0bcd5813d0b268581768372ce5949c607012b101546fc525c1c4c5a7e0ae5677

Sharing

Copy URL

Twitter E-mail

General

Target

0bcd5813d0b268581768372ce5949c607012b101546fc525c1c4c5a7e0ae5677
Size

605KB
MD5

01bb175c5a22873a9ee2cbd560b13270
SHA1

4aea0436af3f44c40bd8e161e613b58bd1f72b48
SHA256

0bcd5813d0b268581768372ce5949c607012b101546fc525c1c4c5a7e0ae5677
SHA512

c38156553b4c0fbb5ab64abfb52231bb652bc9fa55943294005cd24722de1b0f4ef180b1c19c31ae8f67e6d3b1e168190c8b6d6f06163716aefa9979134bba1e
SSDEEP

6144:PV17AEUUoK8fKO8gX5+S5xOV2bRH+icUHGLtJ5oTYOQcaXOnbW58UVtrMEnf0lMD:PcEUjkAv5DdH+UGCYOKXrT9md9QHFb

Score

N/A

Malware Config

Signatures

Files

0bcd5813d0b268581768372ce5949c607012b101546fc525c1c4c5a7e0ae5677
.exe windows x64

49e06356e0fb67c4e4a85f69754c98bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
lstrlenW
GetLongPathNameW
CompareStringW
WaitForSingleObject
CloseHandle
GetLastError
OpenProcess
HeapSetInformation

user32

GetDesktopWindow
PostMessageW
GetClientRect
CharNextW
EnableWindow
SetWindowPos
SetWindowLongPtrW

mfc42u

ord5702
ord4694
ord6812
ord5586
ord5724
ord5663
ord4752
ord1777
ord4365
ord6437
ord5406
ord5245
ord4721
ord5687
ord4368
ord5065
ord5730
ord5711
ord6053
ord3049
ord3243
ord3362
ord4017
ord3231
ord3366
ord3052
ord3166
ord3046
ord4082
ord4083
ord4077
ord3164
ord4371
ord4983
ord4770
ord3916
ord2752
ord2517
ord1498
ord1505
ord5229
ord4789
ord2670
ord2060
ord6814
ord3933
ord5484
ord1736
ord5683
ord2457
ord2140
ord5699
ord4988
ord4771
ord6887
ord1063
ord659
ord4598
ord1584
ord1463
ord2846
ord1404
ord2665
ord4473
ord1040
ord626
ord6328
ord4124
ord5077
ord4557
ord852
ord337
ord1812
ord6813
ord4836
ord2559
ord2515
ord6071
ord4191
ord1388
ord5615
ord2412
ord3468
ord4815
ord5722
ord2399

msvcrt

free
malloc
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
memset
__CxxFrameHandler3

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
EtwTraceMessage
RtlVirtualUnwind

shell32

SHGetFolderPathW
SHGetMalloc
SHGetDesktopFolder
SHGetFolderLocation

shlwapi

PathAddBackslashW
PathCompactPathExW
StrRetToBufW
StrChrW

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 556KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

49e06356e0fb67c4e4a85f69754c98bf

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

mfc42u

msvcrt

ntdll

shell32

shlwapi

Sections

.text Size: 19KB - Virtual size: 18KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 732B

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 556KB - Virtual size: 2.4MB

.text
Size: 19KB - Virtual size: 18KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 732B

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 556KB - Virtual size: 2.4MB