5534ca4df250cd6c24d2d2e539c591c60b28ae8dae07f90e76007c230cd1806b

Sharing

Copy URL Twitter E-mail

General

Target

5534ca4df250cd6c24d2d2e539c591c60b28ae8dae07f90e76007c230cd1806b
Size

580KB
MD5

0cc7d288493f6dce661c5ba3e8bb18f0
SHA1

0df5e3e2e6467e145f4530b043780bc9beed8a4c
SHA256

5534ca4df250cd6c24d2d2e539c591c60b28ae8dae07f90e76007c230cd1806b
SHA512

b279e5de79cf42f2fb870b03864630febe768a588dd6219a68d4e9d66ed95a6b9f161b0e1dceec67d0fd6e37c70c95143c11126c4fc6d0d9f985dbc6a8e3725f
SSDEEP

12288:7st5TRQ1dYCyIEDNVgFl6wtGsECwmSep4m/jMhInbSD09SYN:85TyvYCENVgFl6wtGnCPSep4m/kInebM

Score

N/A

Malware Config

Signatures

Files

5534ca4df250cd6c24d2d2e539c591c60b28ae8dae07f90e76007c230cd1806b
.exe windows x64

d1642b83918e9fb9d07cd464acb1d128

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

UpdatePerUserSystemParameters
GetSystemMetrics

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlCopySid
RtlLengthSid

shell32

CommandLineToArgvW

advapi32

EqualSid
OpenProcessToken
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
GetTokenInformation
OpenThreadToken
ImpersonateLoggedOnUser
SetThreadToken
ConvertSidToStringSidW

kernel32

Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GlobalFree
GetEnvironmentVariableW
FreeLibrary
CreateProcessW
GetCurrentProcess
CompareFileTime
SetEnvironmentVariableW
WaitForSingleObject
GetSystemDirectoryW
LoadLibraryW
GetExitCodeProcess
lstrlenW
GetLastError
SetLastError
GetProcAddress
LocalAlloc
SetCurrentDirectoryW
CloseHandle
LocalFree
GetSystemTime
ExpandEnvironmentStringsW
GetCommandLineW
CompareStringW
HeapSetInformation
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
CreateFileW
SetFilePointer
WriteFile
DuplicateHandle
GetCurrentThread

msvcrt

__setusermatherr
__CxxFrameHandler3
memmove
_vsnwprintf
_itow
??3@YAXPEAX@Z
__getmainargs
__C_specific_handler
_XcptFilter
_exit
_ismbblead
_cexit
exit
_acmdln
_initterm
_amsg_exit
memset
_commode
_fmode
__set_app_type
?terminate@@YAXXZ

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 556KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d1642b83918e9fb9d07cd464acb1d128

Headers

DLL Characteristics

File Characteristics

Imports

user32

ntdll

shell32

advapi32

kernel32

msvcrt

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 564B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 556KB - Virtual size: 2.4MB

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 564B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 556KB - Virtual size: 2.4MB