D468D06E83055D9DD7BFB739E963E56F[.]fil | Triage

Sharing

Copy URL Twitter E-mail

General

Target

D468D06E83055D9DD7BFB739E963E56F.fil
Size

11.8MB
MD5

d468d06e83055d9dd7bfb739e963e56f
SHA1

e4fb6c372cfcbf9ac586ebf68bed78b1f8d2d3df
SHA256

963298e6a2684faf7f01a4058c87e9c339e8e4ef05cb853505da164e6bb0eed7
SHA512

f090354b673278c05d44d09ebfc0db3a73e9afe0ae94b167ed8235b159d609487f19cb6e2ff53d1a6493ffcb0d18ccc9409c3284732303aebc0ca3dc5dab03bf
SSDEEP

98304:bszGyvsMHFutqim/ZozGsqi5X2nZWTP9UTMh2B65nUVXAsHpP72IO0rNhTrj9pgZ:wotqn/Z7EGxbIIOENDpXjTLjPOT

Score

N/A

Malware Config

Signatures

Files

D468D06E83055D9DD7BFB739E963E56F.fil
.exe windows x86

fc9ae8768553a9930f55be6801914203

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleA
SetLastError
VirtualProtect
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
ExitProcess
FormatMessageA
GetCurrentProcess
SetEnvironmentVariableW
CloseHandle
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW
OutputDebugStringW
GetFileAttributesW

user32

wsprintfW
MessageBoxA

ntdll

NtProtectVirtualMemory
NtClose
LdrLoadDll
RtlInitUnicodeString
NtMapViewOfSection
NtCreateSection
LdrGetProcedureAddress
NtUnmapViewOfSection

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ