800a82e49c157e54219ec9cddbaf80c079fd53b38684c5e1bad91f38e95c673f

Sharing

Copy URL Twitter E-mail

General

Target

800a82e49c157e54219ec9cddbaf80c079fd53b38684c5e1bad91f38e95c673f
Size

819KB
MD5

0ac9639dd120380993af99cd525b1388
SHA1

a60995411b1a6a6be7e14727ed588772d5d742e6
SHA256

800a82e49c157e54219ec9cddbaf80c079fd53b38684c5e1bad91f38e95c673f
SHA512

5474957c7dfd024f2da11eaa38d2963521b3b4e68f0f9387f8f0ee19fa329bac6545f4eb0e8ebb2e275a3be0e94c9cd03337bb602c1280159f47886be42a318d
SSDEEP

24576:A/3NZ/w44lrdLL8NjYrKxA1htgsrVv9prb:A/NZodjLL8NtA1hOsdr

Score

N/A

Malware Config

Signatures

Files

800a82e49c157e54219ec9cddbaf80c079fd53b38684c5e1bad91f38e95c673f
.exe windows x86

badabbd8ddc11ab2ea6ac32618b6ec59

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winscard

SCardRemoveReaderFromGroupA
SCardReleaseNewReaderEvent
SCardListInterfacesA
SCardListReadersA
SCardGetCardTypeProviderNameW
SCardListReadersW
SCardSetCardTypeProviderNameW
SCardGetCardTypeProviderNameA
SCardListInterfacesW
SCardLocateCardsW
SCardListCardsA
SCardConnectA
SCardGetStatusChangeW
SCardEstablishContext
SCardIntroduceReaderW
SCardControl
SCardFreeMemory
SCardForgetReaderW
SCardIntroduceCardTypeA
SCardSetAttrib
SCardAccessNewReaderEvent
SCardIntroduceCardTypeW
SCardLocateCardsByATRW
g_rgSCardT1Pci
g_rgSCardT0Pci
SCardListReaderGroupsW
SCardEndTransaction
SCardAddReaderToGroupW
SCardConnectW
SCardDisconnect
SCardStatusW
SCardGetProviderIdA
SCardIntroduceReaderGroupA

mapistub

EncodeID@12
OpenTnefStream@28
MAPIDeinitIdle@0
MAPIOpenLocalFormContainer@4
HrGetOmiProvidersFlags@8
UlPropSize@4
ScDupPropset@16
MAPIGetDefaultMalloc@0
MAPIAllocateBuffer
GetOutlookVersion@0
MNLS_lstrcmpW@8
CreateIProp@24
MAPIReadMail
ScCopyNotifications@16
FBadEntryList@4
FtNegFt@8
SwapPword@8
ScUNCFromLocalPath@12
MAPIDeleteMail
GetOutlookVersion
FGetComponentPath
EnableIdleRoutine@8
IsBadBoundedStringPtr@8
HrSetOmiProvidersFlagsInvalid@4
__CPPValidateParameters@8
UNKOBJ_ScCOAllocate@12
HrAddColumns@16
MAPISaveMail

sqlunirl

_GetTempPath_@8
_EnumServicesStatus_@32
_ClearEventLog_@8
_EnumWindowStations_@8
_GetWindowText@12
_ReadConsoleInput_@16
_AccessCheckAndAuditAlarm_@44
_CreateMetaFile_@4
_PeekMessage@20
_CreateService_@52
_GetTextMetrics@8
_SetProp@12
_GetAtomName_@12
_DefFrameProc_@20
_GetNamedPipeHandleState_@28
_LoadKeyboardLayout_@8
newMultiByteFromWideCharEx
__lopen_@8
_ReadEventLog_@28
_LoadLibraryEx_@12
_WaitNamedPipe_@8
_ExtractIconEx_@20
_SendDlgItemMessage@20
_DragQueryFile_@16
_GetCharABCWidthsFloat_@16
_RegisterClassEx_@4
_CommDlg_OpenSave_GetSpec@12
_RegDeleteValue_@8
_GetSaveFileName@4
_SetWindowsHook_@8
_DefineDosDevice_@12
_CreateSemaphore_@16
_OpenMutex_@12

kernel32

SetTimerQueueTimer
LocalFileTimeToFileTime
SearchPathA
OutputDebugStringW
GetDefaultCommConfigW
GetModuleHandleA
FindActCtxSectionGuid
SetLastConsoleEventActive
CreateFileMappingW
RemoveDirectoryW
SetCalendarInfoW
GetDiskFreeSpaceExA
GetComputerNameExA
lstrcmpiW
ExitProcess
LoadLibraryA
GetACP
VerSetConditionMask
GetVDMCurrentDirectories
GetLogicalDrives
VirtualAlloc
PeekNamedPipe
WaitForMultipleObjects
SetConsoleInputExeNameW
LockResource
ReadFileScatter
LocalLock
InterlockedExchange
SetEndOfFile
DeactivateActCtx
InterlockedExchangeAdd
CreateJobSet
FindNextVolumeA
SetThreadUILanguage
SetConsoleWindowInfo

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 195KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

badabbd8ddc11ab2ea6ac32618b6ec59

Headers

DLL Characteristics

File Characteristics

Imports

winscard

mapistub

sqlunirl

kernel32

Sections

.text Size: 412KB - Virtual size: 411KB

.rdata Size: 90KB - Virtual size: 90KB

.data Size: 195KB - Virtual size: 1.5MB

.rsrc Size: 119KB - Virtual size: 118KB

.reloc Size: 1024B - Virtual size: 940B

.text
Size: 412KB - Virtual size: 411KB

.rdata
Size: 90KB - Virtual size: 90KB

.data
Size: 195KB - Virtual size: 1.5MB

.rsrc
Size: 119KB - Virtual size: 118KB

.reloc
Size: 1024B - Virtual size: 940B