3eb400ea6d03d789a1b2988494ec6f50d189684915603b0574a6f54cdbcc8132

Sharing

Copy URL Twitter E-mail

General

Target
3eb400ea6d03d789a1b2988494ec6f50d189684915603b0574a6f54cdbcc8132
Size 164KB
Sample221029-a5llssefaj
SHA256 3eb400ea6d03d789a1b2988494ec6f50d189684915603b0574a6f54cdbcc8132
MD5 0cc6425f52f7db7d325b5f525f9f6caa
SHA1 04d42163217138af655fcc80b90ddd5b6e8bfba1
SHA512 921801e9432107db01ca18d68c32866fb2769e90ab8d2066cb3a8c8d942a7357095b8817fca0ca98dc90be220f46a394913ea8ab98f4fb931d784cc8f969d9dc
SSDEEP 1536:RI8oIFIJkuvfZ/AuwqQb9nX0SNEHfIjVgLZ+w9HE0BX4CqpiziAq7agHq8GWOka+:RaSyxvfGqanX+UyHl4e+/HkP2z
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

3eb400ea6d03d789a1b2988494ec6f50d189684915603b0574a6f54cdbcc8132

.dll 164KB

3eb400ea6d03d789a1b2988494ec6f50d189684915603b0574a6f54cdbcc8132

IMPHASH 91315e51e2be1d9d43764929c8c69350
SHA256 3eb400ea6d03d789a1b2988494ec6f50d189684915603b0574a6f54cdbcc8132
MD5 0cc6425f52f7db7d325b5f525f9f6caa
SHA1 04d42163217138af655fcc80b90ddd5b6e8bfba1
SHA512 921801e9432107db01ca18d68c32866fb2769e90ab8d2066cb3a8c8d942a7357095b8817fca0ca98dc90be220f46a394913ea8ab98f4fb931d784cc8f969d9dc
SSDEEP 1536:RI8oIFIJkuvfZ/AuwqQb9nX0SNEHfIjVgLZ+w9HE0BX4CqpiziAq7agHq8GWOka+:RaSyxvfGqanX+UyHl4e+/HkP2z
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

104395

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA ReadFile GetFileSize CreateFileA TerminateThread CreateToolhelp32Snapshot GetCurrentProcessId SetThreadPriority CreateEventA OpenEventA GetTickCount OutputDebugStringA GetCommandLineA GetWindowsDirectoryA Process32Next Process32First WriteFile GetLocalTime CreateProcessA VirtualAlloc VirtualFree GetCurrentThreadId GetSystemDirectoryA DeviceIoControl DisableThreadLibraryCalls MultiByteToWideChar WriteProcessMemory VirtualProtectEx GetLastError SetErrorMode DeleteFileA GlobalUnlock WideCharToMultiByte OpenProcess Sleep TerminateProcess GlobalAlloc GlobalLock GetModuleHandleA LoadLibraryA GetProcAddress GlobalFree GetModuleFileNameA GetCurrentProcess CreateThread CloseHandle ReadProcessMemory ExitProcess IsBadReadPtr

user32

PostThreadMessageA EnumWindows PostMessageA GetWindowTextA GetMessageA wsprintfA GetWindowThreadProcessId GetInputState ClipCursor

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoA InternetOpenUrlA InternetOpenA InternetOpenW InternetOpenUrlW

ws2_32

inet_ntoa getpeername

advapi32

CloseServiceHandle OpenSCManagerA DeleteService OpenServiceA ControlService RegCloseKey RegFlushKey RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

msvcrt

atoi __CxxFrameHandler ??3@YAXPAX@Z wcscmp wcslen strchr strstr strrchr sprintf time malloc free _initterm _adjust_fdiv _stricmp _strlwr srand

Name

.text

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ltata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

l4ata

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

l3ata

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

l2ata

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

l1ata

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ