ff8b7cc5490bc278fc26c5ea5bc010a9800e2c6086a4e32dc2658ee8209411ba

Sharing

Copy URL Twitter E-mail

General

Target

ff8b7cc5490bc278fc26c5ea5bc010a9800e2c6086a4e32dc2658ee8209411ba
Size

595KB
MD5

a3920c30c721f21f54d726b073b4e810
SHA1

90cd943ec8445545274f2584159fc0ec70456963
SHA256

ff8b7cc5490bc278fc26c5ea5bc010a9800e2c6086a4e32dc2658ee8209411ba
SHA512

cde078a51662b097785c445a733605070292f649c25e5f0a687f604100196419c8fcf5f2ca7479a4d1ade88a4871e37babb018f895be2befc5993044dd2ea1c2
SSDEEP

12288:nmTUAoXLMPLD3bQfLz/ts+4OPs+b2ieTNxs/BzFxiFp:qUAoXIPLD3bQTz1PJb2LT/mxF8j

Score

N/A

Malware Config

Signatures

Files

ff8b7cc5490bc278fc26c5ea5bc010a9800e2c6086a4e32dc2658ee8209411ba
.exe windows x64

bcef50d6d0b94f36b0c93fed960f3837

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
EventWrite
GetTraceEnableFlags
RegQueryValueExW
GetTraceLoggerHandle
UnregisterTraceGuids
RegOpenKeyExW
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW
RegSetValueExW
QueryServiceConfigW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenServiceW
OpenSCManagerW
OpenProcessToken
CloseServiceHandle
EnumServicesStatusExW

kernel32

CreateDirectoryW
WaitForSingleObject
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
WriteFile
GetProcessTimes
K32GetModuleFileNameExW
HeapFree
ReadProcessMemory
GetVersionExW
CreateFileW
GetTempPathW
GetLastError
GetProcAddress
IsWow64Process
CreateFileMappingW
SetConsoleCtrlHandler
RemoveDirectoryW
WaitForMultipleObjects
HeapSetInformation
SetProcessShutdownParameters
CloseHandle
DeleteFileW
GetCurrentProcessId
LocalAlloc
GetCurrentProcess
HeapAlloc
FreeLibrary
GetProcessId
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetTempFileNameW
LoadLibraryW
Sleep
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
TerminateProcess
UnhandledExceptionFilter
OpenProcess
GetModuleFileNameW
SetLastError
LocalFree

user32

LoadStringW

msvcrt

?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_wtol
_vsnwprintf
qsort
_wcsicmp
memset
_amsg_exit
wcsrchr
memcpy

ntdll

NtSetEvent
NtQueryInformationThread
RtlFreeHeap
NtQueryInformationProcess
NtWaitForSingleObject
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtResetEvent
NtDuplicateObject
NtOpenProcess
NtReleaseMutant
RtlReleaseSRWLockExclusive
NtCreateMutant
NtCreateEvent
RtlAllocateHeap
NtCreateThreadEx
RtlAcquireSRWLockExclusive
NtClose
RtlNtStatusToDosError
RtlCreateProcessReflection
EtwEventRegister
EtwEventUnregister
RtlInitUnicodeString
RtlEqualUnicodeString

wer

WerReportSetParameter
WerReportSubmit
WerReportCreate
WerReportAddFile
WerReportCloseHandle

shlwapi

ord348

dbghelp

MiniDumpWriteDump

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 556KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bcef50d6d0b94f36b0c93fed960f3837

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

wer

shlwapi

dbghelp

version

Sections

.text Size: 31KB - Virtual size: 31KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 672B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 556KB - Virtual size: 2.4MB

.text
Size: 31KB - Virtual size: 31KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 672B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 556KB - Virtual size: 2.4MB