f79ec7d88c9b942197f3cef29cc810acbc7f05a15d9edf5d2c1b5c11024a8cb4

Sharing

Copy URL Twitter E-mail

General

Target

f79ec7d88c9b942197f3cef29cc810acbc7f05a15d9edf5d2c1b5c11024a8cb4
Size

743KB
MD5

0c17a898b92f7b6a2b68f1cdfbccb020
SHA1

be16821881f929c84d507b4ab619d61608694586
SHA256

f79ec7d88c9b942197f3cef29cc810acbc7f05a15d9edf5d2c1b5c11024a8cb4
SHA512

afef1b0dffb8c7b2f9af7b0a2920e15bb986f6cdc57c70f1f0bbe335a568d598521fe94f6be2ac7a064e38ca29cfd6b1deb052c105bd549da3bd641727feca7e
SSDEEP

12288:d9G6DMzHMMHMMMyMMMZMMMVcR9bzOXmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMt:nGLbMMHMMMvMMZMMMKzb6XmMMMiMMMzd

Score

N/A

Malware Config

Signatures

Files

f79ec7d88c9b942197f3cef29cc810acbc7f05a15d9edf5d2c1b5c11024a8cb4
.exe windows x86

596e1a03d17824154e0fc0d4f4699fab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EventWrite
GetTraceEnableFlags
RegQueryValueExW
EventUnregister
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
RegOpenKeyExW
EventRegister
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW

kernel32

Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
TerminateProcess
CreateFileW
lstrlenW
VerifyVersionInfoW
GetLastError
GetProcAddress
LocalAlloc
IsWow64Process
HeapSetInformation
GetFileTime
DeleteCriticalSection
CloseHandle
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
GetCurrentProcess
VerSetConditionMask
SetDllDirectoryW
CreateProcessW
SetErrorMode
RaiseException
LoadLibraryA
GetSystemDefaultLCID
GetUserDefaultLCID
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersionExA
FreeLibrary
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentDirectoryW
GetCommandLineW

user32

IsWindowEnabled
LoadStringW
CharNextW
GetWindowThreadProcessId
AllowSetForegroundWindow
SendMessageTimeoutW
FindWindowExW
MessageBoxW
IsWindowVisible

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
iswalpha
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
wcsncmp
iswspace
_vsnwprintf
memset

shlwapi

ord154
SHGetValueW
SHRegGetValueW
SHSetValueW
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
ord158
PathFindFileNameW
UrlCreateFromPathW
StrStrW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoInitialize

urlmon

ord410
ord111

iertutil

ord42
ord32
ord44
ord325
ord9
ord31
ord163
ord650
ord58

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 693KB - Virtual size: 693KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ngaut
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

596e1a03d17824154e0fc0d4f4699fab

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

shell32

ole32

urlmon

iertutil

Sections

.text Size: 26KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 693KB - Virtual size: 693KB

.reloc Size: 1KB - Virtual size: 1KB

.ngaut Size: 4KB - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 693KB - Virtual size: 693KB

.reloc
Size: 1KB - Virtual size: 1KB

.ngaut
Size: 4KB - Virtual size: 4KB