1f1af6395e7260e80b8290603dab72af82b812f2a6161c3afd37d932436d6648

Sharing

Copy URL Twitter E-mail

General

Target

1f1af6395e7260e80b8290603dab72af82b812f2a6161c3afd37d932436d6648
Size

64KB
MD5

772b750662867f1b1f01759ba1669730
SHA1

03c08f13881d77df40a0014ec619b1d8621a3166
SHA256

1f1af6395e7260e80b8290603dab72af82b812f2a6161c3afd37d932436d6648
SHA512

6d6856e79dc98f0dea3493862dda33834071366ce893d15fae9be295e7153c9713414d3b5417aea5523bec941ab19cb719c80736e42dec1919787a19ab337788
SSDEEP

1536:qNypMXT98WnXCapjPwYTmTLe6T1t8EewayAdjF+7KL:qN1T9vVP1T8x1t88CdQ7KL

Score

N/A

Malware Config

Signatures

Files

1f1af6395e7260e80b8290603dab72af82b812f2a6161c3afd37d932436d6648
.exe windows x86

79279d2cf4bef07b664082b428392225

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

kernel32

WriteConsoleW
GetConsoleOutputCP
HeapFree
GetProcessHeap
GetLastError
GetConsoleScreenBufferInfo
GetFileType
GetStdHandle
SetConsoleTextAttribute
HeapAlloc
LocalFree
WriteFile
FormatMessageW
GetLocaleInfoW
GetModuleHandleW
GetModuleFileNameW
ReadConsoleW
ReadConsoleInputW
MultiByteToWideChar
ReadFile
SetConsoleMode
GetConsoleMode
FindClose
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
FreeLibrary
LoadLibraryW
GetTempPathW
CloseHandle
CreateFileW
SetThreadUILanguage
DeleteFileW
CopyFileW
FileTimeToSystemTime
HeapSetInformation
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

msvcrt

__wgetmainargs
_cexit
_exit
_XcptFilter
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_controlfp
wcsncmp
_vsnwprintf
_wcsicmp
fwprintf
wprintf
_wcslwr
exit
_wtoi
fclose
wcstok
fgetws
_wfopen
memset
_wcsnicmp
wcstod
_ftol2
memcpy
wcsstr
_wsplitpath_s
_wmakepath_s
wcschr
_getmbcp

ole32

StringFromGUID2

user32

LoadStringW
CharToOemW

pdh

PdhRelogW
PdhGetLogFileTypeW
PdhOpenQueryH
PdhGetDataSourceTimeRangeH
PdhCloseLog
PdhBindInputDataSourceW
PdhEnumObjectItemsHW
PdhValidatePathExW
PdhParseCounterPathW
PdhMakeCounterPathW
PdhExpandWildCardPathHW
PdhEnumMachinesHW
PdhEnumObjectsHW
PdhAddCounterW

version

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

rpcrt4

UuidCreate

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kzxaloq
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

79279d2cf4bef07b664082b428392225

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

user32

pdh

version

rpcrt4

Sections

.text Size: 29KB - Virtual size: 29KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 29KB - Virtual size: 30KB

kzxaloq Size: - Virtual size: 4KB

.text
Size: 29KB - Virtual size: 29KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 29KB - Virtual size: 30KB

kzxaloq
Size: - Virtual size: 4KB