3a3157cce1c675e63c8982164f3cced53c50ed304a61f91a1d389ab194fc7a7c

Sharing

Copy URL Twitter E-mail

General

Target

3a3157cce1c675e63c8982164f3cced53c50ed304a61f91a1d389ab194fc7a7c
Size

104KB
MD5

78ae4254bde5bd8b8f532e44faa9d130
SHA1

c4f2f0773cbf30bde3886e60d5bc2e38b969b030
SHA256

3a3157cce1c675e63c8982164f3cced53c50ed304a61f91a1d389ab194fc7a7c
SHA512

91cf7915d7c73e32cccf61b99ff8f7e4ef2a75575e55953d0444127509f072f45847b5687dd8d83508f1aa72269fb72af9cc5f6cfde42f6a5a69196a2c2d780b
SSDEEP

1536:qkgB7C8zKIa+Umnh/I4Rikvbd2SGsqyPwsx0eoXojixq9nDNz8GuryYCTEPnf:q3pC8z/Umnh/zQkvbQSD4W0eoXojiHr

Score

N/A

Malware Config

Signatures

Files

3a3157cce1c675e63c8982164f3cced53c50ed304a61f91a1d389ab194fc7a7c
.exe windows x86

1a0e90f4d3e5c8621f103570a11cf26d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

inet_ntoa
send
select
connect
setsockopt
socket
WSAStartup
recv
WSAGetLastError
htons
htonl
ioctlsocket
gethostbyname
closesocket

kernel32

VirtualAlloc
HeapAlloc
GetOEMCP
HeapReAlloc
ReleaseMutex
UnmapViewOfFile
CloseHandle
MapViewOfFile
SetEvent
IsBadStringPtrA
GetCurrentProcessId
GetTickCount
OpenProcess
WaitForSingleObject
GetVersionExA
Sleep
ReadProcessMemory
GetLastError
WriteProcessMemory
GetVersion
GetProcAddress
CreateEventA
lstrcatA
lstrcpyA
CreateFileMappingA
CreateMutexA
WriteFile
SetFilePointer
GlobalAlloc
GlobalFree
ResetEvent
DuplicateHandle
GetCurrentProcess
GetCPInfo
lstrcmpiA
LoadLibraryA
GetStringTypeA
GetStringTypeW
LCMapStringA
ReadFile
GetACP
FlushFileBuffers
LCMapStringW
SetStdHandle
lstrlenA
lstrcmpA
CreateThread
GetCommandLineA
GetStartupInfoA
MultiByteToWideChar
RtlUnwind
HeapFree
VirtualFree
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
UnhandledExceptionFilter
GetModuleHandleA
FreeEnvironmentStringsA
TerminateProcess
ExitProcess
GetModuleFileNameA

user32

wsprintfA
SetWindowTextA
PostQuitMessage
DispatchMessageA
TranslateMessage
DefWindowProcA
DestroyWindow
RegisterClassA
MsgWaitForMultipleObjects
MessageBoxA
CreateWindowExA
ShowWindow
LoadCursorA
PeekMessageA

advapi32

RegCloseKey
RegQueryValueExA
SetSecurityInfo
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rdtlybh
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1a0e90f4d3e5c8621f103570a11cf26d

Headers

File Characteristics

Imports

wsock32

kernel32

user32

advapi32

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 48KB - Virtual size: 48KB

rdtlybh Size: - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 48KB - Virtual size: 48KB

rdtlybh
Size: - Virtual size: 4KB