e7b757203d674167bd435d75fd382b11e366a7ff50da1c8d5dbc5aca1584095a

Sharing

Copy URL Twitter E-mail

General

Target

e7b757203d674167bd435d75fd382b11e366a7ff50da1c8d5dbc5aca1584095a
Size

513KB
MD5

830e1e7cf4300d3cb691137518fca180
SHA1

72acd8dc9ceb9ad6ebf80a4d12f1f7da6cf71fde
SHA256

e7b757203d674167bd435d75fd382b11e366a7ff50da1c8d5dbc5aca1584095a
SHA512

5b6b46801fd3ec83169c8563092412ebd0d63e733c831619a8c1a73918f146894980ca83c78d5ca6faaf467b383358d9ac8dc8eef5cb145fb97ad27ff5a17ca2
SSDEEP

6144:LeSjwyymhPBDlnLHtVJiLxpUJMNbwBGMETKwrDIP1f2rp3vKCL8fS1:KSjwyyuPlltaEvExrDIP1urp3vP8

Score

N/A

Malware Config

Signatures

Files

e7b757203d674167bd435d75fd382b11e366a7ff50da1c8d5dbc5aca1584095a
.exe windows x64

25713d74d695985d0f50dbc71686b46c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExA

kernel32

FreeLibrary
GetModuleHandleW
VirtualFree
WideCharToMultiByte
LoadLibraryW
MultiByteToWideChar
GetLastError
GetProcAddress
VirtualAlloc
ProcessIdToSessionId
LocalAlloc
HeapSetInformation
GetCurrentProcessId
LocalFree
ExpandEnvironmentStringsW
Sleep
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
CreateActCtxW
ReleaseActCtx
GetModuleFileNameW
DeactivateActCtx
ActivateActCtx

msvcrt

_stricmp
_wcsicmp
strstr
printf
_vsnprintf
exit
__wgetmainargs
__C_specific_handler
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
memset
_cexit
_exit
_XcptFilter

ntdll

NtQuerySystemInformation
RtlInitUnicodeString
NtClose
NtOpenFile
DbgPrint
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

rasapi32

RasGetAutodialAddressW
RasGetAutodialParamW
DwRasUninitialize
RasEnumAutodialAddressesW

rasdlg

RasPhonebookDlgW
RasAutodialQueryDlgW
RasDialDlgW

tapi32

lineGetTranslateCapsW
lineShutdown
lineInitialize

ws2_32

WSAStartup

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 496KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

25713d74d695985d0f50dbc71686b46c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

rasapi32

rasdlg

tapi32

ws2_32

Sections

.text Size: 11KB - Virtual size: 11KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 512B - Virtual size: 360B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 82B

.vmp0 Size: 496KB - Virtual size: 1.8MB

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 512B - Virtual size: 360B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 82B

.vmp0
Size: 496KB - Virtual size: 1.8MB