9ed8d1de03b412a1f235a4be0fc7d22f74f2c8dd97aefefb00016070fc2c6473

Sharing

Copy URL Twitter E-mail

General

Target

9ed8d1de03b412a1f235a4be0fc7d22f74f2c8dd97aefefb00016070fc2c6473
Size

32KB
MD5

a201af5727b2ef2942187ddf1a082040
SHA1

bb058838d47d231f586298159da59017a6687b4a
SHA256

9ed8d1de03b412a1f235a4be0fc7d22f74f2c8dd97aefefb00016070fc2c6473
SHA512

682152afa72cf0e0053154c969fbc206553ae2fb0872bbc8aba37e12b23c4a20fdec2ab01db8b4b5538c87ab55f528c208b2f83f456e8f8dc3820152b8ad2844
SSDEEP

768:I5EDkpG0VUE7ip/qatXf6ZJWiVkkEKGdPxAarj/jD:I5EwpL7kqYXgrZEKGdPxASj//

Score

N/A

Malware Config

Signatures

Files

9ed8d1de03b412a1f235a4be0fc7d22f74f2c8dd97aefefb00016070fc2c6473
.exe windows x86

5b6b488e09f3c1039a05ea7984d16737

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedCompareExchange
CreateThread
LocalFree
CloseHandle
WaitForSingleObject
FreeLibrary
FormatMessageW
LocalAlloc
GetConsoleScreenBufferInfo
GetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
InterlockedExchange
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
Sleep
ExitThread
GetCurrentProcessId
lstrlenW
GetLastError

msvcr80

_initterm
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__winitenv
exit
_XcptFilter
_exit
memset
_cexit
__wgetmainargs
_amsg_exit
wcstok
memcpy
_wtoi
_vsnwprintf_s
_wcsicmp
_initterm_e

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoUninitialize
CoInitializeEx

webengine

IsRegisteredInProc
RemoveAspnetFromIISKey
IsMatchingBitness
CheckIISState
RunningOn64Bit
AspnetLoadResourceDLL
GetExistingVersion
RunAspnetCA
LoadResourceString
ValidateIISPath
RegisterScriptMapsOnVista
GrantAccessToUserAccountOnVista
GrantAccessToUserAccount
RegisterAspNetEx
UnregisterAspNet
RemoveClientScriptFiles
CopyClientScriptFiles
PrintStringToStdOut
CallManagedProtectedConfigAction
IsVista
PrintResourceString
SetRemoteConfigDCOMRegKeys
DetectErrorAndGetLogfileName
ListAspnetInstalledVersions
ListAspnetInstalledIISKeys
RunPkgmgr
PrintResourceStringNoNewLine
GetXSPHeap

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b6b488e09f3c1039a05ea7984d16737

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr80

advapi32

ole32

webengine

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 2KB - Virtual size: 15KB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 2KB - Virtual size: 15KB

.rsrc
Size: 8KB - Virtual size: 8KB