798a5e3141eced760ee4413ce5c85a4bb1e098da56c8ce86444b23b337863324

Sharing

Copy URL Twitter E-mail

General

Target

798a5e3141eced760ee4413ce5c85a4bb1e098da56c8ce86444b23b337863324
Size

269KB
MD5

7ac06cea56afb029aa104c5c3a09aec9
SHA1

81f373b365bb210e6fa1dc14d531651b9f8c0774
SHA256

798a5e3141eced760ee4413ce5c85a4bb1e098da56c8ce86444b23b337863324
SHA512

a141ed3e1283d42c26e9904ba7f3abfb4a62f921c75110b63012d99d87e4a11f123d47eb04c757fd0d958f651ab42c6bb3ab719b5f5a0c9142e098cff4229153
SSDEEP

6144:oJIoB5cIU4X/Orr+PXV0J2mWxoOqg4IZaaLl:o2S2GmCFy27xoPkLl

Score

N/A

Malware Config

Signatures

Files

798a5e3141eced760ee4413ce5c85a4bb1e098da56c8ce86444b23b337863324
.exe windows x86

8f23688a095625c981cea515b2704305

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winspool.drv

AddPrinterDriverExW
AddPrinterDriverW
AddPrinterW
ClosePrinter
ConfigurePortW
DeleteFormW
DeleteMonitorW
DeletePortW
DeletePrintProcessorW
DeletePrintProvidorW
DeletePrinter
DeletePrinterConnectionW
DeletePrinterDataExW
DeletePrinterDataW
DeletePrinterDriverExW
DeletePrinterDriverW
EnumPrintProcessorsW
EnumPrinterDataExW
EnumPrinterDataW
EnumPrinterDriversW
EnumPrinterKeyW
EnumPrintersW
FindClosePrinterChangeNotification
FlushPrinter
GetFormW
GetJobW
GetPrintProcessorDirectoryW
GetPrinterDataExW
GetPrinterDataW
GetPrinterDriverDirectoryW
GetPrinterDriverW
GetPrinterW
OpenPrinterW
PrinterMessageBoxW
ReadPrinter
ResetPrinterW
ScheduleJob
SetFormW
SetJobW
SetPortW
SetPrinterDataExW
SetPrinterDataW
StartDocPrinterW
StartPagePrinter
WaitForPrinterChange

odbc32

ord44
ord43
ord142
ord141
ord140
ord78
ord121
ord20
ord119
ord18
ord117
ord16
ord13
ord153
ord154
ord155
ord156
ord58
ord64
ord165
ord166
ord167
ord68
ord69
ord170
ord31
ord132
ord133
ord135
ord136
ord37
ord138
ord139
ord173
ord74
ord134

kernel32

IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
HeapAlloc
HeapSize
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
RtlUnwind
Sleep
HeapFree
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetCurrentThread
InterlockedDecrement
GetLastError
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
WriteFile
DecodePointer
ExitProcess
SetHandleCount
GetModuleHandleW
GetProcAddress
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineW
ExpandEnvironmentStringsW
VirtualProtect
WritePrivateProfileStringW

Sections

.text
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f23688a095625c981cea515b2704305

Headers

DLL Characteristics

File Characteristics

Imports

winspool.drv

odbc32

kernel32

Sections

.text Size: 203KB - Virtual size: 202KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 24KB - Virtual size: 159KB

.rsrc Size: 10KB - Virtual size: 9KB

.text
Size: 203KB - Virtual size: 202KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 24KB - Virtual size: 159KB

.rsrc
Size: 10KB - Virtual size: 9KB