201bd7d0f92f3f2e528e8c7d2d29f761f57c45d484b235a88d7f2990304ee719

Sharing

Copy URL Twitter E-mail

General

Target

201bd7d0f92f3f2e528e8c7d2d29f761f57c45d484b235a88d7f2990304ee719
Size

125KB
MD5

799857375f3d67312f61df1688438ac0
SHA1

0f5e5287ed435bd1c12299643bc85d811eeac6e7
SHA256

201bd7d0f92f3f2e528e8c7d2d29f761f57c45d484b235a88d7f2990304ee719
SHA512

06ac3afa85c126cd3559862f552279b5c17d85deb491927b8e97e2447c0d6f593501fb9e8a733040cf59c6ed1fbe5b0d87a9f8df67e791e4a774db646dacf877
SSDEEP

3072:h3K14oZled9HQNIiqN1eIs4Y7cNc8Qsq+nQGdiY8qJxGHmL55B:5+gd9niqaIfNc8Qsq+QfUxGOJ

Score

N/A

Malware Config

Signatures

Files

201bd7d0f92f3f2e528e8c7d2d29f761f57c45d484b235a88d7f2990304ee719
.exe windows x86

78682f9c7d949b907e46c7e3d9501d98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_stricmp
_strnicmp
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
realloc
memmove
atoi
islower
isdigit
modf
_environ
_wenviron
strncmp
fprintf
__iob_func
strerror
wcsncmp
isalpha
wcschr
_errno
_strtoi64
_close
memcpy
malloc
free
signal
memset
strrchr
strchr
exit
_getpid

wsock32

shutdown
socket
WSAGetLastError
ioctlsocket
closesocket
getsockname
listen
connect
send
inet_ntoa
select
accept
recv
ntohl
__WSAFDIsSet
WSAStartup
WSACleanup
bind

kernel32

GetCurrentThreadId
LoadLibraryA
GetProcAddress
GetVersionExA
SetEvent
ReleaseMutex
GetCommandLineW
GlobalFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsFree
TlsAlloc
SetCurrentDirectoryW
GetCurrentDirectoryW
GetCurrentProcessId
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
FormatMessageA
GetFileAttributesExW
GetFullPathNameW
GetFileType
LocalFree
RemoveDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetStdHandle
DeleteFileW
CreateFileW
CloseHandle
SetStdHandle
GetFileInformationByHandle
DeviceIoControl
Sleep
LockFile
LockFileEx
UnlockFile
UnlockFileEx
TerminateProcess
InterlockedExchange
DeleteCriticalSection
SetFilePointer
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetOverlappedResult
CancelIo
WaitForSingleObject
ReadFile
GetLastError
PeekNamedPipe
WriteFile
CreateEventA
GetSystemTimeAsFileTime
SetLastError
InterlockedCompareExchange

advapi32

FreeSid
AllocateAndInitializeSid
GetSecurityInfo
GetNamedSecurityInfoA
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW

shell32

CommandLineToArgvW

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

78682f9c7d949b907e46c7e3d9501d98

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

wsock32

kernel32

advapi32

shell32

Sections

.text Size: 42KB - Virtual size: 41KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 71KB - Virtual size: 72KB

.text
Size: 42KB - Virtual size: 41KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 71KB - Virtual size: 72KB