30370e97a42d4e1da0e12e4423bc92fc6881fcd78695dee6efb8ce10651aa954

Sharing

Copy URL Twitter E-mail

General

Target

30370e97a42d4e1da0e12e4423bc92fc6881fcd78695dee6efb8ce10651aa954
Size

1.3MB
MD5

250bbab971e63f1c0316fd599a096f76
SHA1

770133e77c12d4be2550b01eab9ab088df4a35a4
SHA256

30370e97a42d4e1da0e12e4423bc92fc6881fcd78695dee6efb8ce10651aa954
SHA512

d0aef3663fdb210c5ec298794064292b782b61431ec07492e75be01cb87f8643818b7a8c6542cb4e1df5308c304ee3afae4f2bf0071afb1a21431fa8c5d904eb
SSDEEP

24576:thwT29ItWMqJyeE4BVjsS8c9Wn+rhoeFD+yqjb0yOSTJc:YelvVVHCcejbpTJc

Score

N/A

Malware Config

Signatures

Files

30370e97a42d4e1da0e12e4423bc92fc6881fcd78695dee6efb8ce10651aa954
.exe windows x86

b25d40be15415ddecf6ddbd82e2b512d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
GetFileInformationByHandle
FileTimeToLocalFileTime
CloseHandle
GetProcAddress
GetLastError
GetFileAttributesA
LoadLibraryW
FreeLibrary
CreateFileA
FileTimeToDosDateTime
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
WaitForMultipleObjects
CreateEventW
SetUnhandledExceptionFilter
DeviceIoControl
CreateFileW
GetCurrentProcessId
GetVersionExW
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
GetFileType
GetStdHandle
MultiByteToWideChar
GetModuleHandleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetLastError
GetCurrentProcess
CreateProcessW
OutputDebugStringW
GlobalMemoryStatus

ntdll

ZwDelayExecution
RtlCreateUserThread
LdrShutdownThread
CsrClientCallServer
NtTerminateThread
NtResumeThread
RtlxUnicodeStringToOemSize
NlsMbOemCodePageTag
RtlxUnicodeStringToAnsiSize
RtlOemStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlxOemStringToUnicodeSize
RtlUnicodeStringToOemString
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlUpcaseUnicodeString
isdigit
isspace
strncmp
RtlAllocateHeap
RtlFreeHeap
LdrLoadDll
LdrGetProcedureAddress
RtlInitAnsiString
RtlInitUnicodeString
LdrUnloadDll
_stricmp
memmove
RtlCreateUnicodeString
memset
memcpy
_allmul
_aullshr
_aulldiv
_allrem
_chkstk
_aullrem
LdrGetDllHandle

msvcr90

free
malloc
realloc
strchr
raise
__iob_func
_exit
wcsstr
_vsnwprintf
vfprintf
memchr
qsort
strcmp
_time64
isxdigit
atoi
sscanf
tolower
isupper
strncpy
strtoul
_gmtime64
swprintf_s
_invoke_watson
_set_invalid_parameter_handler
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
__CxxFrameHandler3
_amsg_exit
__getmainargs
_cexit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
modf
??2@YAPAXI@Z
_close
_write
_lseek
_sopen_s
strcpy_s
_read
remove
_errno
sprintf_s
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_CxxThrowException

user32

MsgWaitForMultipleObjectsEx
GetProcessWindowStation
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
MsgWaitForMultipleObjects

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
CreateRestrictedToken
CreateProcessAsUserW

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 933KB - Virtual size: 933KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.xrdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b25d40be15415ddecf6ddbd82e2b512d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

msvcr90

user32

advapi32

Exports

Exports

Sections

.text Size: 933KB - Virtual size: 933KB

.rdata Size: 213KB - Virtual size: 213KB

.data Size: 11KB - Virtual size: 32KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 69KB - Virtual size: 68KB

.xrdata Size: 68KB - Virtual size: 68KB

.text
Size: 933KB - Virtual size: 933KB

.rdata
Size: 213KB - Virtual size: 213KB

.data
Size: 11KB - Virtual size: 32KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 69KB - Virtual size: 68KB

.xrdata
Size: 68KB - Virtual size: 68KB