be2059f44fb75dca4696c893fe5920ae4cfe1dedc938b948ea4ade7a8d5f3ec8

Sharing

Copy URL Twitter E-mail

General

Target

be2059f44fb75dca4696c893fe5920ae4cfe1dedc938b948ea4ade7a8d5f3ec8
Size

35KB
MD5

013ffa12c59e94d063db418343d7fb30
SHA1

2048322869cb6944136e529d3f92a309c670cdaf
SHA256

be2059f44fb75dca4696c893fe5920ae4cfe1dedc938b948ea4ade7a8d5f3ec8
SHA512

84e3ed9e93a2dae63fdd6d591d1c8fd7e5af83ba543a387e23dbc45cbd625b363aaabb209c76cfb4f5179cd7a0c304a2fbcd8fa31de3b98938f52ef6ab394845
SSDEEP

384:NiMgD2l34OgDpENSi2XaLruc+eArf3WZirW7KqtFqUHHyaJr2x8fCjlLMZ+Ri+6h:Nr34O6pENSi2XaGc+eaFvsqUn2LJMwy

Score

N/A

Malware Config

Signatures

Files

be2059f44fb75dca4696c893fe5920ae4cfe1dedc938b948ea4ade7a8d5f3ec8
.dll windows x86

d5ecf342a180feeafda6718737839760

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32First
CreateToolhelp32Snapshot
Sleep
GetModuleFileNameA
CreateThread
WideCharToMultiByte
ReadProcessMemory
LoadLibraryA
GetTempPathA
SetThreadPriority
GetFileSize
ReadFile
CreateFileA
GetProcessHeap
HeapAlloc
VirtualProtect
WriteProcessMemory
GetCurrentProcessId
OpenProcess
GetLastError
EnterCriticalSection
LeaveCriticalSection
IsBadReadPtr
GetProcAddress
InitializeCriticalSection
AddVectoredExceptionHandler
OpenThread
GetThreadContext
SetThreadContext
CloseHandle
Thread32Next
GetCurrentProcess
FlushInstructionCache
VirtualProtectEx
GetModuleHandleA
InterlockedExchange
DeleteCriticalSection

msvcrt

wcsstr
strrchr
strcat
malloc
_except_handler3
_vsnprintf
isspace
isalnum
wcscat
atoi
exit
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
wcslen
wcsncat
wcscpy
free
_strlwr
strstr
mbstowcs
wcscmp
sprintf
strlen
strchr
strncpy
strcpy
_stricmp
memcpy
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler

gdiplus

GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup

gdi32

DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
DeleteObject

wsock32

shutdown
closesocket

user32

wsprintfA
GetForegroundWindow
GetClassNameW
GetWindow

Exports

Exports

DllMoveFile

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5ecf342a180feeafda6718737839760

Headers

File Characteristics

Imports

kernel32

msvcrt

gdiplus

gdi32

wsock32

user32

Exports

Exports

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 3KB - Virtual size: 7KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 7KB

.reloc
Size: 2KB - Virtual size: 2KB