ebdce1edb09551aacb28140dffe538e1bc17c8c9ceb1b560f4a0d96a9d8b8bbb

Sharing

Copy URL Twitter E-mail

General

Target

ebdce1edb09551aacb28140dffe538e1bc17c8c9ceb1b560f4a0d96a9d8b8bbb
Size

618KB
MD5

4c4a62087cd650eeed8d196d37ce3a40
SHA1

2678ceb4eff923ce7fe72d6632a9d08d55bde9e4
SHA256

ebdce1edb09551aacb28140dffe538e1bc17c8c9ceb1b560f4a0d96a9d8b8bbb
SHA512

5c5812cf7f2973bf87907129d19f4c1a83b5295ef027f3e587bfe229a09d49a63d820a147c1e19d8947808848366090f4da0bb6dcf7f4113a11665e707deb668
SSDEEP

12288:svhQ6D6jCs4MmQbkdTOpZrVxWaAlS7lwrcKQK5M0vvs7WHCB+Yd:svG6K39gUpZ8lSuIKQ4tv07WHCB+O

Score

N/A

Malware Config

Signatures

Files

ebdce1edb09551aacb28140dffe538e1bc17c8c9ceb1b560f4a0d96a9d8b8bbb
.exe windows x86

b249b72c79dce3481a9d4310b423c53f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
SetConsoleTextAttribute
HeapAlloc
GetLastError
FindClose
FindNextFileW
FindFirstFileW
SetThreadLocale
GetSystemDefaultLCID
GetLocaleInfoW
GetThreadLocale
GetUserDefaultUILanguage
SetEvent
InterlockedExchange
LocalFree
WriteFile
WriteConsoleW
GetFileType
FormatMessageW
GetModuleHandleW
GetModuleFileNameW
ReadConsoleW
MultiByteToWideChar
ReadFile
SetConsoleMode
GetConsoleMode
SystemTimeToFileTime
FreeLibrary
GetConsoleScreenBufferInfo
CloseHandle
CreateFileW
GetLocalTime
WaitForSingleObject
GetVersionExW
SetConsoleCtrlHandler
CreateEventW
ReleaseMutex
LeaveCriticalSection
CreateThread
EnterCriticalSection
TerminateThread
GetExitCodeThread
CreateMutexW
InitializeCriticalSection
GetComputerNameW
DeleteCriticalSection
HeapValidate
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetProcessHeap
HeapFree
LoadLibraryW
GetConsoleOutputCP

msvcrt

wcstod
wcstok
wcsncpy
wprintf
_getmbcp
wcsstr
_wcslwr
_wtoi
fclose
fwprintf
_wfopen
fgetws
_sleep
??2@YAPAXI@Z
_c_exit
_exit
_wcsnicmp
_cexit
__winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
wcslen
_except_handler3
_wcsicmp
_vsnwprintf
exit
??3@YAXPAX@Z
_wtol
_wsplitpath
wcscmp
_XcptFilter
_wmakepath

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

user32

LoadStringW
CharToOemW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

pdh

PdhEnumObjectItemsW
PdhEnumObjectsW
PdhOpenLogW
PdhUpdateLogW
PdhCollectQueryData
PdhGetFormattedCounterArrayW
PdhExpandWildCardPathW
PdhOpenQueryW
PdhAddCounterW
PdhCloseLog
PdhCloseQuery

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 588KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b249b72c79dce3481a9d4310b423c53f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

user32

version

pdh

Sections

.text Size: 28KB - Virtual size: 27KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 588KB - Virtual size: 2.3MB

.text
Size: 28KB - Virtual size: 27KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 588KB - Virtual size: 2.3MB