4cbd583e7c11de68bc7c0f085545cd9ea153bb066f6f322b43b70da416aac71b

Sharing

Copy URL

Twitter E-mail

General

Target

4cbd583e7c11de68bc7c0f085545cd9ea153bb066f6f322b43b70da416aac71b
Size

263KB
MD5

6afdb2e82e0c3c0e54e77939d02e5040
SHA1

f6eeb646853bbfcb11797178842bcd09cc0caae8
SHA256

4cbd583e7c11de68bc7c0f085545cd9ea153bb066f6f322b43b70da416aac71b
SHA512

d571942ba697b6ec8879b83d1b5197959070a180ee8726d098532560d7f2a85b1a13be93325def75d64feb00da0f72a50681378215f0f2fca9c6db8752e6cc77
SSDEEP

6144:rYFx/kjh3saf4BHKKua57c2xWIwG2v2A6oQ3Lky9IV8v9:r7jxUHKCdKIwG+EbkzGv9

Score

N/A

Malware Config

Signatures

Files

4cbd583e7c11de68bc7c0f085545cd9ea153bb066f6f322b43b70da416aac71b
.exe windows x64

ea351dbd127d10e9e3b7a74d92e3ae28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

kernel32

GetCommandLineW
GetCPInfo
SetThreadUILanguage
ReadConsoleW
WriteFile
WideCharToMultiByte
LoadLibraryW
GetConsoleMode
FormatMessageW
GetTimeFormatW
WriteConsoleW
MultiByteToWideChar
GetConsoleOutputCP
GetStdHandle
GetLastError
GetThreadLocale
GetFileType
HeapSetInformation
LocalFree
GetSystemTime
ExpandEnvironmentStringsW
GetProfileStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
UnhandledExceptionFilter
GetProfileIntA
LocalAlloc
LoadLibraryExW
FreeLibrary
TerminateProcess

msvcrt

wcscpy_s
__getmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_stricmp
??3@YAXPEAX@Z
memset
_itoa_s
strspn
strcpy_s
sscanf
exit
wcstok
_wcsupr
_iob
_vsnwprintf
strpbrk
wcsrchr
fgets
strchr
malloc
free
wcstoul
_wcsicmp
wcschr
strcat_s

ntdll

WinSqmIsOptedIn
RtlCaptureContext
WinSqmAddToStream
RtlLookupFunctionEntry
RtlVirtualUnwind

netutils

NetApiBufferFree

schedcli

NetScheduleJobEnum
NetScheduleJobDel
NetScheduleJobGetInfo
NetScheduleJobAdd

shell32

CommandLineToArgvW

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 236KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea351dbd127d10e9e3b7a74d92e3ae28

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

netutils

schedcli

shell32

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 3KB - Virtual size: 9KB

.pdata Size: 1024B - Virtual size: 576B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 236KB - Virtual size: 460KB

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 3KB - Virtual size: 9KB

.pdata
Size: 1024B - Virtual size: 576B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 236KB - Virtual size: 460KB