95f587570026e4489cf0c119ba68e903e3e653b5ba58c7ee89ea10b2e92b4ab2

Sharing

Copy URL Twitter E-mail

General

Target

95f587570026e4489cf0c119ba68e903e3e653b5ba58c7ee89ea10b2e92b4ab2
Size

528KB
MD5

80f315d0e1d89c4c1401b866adca1eef
SHA1

d9be5c183125fcb94d871db7cc9afa3c3a87c340
SHA256

95f587570026e4489cf0c119ba68e903e3e653b5ba58c7ee89ea10b2e92b4ab2
SHA512

4f414b536227bd240620f19c87cd1fb8e5f308156cb245d2d92266021abb9f2a2c195e6509293c68a28b1754e68dc2f21c10a3a1d630c160865ded8205c1a8f4
SSDEEP

12288:Xrtg0+Cdfkb8fPpFux0Mhh/Jn29yFvjoBRGgodd4iAO4:xg0+afkbMPshQ9MvAodmBO4

Score

N/A

Malware Config

Signatures

Files

95f587570026e4489cf0c119ba68e903e3e653b5ba58c7ee89ea10b2e92b4ab2
.exe windows x64

ea351dbd127d10e9e3b7a74d92e3ae28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

kernel32

GetCommandLineW
GetCPInfo
SetThreadUILanguage
ReadConsoleW
WriteFile
WideCharToMultiByte
LoadLibraryW
GetConsoleMode
FormatMessageW
GetTimeFormatW
WriteConsoleW
MultiByteToWideChar
GetConsoleOutputCP
GetStdHandle
GetLastError
GetThreadLocale
GetFileType
HeapSetInformation
LocalFree
GetSystemTime
ExpandEnvironmentStringsW
GetProfileStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
GetCurrentProcess
UnhandledExceptionFilter
GetProfileIntA
LocalAlloc
LoadLibraryExW
FreeLibrary
TerminateProcess

msvcrt

wcscpy_s
__getmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_stricmp
??3@YAXPEAX@Z
memset
_itoa_s
strspn
strcpy_s
sscanf
exit
wcstok
_wcsupr
_iob
_vsnwprintf
strpbrk
wcsrchr
fgets
strchr
malloc
free
wcstoul
_wcsicmp
wcschr
strcat_s

ntdll

WinSqmIsOptedIn
RtlCaptureContext
WinSqmAddToStream
RtlLookupFunctionEntry
RtlVirtualUnwind

netutils

NetApiBufferFree

schedcli

NetScheduleJobEnum
NetScheduleJobDel
NetScheduleJobGetInfo
NetScheduleJobAdd

shell32

CommandLineToArgvW

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 366B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ea351dbd127d10e9e3b7a74d92e3ae28

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

netutils

schedcli

shell32

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 3KB - Virtual size: 9KB

.pdata Size: 1024B - Virtual size: 576B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 366B

.vmp0 Size: 500KB - Virtual size: 1.8MB

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 3KB - Virtual size: 9KB

.pdata
Size: 1024B - Virtual size: 576B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 366B

.vmp0
Size: 500KB - Virtual size: 1.8MB