b890f6c3393e3bb915b9e43a47d10451ddc370356927e0a47991387ea366fe9f

Sharing

Copy URL Twitter E-mail

General

Target

b890f6c3393e3bb915b9e43a47d10451ddc370356927e0a47991387ea366fe9f
Size

32KB
MD5

a2f3f9fdc0c490bc0c536f960761b460
SHA1

07dc8b73a817972cf6f57c3dc7d7293c8ad10907
SHA256

b890f6c3393e3bb915b9e43a47d10451ddc370356927e0a47991387ea366fe9f
SHA512

d7758a985050396a451cbd1a083b6e513213d5bc115e4e3e4f92e84d199e2fe1c7d2b2e8ecae877071c0f0dc3ae47d13849bd658e48dd7cfd34ffdc425c4cf13
SSDEEP

768:I5EDkpG0VUE7ip/qatXf6ZJWiVkkcxTDoLzICsv/jD:I5EwpL7kqYXgrZNkv//

Score

N/A

Malware Config

Signatures

Files

b890f6c3393e3bb915b9e43a47d10451ddc370356927e0a47991387ea366fe9f
.exe windows x86

5b6b488e09f3c1039a05ea7984d16737

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedCompareExchange
CreateThread
LocalFree
CloseHandle
WaitForSingleObject
FreeLibrary
FormatMessageW
LocalAlloc
GetConsoleScreenBufferInfo
GetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
InterlockedExchange
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
Sleep
ExitThread
GetCurrentProcessId
lstrlenW
GetLastError

msvcr80

_initterm
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__winitenv
exit
_XcptFilter
_exit
memset
_cexit
__wgetmainargs
_amsg_exit
wcstok
memcpy
_wtoi
_vsnwprintf_s
_wcsicmp
_initterm_e

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoUninitialize
CoInitializeEx

webengine

IsRegisteredInProc
RemoveAspnetFromIISKey
IsMatchingBitness
CheckIISState
RunningOn64Bit
AspnetLoadResourceDLL
GetExistingVersion
RunAspnetCA
LoadResourceString
ValidateIISPath
RegisterScriptMapsOnVista
GrantAccessToUserAccountOnVista
GrantAccessToUserAccount
RegisterAspNetEx
UnregisterAspNet
RemoveClientScriptFiles
CopyClientScriptFiles
PrintStringToStdOut
CallManagedProtectedConfigAction
IsVista
PrintResourceString
SetRemoteConfigDCOMRegKeys
DetectErrorAndGetLogfileName
ListAspnetInstalledVersions
ListAspnetInstalledIISKeys
RunPkgmgr
PrintResourceStringNoNewLine
GetXSPHeap

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b6b488e09f3c1039a05ea7984d16737

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr80

advapi32

ole32

webengine

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 2KB - Virtual size: 15KB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 2KB - Virtual size: 15KB

.rsrc
Size: 8KB - Virtual size: 8KB