b863a8cc731c024f15ec14fc9cc23078321e22a0549d8bff39c77e21afd48a58

Sharing

Copy URL Twitter E-mail

General

Target

b863a8cc731c024f15ec14fc9cc23078321e22a0549d8bff39c77e21afd48a58
Size

212KB
MD5

8176abf47b20491b55320c4841584227
SHA1

a2dde62ad83ff115f6dfefe4d53d5774c54fbee9
SHA256

b863a8cc731c024f15ec14fc9cc23078321e22a0549d8bff39c77e21afd48a58
SHA512

f37cc7c9b56f7163579ff775980961f90cda94d0c53bdaf3d31a21cd23abf2463cb63975a6ac120ea9c7591c5428f9a6033eaec8727f5a9340f6002f45881ab9
SSDEEP

3072:gm6GtSsn25e0W38VQxrNp0fNzSLBO0dV2bzTWeg0EAT+mf6VHPKrItfprYD75wJf:gmTtn25e0WMVQx019qG3WjATgQfFwJf

Score

N/A

Malware Config

Signatures

Files

b863a8cc731c024f15ec14fc9cc23078321e22a0549d8bff39c77e21afd48a58
.exe windows x86

2e06917fedb0434658556f57fa15a035

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr70

_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__p___winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_itoa
_local_unwind2
wcscpy
wcscat
wprintf
strchr
strtol
strstr
_purecall
_ftol
strncmp

advapi32

RegQueryValueExW
RegCloseKey
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegOpenKeyExW

kernel32

SwitchToThread
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessAffinityMask
InterlockedCompareExchange
GetCurrentThreadId
GetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
WideCharToMultiByte
GetSystemTimeAsFileTime
lstrlenW
InterlockedDecrement
InterlockedIncrement
SetConsoleCtrlHandler
CreateEventW
MultiByteToWideChar
lstrlenA
HeapReAlloc
HeapFree
GetModuleHandleA
CloseHandle
SetEvent
WaitForSingleObject
GetSystemInfo
Sleep
SetWaitableTimer
CreateWaitableTimerW
CreateThread
HeapAlloc

mswsock

GetAcceptExSockaddrs
AcceptEx

ole32

CoUninitialize
CoInitializeEx

ws2_32

WSAGetLastError
select
recv
WSASend
WSARecv
WSAGetOverlappedResult
gethostbyname
ntohs
inet_ntoa
WSACleanup
WSAStartup
WSASocketW
closesocket
htons
htonl
bind
listen
setsockopt

mscoree

ClrCreateManagedInstance

aspnet_isapi

InitializeLibrary
?XspLogEvent@@YAJKPAGZZ
AttachHandleToThreadPool
GetXSPHeap

Exports

Exports

_STWNDCloseConnection@4
_STWNDDeleteStateItem@4
_STWNDEndOfRequest@4
_STWNDGetLocalAddress@8
_STWNDGetLocalPort@4
_STWNDGetRemoteAddress@8
_STWNDGetRemotePort@4
_STWNDIsClientConnected@4
_STWNDSendResponse@24

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2e06917fedb0434658556f57fa15a035

Headers

File Characteristics

Imports

msvcr70

advapi32

kernel32

mswsock

ole32

ws2_32

mscoree

aspnet_isapi

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 16KB

.data Size: 4KB - Virtual size: 500B

.rsrc Size: 4KB - Virtual size: 1KB

.text Size: 180KB - Virtual size: 180KB

.text
Size: 20KB - Virtual size: 16KB

.data
Size: 4KB - Virtual size: 500B

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 180KB - Virtual size: 180KB