b237512ad307a5800da29add1e78fcdeb0b7763a2019f89b33a14d43c762187c

Sharing

Copy URL Twitter E-mail

General

Target

b237512ad307a5800da29add1e78fcdeb0b7763a2019f89b33a14d43c762187c
Size

872KB
MD5

473223ea5dcaa3b2a93ec4371d332830
SHA1

bb687f0fb9b0f2ea4c282029d6326d16f1014077
SHA256

b237512ad307a5800da29add1e78fcdeb0b7763a2019f89b33a14d43c762187c
SHA512

32e1758e1a86ef8560b7e820dc5bad6cd5d17427434af36e7af33616619d5626bc55b125ff1a1108e61ebbe9abb91a3e5e32811c394a562b05417a0cb9f2e8c5
SSDEEP

12288:bEerclzRCayeopvGNzM6s4D8e8FIBK86dNvMXfAo9xALO6WCvuPPTP6s1E5HaqZz:bENDitCPPr66EZdMPCZeX5PYUnw74

Score

N/A

Malware Config

Signatures

Files

b237512ad307a5800da29add1e78fcdeb0b7763a2019f89b33a14d43c762187c
.exe windows x86

dcdd642290ef7ddb3b5d95966881c025

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegCreateKeyExW
GetTokenInformation
OpenProcessToken
CreateProcessAsUserW
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
DuplicateTokenEx

kernel32

GetLastError
VerifyVersionInfoW
VerSetConditionMask
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
GetCurrentProcess
GetUserGeoID
GetExitCodeProcess
WaitForSingleObject
LocalFree
GetModuleHandleW
lstrcmpA
GetModuleFileNameW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange

user32

LoadStringW

msvcrt

_controlfp
_vsnwprintf
memset
??3@YAXPAX@Z
wcschr
_wcsnicmp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_wtoi
??2@YAPAXI@Z

ole32

CoUninitialize
CoTaskMemFree
CoCreateInstance
CoInitializeEx

ntdll

RtlUnwind

shell32

ord723
SHGetFolderPathW
ord155
ord190
ShellExecuteW
SHBindToParent

shlwapi

PathCombineW
PathAddExtensionW
ord158
SHRegGetBoolUSValueW
SHRegGetUSValueW
SHDeleteValueW
PathFindFileNameW
ord176
SHRegSetUSValueW
SHSetValueW

wininet

InternetGetCookieW
InternetSetCookieW

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 269KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 588KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dcdd642290ef7ddb3b5d95966881c025

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

ntdll

shell32

shlwapi

wininet

oleaut32

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 269KB - Virtual size: 272KB

.reloc Size: 588KB - Virtual size: 2.4MB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 269KB - Virtual size: 272KB

.reloc
Size: 588KB - Virtual size: 2.4MB