fb1472507806379fbec6b6160fcfd2739f316aa723d2ce0e9f28a6773665b996

Sharing

Copy URL Twitter E-mail

General

Target

fb1472507806379fbec6b6160fcfd2739f316aa723d2ce0e9f28a6773665b996
Size

520KB
MD5

81e68b802e853b2919e2b660c60e2282
SHA1

b2b03ac7e058c3b9928e9115d3192029c912eee6
SHA256

fb1472507806379fbec6b6160fcfd2739f316aa723d2ce0e9f28a6773665b996
SHA512

d6264d2b379b1b553330ec765e4b8636741ca31e1c99f6e715104b8d9e3ca009289595e53bbc6f54fafaf0d51b28a582b31efa6befa9ca70e3d8d44e8e8364f6
SSDEEP

12288:YbkdPB9zXZxjCgqhB0JrryRjYQ7OFI2UPxZLXJI:YwdnZxGbcnyFyfUPvJI

Score

N/A

Malware Config

Signatures

Files

fb1472507806379fbec6b6160fcfd2739f316aa723d2ce0e9f28a6773665b996
.exe windows x86

7bbe799b36cf71e8e27873737b95a42c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmDisableIME

kernel32

CreateFileMappingW
OpenFileMappingW
CreateMutexW
OpenMutexW
ReleaseMutex
GetCommandLineW
GetCurrentProcess
GetModuleHandleW
LoadLibraryW
GetModuleFileNameW
GetTempPathW
GetProcAddress
GetCurrentProcessId
InterlockedIncrement
CreateProcessW
MoveFileExW
Sleep
CopyFileW
FileTimeToSystemTime
GetCurrentThreadId
SetFileAttributesW
SetFilePointer
WriteFile
FormatMessageW
SetLastError
LocalFree
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
FindFirstFileW
FindClose
LocalAlloc
FindNextFileW
GetFileSize
ReadFile
FlushFileBuffers
OutputDebugStringW
GetSystemDirectoryW
RemoveDirectoryW
GetTickCount
VirtualQuery
SetUnhandledExceptionFilter
UnmapViewOfFile
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
InitializeCriticalSection
HeapFree
HeapAlloc
TerminateProcess
UnhandledExceptionFilter
HeapReAlloc
GetStartupInfoW
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetDriveTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
RtlUnwind
GetTimeZoneInformation
GetCPInfo
RaiseException
LCMapStringA
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetACP
GetOEMCP
IsValidCodePage
GetFullPathNameW
GetCurrentDirectoryA
GetConsoleCP
GetConsoleMode
GetModuleHandleA
GetStringTypeA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
GetLocaleInfoW
SetStdHandle
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetDriveTypeA
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
MapViewOfFile
CreateDirectoryW
CreateFileW
CloseHandle
CreateEventW
InterlockedExchange
InterlockedCompareExchange
WaitForSingleObject
QueryPerformanceFrequency
LCMapStringW
QueryPerformanceCounter
DeleteFileW
GetLastError

user32

wvsprintfW
GetSystemMetrics
MessageBoxW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

advapi32

SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeAcl
GetNamedSecurityInfoW
RegCloseKey
RegOpenKeyExW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx
LookupAccountSidW
GetTokenInformation
OpenProcessToken
GetSidLengthRequired
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
SetSecurityDescriptorSacl
RegCreateKeyExW
RegQueryValueExW

shell32

SHGetFolderPathW

Sections

.text
Size: 330KB - Virtual size: 329KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7bbe799b36cf71e8e27873737b95a42c

Headers

DLL Characteristics

File Characteristics

Imports

imm32

kernel32

user32

version

advapi32

shell32

Sections

.text Size: 330KB - Virtual size: 329KB

.rdata Size: 125KB - Virtual size: 124KB

.data Size: 17KB - Virtual size: 49KB

.rsrc Size: 47KB - Virtual size: 48KB

.text
Size: 330KB - Virtual size: 329KB

.rdata
Size: 125KB - Virtual size: 124KB

.data
Size: 17KB - Virtual size: 49KB

.rsrc
Size: 47KB - Virtual size: 48KB