d5c38ff1ca06578ed1e2ea68d76c2b9a0c61acc0ebe4f6e1c370395c609eb1b6

Sharing

Copy URL Twitter E-mail

General

Target

d5c38ff1ca06578ed1e2ea68d76c2b9a0c61acc0ebe4f6e1c370395c609eb1b6
Size

734KB
MD5

1298eef51b368e65329c49796f1a2da0
SHA1

48557cbee64c2f2701dfc70f4fe485d44804ae22
SHA256

d5c38ff1ca06578ed1e2ea68d76c2b9a0c61acc0ebe4f6e1c370395c609eb1b6
SHA512

9a6767542a56e2d6e2d5b58dd429e0f5bd9438a52a453627071b09f5715667026b2bd9cdf405d9e761bea74e7aa9ebbc6dd63c87f428d8a73f22131698658271
SSDEEP

12288:a9G6DMzHMMHMMMyMMMZMMMVcR9bzOXmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMP:WGLbMMHMMMvMMZMMMKzb6XmMMMiMMMzd

Score

N/A

Malware Config

Signatures

Files

d5c38ff1ca06578ed1e2ea68d76c2b9a0c61acc0ebe4f6e1c370395c609eb1b6
.exe windows x86

34ab8235aec436c7a4f8e2509bdb2a1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EventWrite
GetTraceEnableFlags
RegQueryValueExW
EventUnregister
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
RegOpenKeyExW
EventRegister
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW

kernel32

Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
TerminateProcess
CreateFileW
lstrlenW
VerifyVersionInfoW
GetLastError
GetProcAddress
LocalAlloc
IsWow64Process
HeapSetInformation
GetFileTime
DeleteCriticalSection
CloseHandle
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
LoadLibraryW
GetModuleHandleW
GetCurrentProcess
VerSetConditionMask
SetDllDirectoryW
CreateProcessW
SetErrorMode
GetCommandLineW
RaiseException
LoadLibraryA
GetSystemDefaultLCID
GetUserDefaultLCID
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersionExA
FreeLibrary
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentDirectoryW
InitializeCriticalSection

user32

IsWindowEnabled
LoadStringW
CharNextW
GetWindowThreadProcessId
SendMessageTimeoutW
FindWindowExW
MessageBoxW
IsWindowVisible
AllowSetForegroundWindow

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
iswalpha
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
wcsncmp
iswspace
_vsnwprintf
memset

shlwapi

ord154
SHGetValueW
SHRegGetValueW
SHSetValueW
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
ord158
PathFindFileNameW
UrlCreateFromPathW
StrStrW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoInitialize

urlmon

ord410
ord111

iertutil

ord32
ord44
ord325
ord9
ord31
ord163
ord650
ord42
ord58

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 693KB - Virtual size: 693KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ngaut
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

34ab8235aec436c7a4f8e2509bdb2a1d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

shell32

ole32

urlmon

iertutil

Sections

.text Size: 26KB - Virtual size: 25KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 693KB - Virtual size: 693KB

.reloc Size: 1KB - Virtual size: 1KB

.ngaut Size: 4KB - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 25KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 693KB - Virtual size: 693KB

.reloc
Size: 1KB - Virtual size: 1KB

.ngaut
Size: 4KB - Virtual size: 4KB