765c42f8881ba471204
Size

71KB
MD5

4f9342888cadf7fc445a3dc2f58fe9d0
SHA1

8d9c5fbe5d688abae19f6a6fc92d80d89ca5567a
SHA256

e9669a90521fb0a4d0317d2a53fa84cd48b0b3d03e755765c42f8881ba471204
SHA512

af0a56da8b08d67432dfa10b2e212136c047176d824c27df4a95ef653f235d9dbd0daf87305898d3c7a4d413c463ec192056080d3a86f586896cc0d2112782ad
SSDEEP

768:6yt8cYfxUdUW/XjMJ2NmyBOIXzxEFkK2q0Eh2XlxnfR2ojplDfFhPkiID5BUF0+:Jdux9MzY2NmmXtEFkK2qKXlVoYGNK0

Score

N/A

Malware Config

Signatures

Files

e9669a90521fb0a4d0317d2a53fa84cd48b0b3d03e755765c42f8881ba471204
.exe windows x86

60be34e383e683f171d6de8956df339c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

sprintf
_write
strchr
_setjmp3
_isatty
clearerr
putchar
longjmp
exit
islower
toupper
_chdrive
isdigit
_errno
_getcwd
tolower
printf
fflush
_mbslen
_mbsnbcnt
_mbsnbcat
fprintf
getenv
_tempnam
tmpnam
vsprintf
vfprintf
_read
clock
_fstat
_fsopen
calloc
_c_exit
_exit
_XcptFilter
_cexit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_chdir
_mbsnbcpy
free
fopen
_unlink
fclose
_mbscmp
_mbscpy
_mbscat
_mbstrlen
_iob
fgets
_mbschr
atoi

advapi32

GetUserNameA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

ReadFile
GetConsoleMode
Sleep
WriteFile
SetConsoleMode
GetProcessHeap
HeapFree
FormatMessageA
SetThreadUILanguage
LocalAlloc
LocalFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetTempPathA
GetTempFileNameA
WaitForMultipleObjects
MoveFileExA
GetFileSizeEx
CreateFileA
CreateEventA
GetOverlappedResult
InterlockedExchange
InterlockedCompareExchange
HeapAlloc
FindFirstFileA
FindNextFileA
IsDBCSLeadByteEx
GetEnvironmentVariableA
CreateProcessA
WaitForSingleObject
CloseHandle
GetLastError
InitializeCriticalSection
GetCurrentDirectoryA
SetConsoleCtrlHandler
EnterCriticalSection
GetFileAttributesA
LeaveCriticalSection

user32

CharNextExA
CharToOemBuffA
OemToCharBuffA

ws2_32

listen
getnameinfo
ntohs
setsockopt
send
accept
select
__WSAFDIsSet
recv
WSAStartup
getservbyname
socket
htonl
bind
WSAGetLastError
getsockname
connect
shutdown
closesocket
htons
gethostname
getaddrinfo
freeaddrinfo
WSARecv

mswsock

TransmitFile
s_perror

shlwapi

PathIsDirectoryA
PathFileExistsA

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

feihwck
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

60be34e383e683f171d6de8956df339c

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

user32

ws2_32

mswsock

shlwapi

Sections

.text Size: 27KB - Virtual size: 27KB

.data Size: 1024B - Virtual size: 20KB

.rsrc Size: 42KB - Virtual size: 43KB

feihwck Size: - Virtual size: 4KB

.text
Size: 27KB - Virtual size: 27KB

.data
Size: 1024B - Virtual size: 20KB

.rsrc
Size: 42KB - Virtual size: 43KB

feihwck
Size: - Virtual size: 4KB