f02881feb172a0ba31ff9de8082107031102c4c0eb7fe8523626495640030bf0

Sharing

Copy URL Twitter E-mail

General

Target

f02881feb172a0ba31ff9de8082107031102c4c0eb7fe8523626495640030bf0
Size

131KB
MD5

a12be6fb3511971c8ccda6681f7db1e3
SHA1

014a49ffb715d52c94efafe19e3cc6a76fcdc3de
SHA256

f02881feb172a0ba31ff9de8082107031102c4c0eb7fe8523626495640030bf0
SHA512

ef7afa57d63d3a40aa616ddde13062c3847fc5262a99bfe3861c1d37fd0a0250f0054b2a49cc42883b435628400ded776b0e44a1ca386d392a58a62e968e0366
SSDEEP

1536:rHvo6ITxgiX8xWKJKUyitlReLOuKkOweUoxhE4q+MYbdnxeDOdQDoKeA:LoDgeoWKYUZfsyuKZweUoDE47fZxe6FA

Score

N/A

Malware Config

Signatures

Files

f02881feb172a0ba31ff9de8082107031102c4c0eb7fe8523626495640030bf0
.exe windows x86

9de09f06b813e6fd43a42af066bd4a44

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

BindMoniker
CreateClassMoniker
OleCreateLinkToFileEx
OleDoAutoConvert
CreateDataAdviseHolder
OleSetAutoConvert
PropVariantCopy
OleCreateLink
OleRegGetMiscStatus
StgIsStorageILockBytes
OleCreateEx
OleSetContainedObject
CoTaskMemRealloc
CoUnmarshalInterface

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
HeapReAlloc
IsBadWritePtr
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
Sleep
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA

secur32

FreeCredentialsHandle
EncryptMessage
MakeSignature

ws2_32

bind
recvfrom
getprotobynumber
gethostname
socket
sendto
accept
htons
ioctlsocket
inet_addr
getprotobyname
connect
getsockopt

ntdsapi

DsReplicaVerifyObjectsW

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9de09f06b813e6fd43a42af066bd4a44

Headers

File Characteristics

Imports

ole32

kernel32

secur32

ws2_32

ntdsapi

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 29KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 53KB - Virtual size: 53KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 29KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 53KB - Virtual size: 53KB