d6625773005fb6485c414a2cf885d1afb736119e7d7e322e68f0ce8820cb34d0

Sharing

Copy URL

Twitter E-mail

General

Target

d6625773005fb6485c414a2cf885d1afb736119e7d7e322e68f0ce8820cb34d0
Size

129KB
MD5

895f9f0f24c6f2af206205e2cfcf3208
SHA1

14062f188859915573cbe740c24dfb7aa6d2e99f
SHA256

d6625773005fb6485c414a2cf885d1afb736119e7d7e322e68f0ce8820cb34d0
SHA512

040bc8f763589e92f92656da32894b454fee2c73c6695b022d5db3dc194673d8a571bda9bed09ed687c873a3bfc9372939b80e9ecf676021202b8322ad61ee2c
SSDEEP

3072:NpbVxVpL3soQttttL4OwO+ztiMGNZRXt4LplW:nZxVpL3sRttttL4nO+ztiMGFXt4LW

Score

N/A

Malware Config

Signatures

Files

d6625773005fb6485c414a2cf885d1afb736119e7d7e322e68f0ce8820cb34d0
.exe windows x64

b421532314ef8e1c28c3af7fbd5f06cb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OpenProcess
CreateToolhelp32Snapshot
Process32NextW
LoadLibraryA
RtlAddFunctionTable
LoadResource
FindResourceW
GetProcAddress
GetCurrentProcessId
SizeofResource
GetModuleHandleW
GetTempPathW
GetProcessHeap
ExitProcess
GetCurrentDirectoryW
HeapAlloc
CloseHandle
GetLastError
FormatMessageW
GetEnvironmentVariableW
LockResource
HeapFree

user32

GetWindowThreadProcessId
IsWindowVisible
MessageBoxW
SendMessageW
UnhookWindowsHookEx
EnumWindows
FindWindowW
SetWindowsHookExW

advapi32

CryptDestroyKey
CryptReleaseContext
OpenServiceW
ChangeServiceConfigW
StartServiceW
DeleteService
OpenSCManagerW
CloseServiceHandle
CreateServiceW
CryptDecrypt
CryptAcquireContextW
CryptImportKey

shell32

ShellExecuteExW

ntdll

NtDeleteFile
NtMapViewOfSection
NtCreateFile
NtWaitForSingleObject
RtlRandomEx
NtWriteFile
RtlDecompressBuffer
NtCreateSection
NtClose

msvcrt

swprintf_s
_wcstoui64
memcpy

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b421532314ef8e1c28c3af7fbd5f06cb

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ntdll

msvcrt

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 228B

.rsrc Size: 29KB - Virtual size: 28KB

Size: 91KB - Virtual size: 91KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 228B

.rsrc
Size: 29KB - Virtual size: 28KB