d6e5359979890b4c5614cbffe5a226ceb3af99f2ca2b5c5047d0e7d651168410

General

Target

d6e5359979890b4c5614cbffe5a226ceb3af99f2ca2b5c5047d0e7d651168410
Size

516KB
MD5

7a17efa14867bdf219bee60e9e50a300
SHA1

ba6872fe09973e3eb17076bacf8fdb00b0c73aac
SHA256

d6e5359979890b4c5614cbffe5a226ceb3af99f2ca2b5c5047d0e7d651168410
SHA512

0c48587482463f47dd46c048fb8a88c0519df84f1750c1438a2d33258fe02fe9fccca7ad21722acc795aa46e7cf4adaa668623de9f946a74589dd4bcf5979863
SSDEEP

6144:mzAXVE9JFevjNOTSuL72E7J4VjIIxmrVhta/iDDbug2GbqFvhtkI4yC6Iw9ZpsAQ:aA0mNOek7WEJrVhVqvGmDC6bpsA6oZO

Score

N/A

Malware Config

Signatures

Files

d6e5359979890b4c5614cbffe5a226ceb3af99f2ca2b5c5047d0e7d651168410
.exe windows x86

1d602637944f5bc3da7cacae41b82f32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winsta

LogonIdFromWinStationNameW
WinStationReset
WinStationNameFromLogonIdW
WinStationOpenServerW
WinStationQueryInformationW

user32

LoadStringW

kernel32

TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
lstrlenW
GetLastError
SetThreadUILanguage
GetConsoleOutputCP
FreeLibrary
LoadLibraryW
SetLastError
WriteConsoleW
GetFileType
GetStdHandle
MultiByteToWideChar
GetModuleHandleW
FormatMessageW
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
LocalFree
LocalAlloc
GetCommandLineW
GetFileAttributesW
lstrcpynW
FindNextFileW
FindFirstFileW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime

ntdll

_wcslwr
memmove
_wcsnicmp
wcscmp
wcsncpy
wcstol
wcscat
_ultoa
wcschr
wcscpy
wcslen
_snwprintf
iswctype
wcstoul

msvcrt

_cexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
fgetwc
_iob
_wsetlocale
setlocale
fprintf
malloc
free
vfwprintf
vswprintf
fwprintf
_wcsdup
_c_exit
_exit
_XcptFilter
_initterm
exit
__initenv
__getmainargs

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1d602637944f5bc3da7cacae41b82f32

Headers

DLL Characteristics

File Characteristics

Imports

winsta

user32

kernel32

ntdll

msvcrt

Sections

.text Size: 11KB - Virtual size: 10KB

.data Size: 1024B - Virtual size: 5KB

.rsrc Size: 3KB - Virtual size: 3KB

.vmp0 Size: 500KB - Virtual size: 1.6MB

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 1024B - Virtual size: 5KB

.rsrc
Size: 3KB - Virtual size: 3KB

.vmp0
Size: 500KB - Virtual size: 1.6MB