0ad89971b0bbb5fcc5361f541ca8c8fee72243ac0b1c6ff94e1ceb9e2d5b6c1d

Sharing

Copy URL Twitter E-mail

General

Target

0ad89971b0bbb5fcc5361f541ca8c8fee72243ac0b1c6ff94e1ceb9e2d5b6c1d
Size

32KB
MD5

7b6e57b3b5be056857d70cf08efa3da1
SHA1

9fb7ee1763f0d3d92aa831ab6572ab4c14b7ac64
SHA256

0ad89971b0bbb5fcc5361f541ca8c8fee72243ac0b1c6ff94e1ceb9e2d5b6c1d
SHA512

d0335e05caf111b4c006f5d6aa979cc5029cc9e8426343c9e4a167bb45e1033d15fae7c28e1932fabeb8be8a3470d25e88487d6715ede5d9a7cd0ce975749e2c
SSDEEP

768:ByPeUmAsOQgN+S1S1SSlMFxyVqOT52gXb7lH:B2BsIN+S1S1SSlMFQrT8gL7lH

Score

N/A

Malware Config

Signatures

Files

0ad89971b0bbb5fcc5361f541ca8c8fee72243ac0b1c6ff94e1ceb9e2d5b6c1d
.exe windows x86

f2833b47605c7cb8d3777fb485b2b7fb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
VirtualProtect
TryEnterCriticalSection
SetConsoleOutputCP
SetConsoleCursorInfo
RemoveLocalAlternateComputerNameA
PulseEvent
LockFileEx
GetStringTypeExA
GetPrivateProfileIntW
FatalAppExitW
EnumCalendarInfoW
CreateProcessW
WriteConsoleOutputCharacterA
CreatePipe

msvcrt

_getdcwd
mbstowcs
_nextafter
wcscat
_wutime
exp
_strerror
fscanf
qsort
_ismbcalpha
_ultow
_CIlog
fclose

user32

GetScrollRange
InvalidateRect
DdeImpersonateClient

advapi32

GetSecurityDescriptorRMControl
CredWriteDomainCredentialsW
DecryptFileA
DeleteAce
ElfOpenBackupEventLogA
SetSecurityInfo
RegReplaceKeyA
RegGetKeySecurity
GetSecurityInfoExA
BuildTrusteeWithNameA
GetSecurityDescriptorDacl
GetLengthSid
FlushTraceW
ElfReadEventLogW
ElfReadEventLogA

ole32

GetConvertStg
DllGetClassObjectWOW
CreateILockBytesOnHGlobal
CoReleaseServerProcess
HACCEL_UserUnmarshal
UpdateDCOMSettings
OleSetClipboard
OleDestroyMenuDescriptor
OleCreateStaticFromData
OleCreateFromDataEx
IsValidIid
CreateOleAdviseHolder
HICON_UserFree
WriteClassStm

ntdll

RtlAbortRXact
ZwAreMappedFilesTheSame

rpcrt4

NdrClientContextUnmarshall
NdrRpcSmClientAllocate
NdrConformantVaryingStructFree
NdrByteCountPointerBufferSize
I_RpcRequestMutex
I_RpcBindingInqDynamicEndpointA
CStdStubBuffer_CountRefs
RpcErrorResetEnumeration

shell32

ord191
ord77
ord179
ord645
SHBindToParent
ord47
ord171
RealShellExecuteExA
ord152
DragQueryFileW
ShellExecuteExA

comctl32

DrawStatusTextW
ord324
ord338
ord17
FlatSB_GetScrollPos
FlatSB_SetScrollRange
ImageList_Copy
ImageList_Create
ImageList_DrawEx
ImageList_SetFlags
ImageList_SetOverlayImage
CreatePropertySheetPage

shlwapi

StrNCatA
StrIsIntlEqualA
HashData
PathCompactPathW
PathIsPrefixA
SHRegQueryInfoUSKeyW
SHCreateStreamOnFileW
ord16
SHOpenRegStream2A
SHRegGetValueA
UrlGetLocationA
StrTrimW
StrRetToBufW

gdi32

AnimatePalette
Chord
CreateBitmap
CreateFontA
CreateICA
CreateMetaFileW
ExtFloodFill
ExtTextOutA
GetBkColor
SaveDC
UnrealizeObject

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2833b47605c7cb8d3777fb485b2b7fb

Headers

File Characteristics

Imports

kernel32

msvcrt

user32

advapi32

ole32

ntdll

rpcrt4

shell32

comctl32

shlwapi

gdi32

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 1000B

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 1000B