b5fdd89baac9e72075828f4b06e90b2f369ddddccd75a7a1f023411bcfdc6b2c

Sharing

Copy URL Twitter E-mail

General

Target

b5fdd89baac9e72075828f4b06e90b2f369ddddccd75a7a1f023411bcfdc6b2c
Size

580KB
MD5

8084fee64ffe95d793dc9742348354a1
SHA1

420f30bbfb37c1626d833a6c197cf4dcffdb07ca
SHA256

b5fdd89baac9e72075828f4b06e90b2f369ddddccd75a7a1f023411bcfdc6b2c
SHA512

9042c375106f9485f84c70825a1401ab59d9f70c573f79bdea01882284d7c214517ed7c20ad5ce9cfd371888ab1c5b778d6326f1b26648c57a1acc80e20a90d7
SSDEEP

12288:E4ifTsqGrcij0HZB0gP6DFKDryL2F55XI596Mc:KfTWL05BlP6DFO5dM

Score

N/A

Malware Config

Signatures

Files

b5fdd89baac9e72075828f4b06e90b2f369ddddccd75a7a1f023411bcfdc6b2c
.exe windows x86

2ce303fee787a5ace3ff3703405c43c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_except_handler4_common
_decode_pointer
_controlfp_s
_onexit
_lock
__dllonexit
_unlock
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
??3@YAXPAX@Z
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
wcstombs_s
mbstowcs_s
??_U@YAPAXI@Z
wcscat_s
??_V@YAXPAX@Z
_wfopen_s
fclose
feof
fread
wcscpy_s
malloc
free
memset
memcpy
_time64
_difftime64
_invoke_watson
ferror
fseek
ftell
fopen
fwrite
_wcsicmp
wcsncat_s
calloc

kernel32

ReadFile
GetTempPathW
GetStdHandle
WriteFile
CreateFileA
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
InterlockedCompareExchange
CreateEventW
CreateThread
WaitForMultipleObjects
ResetEvent
DeleteFileW
CreateFileW
GetCurrentProcessId
Sleep
CloseHandle
WaitForSingleObject
GlobalAlloc
SetEvent
GetLastError
FormatMessageW
LocalAlloc
LocalFree
GetTempFileNameW

winspool.drv

ReadPrinter
ord203
WritePrinter

advapi32

UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceEvent
RegisterTraceGuidsW

shell32

ShellExecuteExW

ole32

CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantClear

xpsprint

StartXpsPrintJob

Sections

.text
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2ce303fee787a5ace3ff3703405c43c0

Headers

DLL Characteristics

File Characteristics

Imports

msvcr80

kernel32

winspool.drv

advapi32

shell32

ole32

oleaut32

xpsprint

Sections

.text Size: 40KB - Virtual size: 36KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 1KB

.vmp0 Size: 508KB - Virtual size: 1.6MB

.text
Size: 40KB - Virtual size: 36KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 1KB

.vmp0
Size: 508KB - Virtual size: 1.6MB