01cb868e1ba11c9a359e8204065c8040064e21f5d60d0a41cb9cb9c243b5973f

Sharing

Copy URL

Twitter E-mail

General

Target

01cb868e1ba11c9a359e8204065c8040064e21f5d60d0a41cb9cb9c243b5973f
Size

18KB
MD5

73b66fdfa5625f09d073f959f02de680
SHA1

7940cb48aab9746238bb9b66f4b4afc957112064
SHA256

01cb868e1ba11c9a359e8204065c8040064e21f5d60d0a41cb9cb9c243b5973f
SHA512

03d3f58bb7869d87fe1cb0452472a82d71d02641e958eed7d2035db9f326b8e491a3c88947f07018866bdd708e18e3ec98c408c9407f55e47e9578d6fe2ebdbb
SSDEEP

384:VDV0VyBaxHEUbXtO3uxbWAW1+fmhQOAidEEpjW+6sUWm:dV0VyBgTMEJW1+fma3i7Z

Score

N/A

Malware Config

Signatures

Files

01cb868e1ba11c9a359e8204065c8040064e21f5d60d0a41cb9cb9c243b5973f
.dll windows x86

6812878a4ae8b61f7f58c2237a4d262d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsnicmp
wcsstr
memcpy
wcsrchr
wcschr
_XcptFilter
malloc
_except_handler4_common
_vsnwprintf
_amsg_exit
_initterm
free

ntdll

NtOpenEvent
NtClose
RtlAppendUnicodeToString
NtOpenSection
NtSetEvent
RtlInitUnicodeString
NtMapViewOfSection

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-file-l1-1-0

QueryDosDeviceW
DefineDosDeviceW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree

api-ms-win-core-interlocked-l1-1-0

InterlockedExchange
InterlockedCompareExchange

api-ms-win-core-libraryloader-l1-1-0

DisableThreadLibraryCalls

api-ms-win-core-localregistry-l1-1-0

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

api-ms-win-core-misc-l1-1-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

winsta

WinStationIsSessionRemoteable

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6812878a4ae8b61f7f58c2237a4d262d

Headers

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

winsta

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 492B

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 492B