0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked

Sharing

Copy URL

Twitter E-mail

Reason

config extraction: missing cfgextr callback for rule "Gozi_FJ_loader"

General

Target

0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked
Size

89KB
MD5

ffc592251858b76abc3db0dbfe7a078d
SHA1

48735504d3dd1444f326862a8725fe380818fbcd
SHA256

1f7c992588a82d6bec0f5dd1b5de60c3bb937797e8c78c9d11a7cd4313baadf9
SHA512

5c24bc0dbd2024cec9390430f0d2b91f8ad97b71ff08d39ac339aac3b4f25c178cde0769785f812b6537ae4c2d94773c48936bbd942e97cfc057dd8b9ad4b20f
SSDEEP

1536:D5LMc5TFyZiEK6wwicirXrc0dbYdmGNu0CPFDNIWvsZr2TVsaPO:2c5TFyZirXQh9CNDNIW55O

Score

N/A

Malware Config

Signatures

Files

0e61ecd0aad87a72d36bc10288303292859a800d2237ac9c32755d9e455e87e2_unpacked
.dll windows x86

b9310cd4b3f4d25c129bed96789c0b94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtSetContextThread
ZwQueryInformationProcess
NtGetContextThread
ZwOpenProcessToken
ZwOpenProcess
ZwQueryInformationToken
sprintf
ZwClose
NtUnmapViewOfSection
NtMapViewOfSection
RtlNtStatusToDosError
memset
strstr
_strupr
strcpy
wcstombs
mbstowcs
wcscpy
memcpy
RtlAdjustPrivilege
NtCreateSection
_aulldiv
_allmul
RtlUnwind
NtQueryVirtualMemory

kernel32

OpenFileMappingA
VirtualProtect
GetModuleFileNameA
VirtualAllocEx
VirtualAlloc
OpenProcess
CreateRemoteThread
VirtualFree
SetFilePointer
GetVersion
GetComputerNameA
CreateProcessW
GetThreadContext
SwitchToThread
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetTickCount
HeapDestroy
HeapCreate
GetCurrentThreadId
CreateDirectoryW
GetWindowsDirectoryA
Sleep
CopyFileW
lstrlenW
GetModuleHandleA
lstrcatW
DeleteFileW
GetTempPathA
MapViewOfFile
UnmapViewOfFile
SetWaitableTimer
GetCurrentProcess
CreateEventA
LeaveCriticalSection
lstrcmpiA
EnterCriticalSection
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
UnregisterWait
LoadLibraryExW
WaitForSingleObject
SetLastError
RegisterWaitForSingleObject
GetFileSize
FindFirstFileW
GetDriveTypeW
GetLogicalDriveStringsW
InitializeCriticalSection
GetFileAttributesA
GetFileAttributesW
CreateProcessA
CreateFileW
FindFirstFileA
GetTempFileNameA
FindClose
CreateFileMappingA
FindNextFileA
FindNextFileW
DeleteCriticalSection
ResumeThread
CreateThread
lstrcpynA
lstrcmpA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
GetProcAddress
QueueUserAPC
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetCurrentProcessId
GetSystemTime
lstrcmpW
SleepEx
ResetEvent
LocalAlloc
LocalFree
FreeLibrary
InterlockedExchange
RaiseException
SuspendThread
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
QueueUserWorkItem

Exports

Exports

CreateProcessNotify

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

b9310cd4b3f4d25c129bed96789c0b94

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 65KB - Virtual size: 65KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 65KB - Virtual size: 65KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB