9c51593d49e01d6d828472057f8120dc6b0a99f273128204b9d233aab19acf15

Sharing

Copy URL Twitter E-mail

General

Target

9c51593d49e01d6d828472057f8120dc6b0a99f273128204b9d233aab19acf15
Size

585KB
MD5

79f8afe30463a126f011f37dcbe78900
SHA1

9ff330b464a70d49645e1d48c343cb6f9e3ec7b5
SHA256

9c51593d49e01d6d828472057f8120dc6b0a99f273128204b9d233aab19acf15
SHA512

4175941d4e3efc59cce6cab7e7622eb3021d95fe618ffcdf293136a35b612794cdd5bfa47aa9a58f82b18987098fa08318b4a7a5a822cc434c465192e896a80d
SSDEEP

12288:enH/HSAgPq4Uo9Do6fJe0sLX5PMtfg8/PvyGYIFznlRiCLCtg3AqYws8KERoTLFu:efHSAgPq4PFhsLX5BXDqYb8ITx

Score

N/A

Malware Config

Signatures

Files

9c51593d49e01d6d828472057f8120dc6b0a99f273128204b9d233aab19acf15
.exe windows x64

ffc6eebe492057f0ad89da0c93ccaf02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

kernel32

DelayLoadFailureHook
LoadLibraryExA
CloseHandle
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
LeaveCriticalSection
SetThreadpoolWait
CreateThreadpoolWait
WaitForSingleObject
EnterCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
DeleteCriticalSection
InitializeCriticalSection
CompareStringW
GetCurrentProcess
HeapSetInformation
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OpenProcess
K32GetModuleFileNameExW
OpenThread
GetThreadContext
RtlCompareMemory
DuplicateHandle
GetThreadPriority
GetCurrentThread
SetThreadPriority
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OutputDebugStringA
SetErrorMode
GetLastError
SetEnvironmentVariableW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

msvcrt

_wtoi
_wtoi64
_wcsicmp
_vsnprintf
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memset
__CxxFrameHandler3
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_vsnwprintf

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ShipAssert
NtQueryInformationProcess
EtwTraceMessage
DbgPrint

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 560KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ffc6eebe492057f0ad89da0c93ccaf02

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

faultrep

Sections

.text Size: 21KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 768B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 560KB - Virtual size: 2.5MB

.text
Size: 21KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 768B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 560KB - Virtual size: 2.5MB