646ebc7911637be20e01eb2806efa5c994aed844b426cd8e8a1596709a3e0487

General

Target

646ebc7911637be20e01eb2806efa5c994aed844b426cd8e8a1596709a3e0487
Size

389KB
MD5

8191254d81bd841e45484a53b48294f0
SHA1

3c96038277d45dfff1a3494859efa3b5ffc0c422
SHA256

646ebc7911637be20e01eb2806efa5c994aed844b426cd8e8a1596709a3e0487
SHA512

0196da1b4703a7e14483b42d2f251b399bd60b2555961a36061db811cb4102eeed315fc173923af96d4471d32299866ad9731eaa3218dbd65e136392a1d34a2e
SSDEEP

6144:5OLYbgnpJGseASRaPNi8BbrTrWLUpo8zZTLShT2RBrmLWp/3H4zxMXo:2nrLeCNigbrTrpo8zx+NSB6Wl3Huu

Score

N/A

Malware Config

Signatures

Files

646ebc7911637be20e01eb2806efa5c994aed844b426cd8e8a1596709a3e0487
.exe windows x86

870cf9d70b856a36b26500476a375912

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSCloseServer
WTSCloseServer
WTSCloseServer
WTSCloseServer

kernel32

HeapCreate
GetWindowsDirectoryW
TlsFree
SizeofResource
_lopen
FindClose
GetACP
LZRead
TlsFree
TlsFree
GetMailslotInfo
GetConsoleTitleA
GlobalFree
DeleteAtom
DuplicateConsoleHandle
DuplicateHandle
EncodePointer
GlobalFree
DeleteFiber
EnterCriticalSection
RtlUnwind
IsBadReadPtr
SetStdHandle
GlobalFix
EncodeSystemPointer
FreeEnvironmentStringsA
UnhandledExceptionFilter
ExitProcess
Beep
ConvertFiberToThread
EncodePointer
HeapWalk
LCMapStringW
LCMapStringA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 380KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.DATA
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

870cf9d70b856a36b26500476a375912

Headers

File Characteristics

Imports

wtsapi32

kernel32

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 3KB

.data Size: 3KB - Virtual size: 496KB

.rsrc Size: 380KB - Virtual size: 384KB

.DATA Size: 512B - Virtual size: 4KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 3KB

.data
Size: 3KB - Virtual size: 496KB

.rsrc
Size: 380KB - Virtual size: 384KB

.DATA
Size: 512B - Virtual size: 4KB