fa5faef03bad26cfe27ddd2935cc35ab4fdf129c4a17221dedc05de81b1d9422_dump_0x01e60000

Sharing

Copy URL Twitter E-mail

General

Target

fa5faef03bad26cfe27ddd2935cc35ab4fdf129c4a17221dedc05de81b1d9422_dump_0x01e60000
Size

100KB
MD5

b741b0a421b345424ebfee458d2998df
SHA1

565e40ea823042f6bb5d1638a4e5a44af87c82ed
SHA256

ca5446d382dc51f61d9236c9eac2789baea8fb3d2ca5ada6a6e21a9af9f9e53d
SHA512

4096c2e77c3bc6c70f2d0a188818dc9533a6d257d87206b4daff6ed7559da38cc1cdf33c6a59049f679403109b47a8828ceac4039ccb48b391a6c62935727175
SSDEEP

1536:QnDMPFot5DFFXuDMcJ3rL/pCDFHGYvVRQe4zZrb8OsGbKis:QDMNo7RFXipi7NIZrbWGbKis

Score

N/A

Malware Config

Signatures

Files

fa5faef03bad26cfe27ddd2935cc35ab4fdf129c4a17221dedc05de81b1d9422_dump_0x01e60000
.exe windows x86

fbecf5b257ea44188c31bd5f5b4ec69a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineW
wnsprintfA
wnsprintfW

kernel32

TlsAlloc
InitializeCriticalSection
ExitProcess
GetModuleHandleW
ExitThread
OpenProcess
UnmapViewOfFile
MapViewOfFileEx
GetFileSizeEx
CreateFileMappingW
GetFileSize
SetEndOfFile
MoveFileExW
TlsSetValue
FreeLibrary
LoadLibraryA
LocalFree
SetEvent
WaitForMultipleObjects
GetEnvironmentVariableW
GetTempFileNameW
FindFirstFileW
CreateDirectoryW
CopyFileW
GetTempPathW
TlsGetValue
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
GetCurrentThreadId
GetDriveTypeW
CreateProcessW
GetLogicalDrives
GetFileAttributesW
ReadFile
CreatePipe
DuplicateHandle
GetProcAddress
GetModuleHandleA
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileInformationByHandle
CreateRemoteThread
ReadProcessMemory
VirtualProtectEx
WideCharToMultiByte
MultiByteToWideChar
GetNativeSystemInfo
GetVersionExW
GetSystemTimeAsFileTime
GetLastError
SetFilePointer
CreateThread
GetVolumeInformationW
GetCurrentProcessId
ReleaseMutex
CreateEventW
ResetEvent
SetThreadPriority
GetModuleFileNameW
Sleep
GetCurrentThread
SignalObjectAndWait
WaitForSingleObject
CreateMutexW
GetComputerNameA
DeleteFileW
CloseHandle
EnterCriticalSection
FlushFileBuffers
CreateFileW
LeaveCriticalSection
WriteFile
InterlockedDecrement
FindClose
InterlockedIncrement

advapi32

GetSecurityDescriptorSacl
SetNamedSecurityInfoW
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegSetValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenThreadToken
OpenProcessToken
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptGenKey
CryptCreateHash
CryptEncrypt
CryptReleaseContext
CryptDuplicateHash
CryptVerifySignatureW
CryptAcquireContextW
CryptExportKey
CryptGetHashParam
EqualSid
GetLengthSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHGetFolderPathW

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbecf5b257ea44188c31bd5f5b4ec69a

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

shell32

Sections

.text Size: 56KB - Virtual size: 55KB

code Size: 8KB - Virtual size: 7KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 56KB - Virtual size: 55KB

code
Size: 8KB - Virtual size: 7KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.reloc
Size: 8KB - Virtual size: 4KB