1cda28e61af17bed48eba139e705e0d88815a4a7f724d3974cd4d2c8ac4acb59

Sharing

Copy URL Twitter E-mail

General

Target

1cda28e61af17bed48eba139e705e0d88815a4a7f724d3974cd4d2c8ac4acb59
Size

102KB
MD5

906c86b158f9c68ccb7a0d7a2cbe64c9
SHA1

f2023a0fd9d1cb8810d5ff4fda7d844f882ea653
SHA256

1cda28e61af17bed48eba139e705e0d88815a4a7f724d3974cd4d2c8ac4acb59
SHA512

d68f6c3024689682d5a3a1dfd831f1015b10ce1774fb56225a1fbc8a1ecef8d3f4aff726ed4c8a4425b0abeea85c2514ca0f9b9a81efb670663c5c41bd6445df
SSDEEP

3072:DFBt0wuwo2dgtor6dMA7Q4HDgNgSkHq0BN3h/q:w2dgto2/7Q4wRkHq0B7q

Score

N/A

Malware Config

Signatures

Files

1cda28e61af17bed48eba139e705e0d88815a4a7f724d3974cd4d2c8ac4acb59
.exe windows x86

bf6c0901d6d5939708b45df16e88c081

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
TraceMessage

kernel32

TerminateProcess
GetCurrentProcess
CloseHandle
WaitForMultipleObjectsEx
CreateProcessW
GetCurrentProcessId
GetCurrentThread
DuplicateHandle
CreateEventW
ReleaseSemaphore
IsDebuggerPresent
WaitForSingleObject
GetCurrentThreadId
AddVectoredExceptionHandler
SetHandleInformation
GetLastError
CreateSemaphoreW
FreeLibrary
GetProcAddress
LoadLibraryW
SetErrorMode
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetModuleHandleExW
HeapSetInformation
GetTempPathW
InterlockedCompareExchange
MoveFileW
CreateFileW
DeleteFileW
OpenProcess
CreateFileMappingW
MapViewOfFile
VirtualLock
VirtualUnlock
UnmapViewOfFile
lstrlenW
GetProcessHeap
HeapFree
CreateToolhelp32Snapshot
Thread32First
GetProcessId
OpenThread
SuspendThread
Thread32Next
InterlockedDecrement
WriteFile
InterlockedIncrement
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
InterlockedExchange
GetTempFileNameW
HeapAlloc

msvcr80

_wtoi64
??3@YAXPAX@Z
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_callnewh
malloc
_set_abort_behavior
wcsstr
memset
_vsnwprintf_s
?terminate@@YAXXZ
memcpy

ole32

CoInitializeSecurity
CoUninitialize
CoInitializeEx

shlwapi

StrStrIW
PathFindExtensionW
PathFindFileNameW

oleaut32

SetOaNoCache

faultrep

ReportFault

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.mdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bf6c0901d6d5939708b45df16e88c081

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcr80

ole32

shlwapi

oleaut32

faultrep

psapi

version

Sections

.text Size: 15KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 916B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 912B

.mdata Size: 76KB - Virtual size: 76KB

.text
Size: 15KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 916B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 912B

.mdata
Size: 76KB - Virtual size: 76KB