ecfb2c41695ba58f916b4fe0c1a4e0b053ef5468ae5b8e49898175c46529a119

Sharing

Copy URL Twitter E-mail

General

Target

ecfb2c41695ba58f916b4fe0c1a4e0b053ef5468ae5b8e49898175c46529a119
Size

261KB
MD5

a0d3e92bbeaddb4dd235cb040c34e2cd
SHA1

0b273c1791e5477143206aa88171d610c2b52606
SHA256

ecfb2c41695ba58f916b4fe0c1a4e0b053ef5468ae5b8e49898175c46529a119
SHA512

b53ef1d81a3f8b2f64cbadbab85a183804204899d0619bde4161b60df5bc313c8f7ca7719352db06585d87ed39a27ad46200ef1c89652274f3509266cf7ad7c1
SSDEEP

6144:mGFg35ZTXXB404eu65LEf03yKp8U6hlUZOFRKOoaS9:5oLTXx4lH65LE8hmoZUwO6

Score

N/A

Malware Config

Signatures

Files

ecfb2c41695ba58f916b4fe0c1a4e0b053ef5468ae5b8e49898175c46529a119
.exe windows x86

8c47f50de63ea28833787bd4af526cb1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreate

user32

wsprintfA
LoadStringW
CharToOemA
OemToCharA

kernel32

SetFileTime
CancelIo
ReleaseMutex
lstrlenA
DeleteFileA
FindNextFileA
GlobalFindAtomA
GetSystemDefaultLCID
FindFirstFileW
HeapFree
GetPrivateProfileStringW
GlobalAddAtomA
CreateThread
GetDriveTypeA
DeleteCriticalSection
IsDebuggerPresent
GetSystemDirectoryA
ReadFile
SetErrorMode
EnterCriticalSection
HeapAlloc
GetCurrentThreadId
lstrcmpiA
FindFirstFileA
SetFilePointer
GetFileTime
WriteFile
DeviceIoControl
WideCharToMultiByte
CloseHandle
GetProcessHeap
FindClose
GetVolumeInformationA
CreateFileW
WaitForMultipleObjects
SetFileAttributesA
GetSystemInfo
GetACP
CreateFileA
CreateEventA
SetVolumeLabelA
SetLastError
CopyFileW
SetUnhandledExceptionFilter
WaitForSingleObject
GetPrivateProfileStringA
lstrcpyA
FileTimeToSystemTime
GetModuleHandleA
SetFileAttributesW
GetFullPathNameA
SetEndOfFile
QueueUserWorkItem
GetThreadLocale
CopyFileA
GetOverlappedResult
GetShortPathNameA
FindResourceA
CreateMutexA
UnhandledExceptionFilter
LeaveCriticalSection
lstrlenW
DeleteFileW
GetSystemTimeAsFileTime
lstrcpynA
SizeofResource
SetThreadLocale
GetShortPathNameW
VirtualAllocEx

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

ws2_32

inet_ntoa
ntohl

iphlpapi

GetIfEntry
GetIpAddrTable

advapi32

RegCreateKeyExA
RegSetValueExA
RegCreateKeyExW
RegQueryValueExA
RegDeleteValueA
GetSecurityDescriptorDacl
IsValidSecurityDescriptor
GetSecurityDescriptorSacl
OpenSCManagerA
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
RegCloseKey
RegEnumValueA
QueryServiceStatus
SetKernelObjectSecurity
LookupPrivilegeValueA
ControlService
RegQueryValueExW
RegEnumKeyExA
RegDeleteValueW
GetSecurityDescriptorControl
GetUserNameW
OpenProcessToken
StartServiceA
CloseServiceHandle
OpenServiceA
IsValidSid
GetKernelObjectSecurity
ChangeServiceConfigA
RegSetValueExW
CreateServiceW
IsValidAcl
AdjustTokenPrivileges
GetSecurityDescriptorGroup
QueryServiceConfigA
DeleteService
RegOpenKeyExA
RegDeleteKeyA

userenv

GetProfileType
FreeGPOListW
LoadUserProfileW
GetProfilesDirectoryW
GetProfilesDirectoryA
RefreshPolicy
ProcessGroupPolicyCompletedEx
GetNextFgPolicyRefreshInfo

colbact

DllRegisterServer
GetClassInfoForCurrentUser
PartitionAccessCheck

Sections

.jQzls
Size: 512B - Virtual size: 16KB

IMAGE_SCN_MEM_READ

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.IlaRAAg
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GjeF
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UxAAnX
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.PpmnmOs
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gpxaz
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 7KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uNpF
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.YahYH
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mywsjUp
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dxcYdXH
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c47f50de63ea28833787bd4af526cb1

Headers

File Characteristics

Imports

rpcrt4

user32

kernel32

version

ws2_32

iphlpapi

advapi32

userenv

colbact

Sections

.jQzls Size: 512B - Virtual size: 16KB

.text Size: 19KB - Virtual size: 18KB

.IlaRAAg Size: 2KB - Virtual size: 1KB

.GjeF Size: 3KB - Virtual size: 2KB

.UxAAnX Size: 512B - Virtual size: 166B

.PpmnmOs Size: 1024B - Virtual size: 777B

.gpxaz Size: 2KB - Virtual size: 1KB

.data Size: 7KB - Virtual size: 132KB

.rdata Size: 209KB - Virtual size: 209KB

.uNpF Size: 3KB - Virtual size: 2KB

.rsrc Size: 6KB - Virtual size: 5KB

.YahYH Size: 1KB - Virtual size: 1KB

.mywsjUp Size: 2KB - Virtual size: 2KB

.dxcYdXH Size: 2KB - Virtual size: 2KB

.jQzls
Size: 512B - Virtual size: 16KB

.text
Size: 19KB - Virtual size: 18KB

.IlaRAAg
Size: 2KB - Virtual size: 1KB

.GjeF
Size: 3KB - Virtual size: 2KB

.UxAAnX
Size: 512B - Virtual size: 166B

.PpmnmOs
Size: 1024B - Virtual size: 777B

.gpxaz
Size: 2KB - Virtual size: 1KB

.data
Size: 7KB - Virtual size: 132KB

.rdata
Size: 209KB - Virtual size: 209KB

.uNpF
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 6KB - Virtual size: 5KB

.YahYH
Size: 1KB - Virtual size: 1KB

.mywsjUp
Size: 2KB - Virtual size: 2KB

.dxcYdXH
Size: 2KB - Virtual size: 2KB