aef8c3ef1f2e8dcd227f708736719e2fba91c6af1a85d0fe0bed940b40300ffb

Sharing

Copy URL Twitter E-mail

General

Target

aef8c3ef1f2e8dcd227f708736719e2fba91c6af1a85d0fe0bed940b40300ffb
Size

512KB
MD5

20d2fdffc48d88eb1858abe162e73a07
SHA1

5c4c8989150520a0040604a5180fbd8162ff4117
SHA256

aef8c3ef1f2e8dcd227f708736719e2fba91c6af1a85d0fe0bed940b40300ffb
SHA512

c8be8bcb6b7dbf6a915e420698d9ef859fc373aae2a9901228e20862ff030653eca75aa51839662b274e0e48b7423ea2ef1b3fe41e645a1944283da9b89bd347
SSDEEP

6144:of/cUH15thkpaL5CeUNhURdLuUWo1d4j5bDlwtjYDlDByR4pb93cymUuIEvDN:of/cUzthkpaVCeUN2Lubpl

Score

N/A

Malware Config

Signatures

Files

aef8c3ef1f2e8dcd227f708736719e2fba91c6af1a85d0fe0bed940b40300ffb
.exe windows x86

34f52524364754c2fd5667c5fb86e795

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW

kernel32

LocalFree
MultiByteToWideChar
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
SetEvent
WaitForSingleObject
GetModuleFileNameW
CreateEventW
CreateProcessW
DeleteFileW
RemoveDirectoryW
CreateFileA
WriteFile
InitializeCriticalSection
InterlockedCompareExchange
GetProcessHeap
SetEndOfFile
GetModuleHandleA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
InterlockedExchange
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLastError
HeapFree
InterlockedDecrement
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetStartupInfoW
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sleep
InterlockedIncrement
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
ExitProcess
GetModuleFileNameA
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointer
ReadFile
FlushFileBuffers
RtlUnwind
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetLocaleInfoW
CreateFileW

user32

MessageBoxW

shell32

SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW

wininet

InternetReadFile
InternetConnectA
InternetOpenW
HttpSendRequestW
InternetOpenUrlW
InternetCloseHandle
HttpOpenRequestA

ws2_32

WSACleanup
WSAStartup

Sections

.text
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34f52524364754c2fd5667c5fb86e795

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

shell32

shlwapi

wininet

ws2_32

Sections

.text Size: 205KB - Virtual size: 205KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 98KB - Virtual size: 98KB

.text
Size: 205KB - Virtual size: 205KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 98KB - Virtual size: 98KB