dee21564e92742e7d3555070d17a095b27779b758987e1c37591ef607e938f2e

Sharing

Copy URL Twitter E-mail

General

Target

dee21564e92742e7d3555070d17a095b27779b758987e1c37591ef607e938f2e
Size

33KB
MD5

0bd5ae0286ad1507940352f76dcf9a70
SHA1

8aac83daef03690465f50675178d6627b461e15a
SHA256

dee21564e92742e7d3555070d17a095b27779b758987e1c37591ef607e938f2e
SHA512

1f9eecebde4cb2021e2261e88d4946d5273f1dadb778d445ce3993d6715b720c9638cfb4aaf6f8ffd950e76ec9f48d6184917aacd2dd5835ae66fbaf8e718f7c
SSDEEP

768:LFhWQIeQrVkAs+tllL+iKgnMn2iOQs4Isa3:LFgQIdkAsynygua3

Score

N/A

Malware Config

Signatures

Files

dee21564e92742e7d3555070d17a095b27779b758987e1c37591ef607e938f2e
.exe windows x86

fa631c4e8392ecebcfbb258a9c7675ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

kernel32

lstrcmpW
GlobalLock
GlobalAlloc
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
HeapSetInformation
SetErrorMode
GetCommandLineW
GetPrivateProfileSectionW
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
lstrlenW
GlobalUnlock
GlobalFree
lstrcmpiW
LocalAlloc
LocalFree
GetThreadLocale
UnhandledExceptionFilter

user32

SetCursor
CharNextW
LoadStringW
LoadCursorW

msvcrt

_initterm
?terminate@@YAXXZ
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
_except_handler4_common
__set_app_type
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
memmove
_controlfp

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

imm32

ImmDisableIME

shlwapi

PathRemoveFileSpecW
StrToIntW
PathUnquoteSpacesW
PathGetArgsW
PathFileExistsW
PathAppendW
PathIsUNCW
PathGetDriveNumberW
PathFindFileNameW
ord456
ord158

comctl32

ord334
ord328
ord332
ord17

shell32

SHChangeNotify
SHGetFolderPathEx
ord165
ord42
ord58
ord49
ord51
SHAddToRecentDocs
ord164
ord94

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa631c4e8392ecebcfbb258a9c7675ae

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

imm32

shlwapi

comctl32

shell32

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 920B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 18KB - Virtual size: 21KB

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 920B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 18KB - Virtual size: 21KB