Nicht bestätigt 453508[.]crdownload

Sharing

Copy URL

Twitter E-mail

General

Target

Nicht bestätigt 453508.crdownload
Size

474KB
MD5

c3f1890b2500aeac479e37f73eea0ec2
SHA1

eeb50792bfe5e81aa3cff3652508f665e9d7f887
SHA256

3618de137401109d9fc1a438649b31fc7d86e5df915d5e1d8c1232a2f0f5d714
SHA512

d531a17fb1689fadde03c60a011e619ecd98106950b1887d4a3ee7c4edb3e9f1c26a5208955428a5c095d1348a96db76127160ee0b682857c8c56393488b255c
SSDEEP

12288:hBNwkaunbTPnFsSAKRzyfh3mnIFhlYw/5/UHWsK8pFqZmDbHitMrMcKsZ:hkkMbtKWsjymXHNMg

Score

N/A

Malware Config

Signatures

Files

Nicht bestätigt 453508.crdownload
.exe windows x86

f3cf6303cb5edf5f73e91dca3a8ce99f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
WriteFile
GetCurrentDirectoryA
CreateProcessA
GetLastError
GetFileSize
CreateFileA
DeleteFileA
CloseHandle
DeleteCriticalSection
WaitForMultipleObjects
GetExitCodeThread
EnterCriticalSection
GetStdHandle
SetConsoleTitleA
LeaveCriticalSection
WaitForSingleObject
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentProcessId
DecodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
GetFileSizeEx
VerSetConditionMask
VerifyVersionInfoW
MoveFileExA
WideCharToMultiByte
MultiByteToWideChar
GetEnvironmentVariableA
SetLastError
FormatMessageW
QueryPerformanceCounter
GetTickCount
GetFileType
PeekNamedPipe
ReadFile
SleepEx
QueryPerformanceFrequency
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
GetTempPathA
GetModuleFileNameA
GetVolumeInformationA
InitializeCriticalSection
GetComputerNameA
GetCurrentThreadId
GetLocalTime
Sleep
SystemTimeToFileTime

user32

MessageBoxA

advapi32

CryptGetHashParam
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptCreateHash
CryptHashData
GetUserNameA

shell32

ShellExecuteA

libcryptomd

RSA_new
BIO_ctrl
BIO_new
PEM_write_bio_RSA_PUBKEY
RSA_verify
BN_new
PEM_read_bio_RSA_PUBKEY
PEM_read_bio_RSAPrivateKey
RSA_private_decrypt
BIO_new_mem_buf
SHA1
BN_set_word
BIO_free_all
BIO_read
RSA_free
RSA_generate_key_ex
ERR_remove_state
ERR_remove_thread_state
SHA256
EVP_DecryptFinal
EVP_DecryptUpdate
EVP_EncryptInit
EVP_EncryptUpdate
EVP_DecryptInit
RAND_bytes
EVP_EncryptFinal
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_new
EVP_aes_256_cbc
BIO_s_mem
PEM_write_bio_RSAPrivateKey
RSA_public_encrypt

ws2_32

freeaddrinfo
__WSAFDIsSet
select
listen
accept
recvfrom
sendto
WSASetLastError
connect
socket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
recv
WSACloseEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
getaddrinfo
WSACreateEvent
WSAGetLastError
send
closesocket
inet_ntoa
WSAStartup
WSACleanup
gethostbyname
gethostname
ioctlsocket
WSAResetEvent
htonl

crypt32

CryptDecodeObjectEx
CryptQueryObject
CertAddCertificateContextToStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertEnumCertificatesInStore
CertOpenStore
CryptStringToBinaryA
CertCloseStore
CertFindCertificateInStore
PFXImportCertStore
CertGetCertificateChain
CertCreateCertificateChainEngine
CertFreeCertificateContext

wldap32

ord50
ord26
ord30
ord200
ord32
ord22
ord217
ord33
ord301
ord27
ord41
ord46
ord60
ord45
ord79
ord211
ord35
ord143

normaliz

IdnToAscii

msvcr100

_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
isupper
strftime
_strtoi64
_access
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_invoke_watson
_controlfp_s
_strdup
_unlink
_read
_write
_close
__set_app_type
_stat64
_open
_gmtime64
fputc
__sys_nerr
__sys_errlist
wcstombs
strspn
strcspn
_lseeki64
_fstat64
memchr
_getpid
atoi
_fdopen
strpbrk
ftell
memmove
feof
strrchr
fputs
strtoul
sprintf
free
malloc
strtol
sscanf
strstr
strtok_s
strncat
qsort
strchr
strncpy
strtok
realloc
_difftime64
_time64
fgets
printf
fopen
fread
fseek
fclose
exit
strncmp
isspace
scanf
__iob_func
fflush
tolower
_beginthreadex
fprintf
_kbhit
_getch
sprintf_s
fwrite
memcpy
calloc
memset
_errno

Sections

.text
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3cf6303cb5edf5f73e91dca3a8ce99f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

libcryptomd

ws2_32

crypt32

wldap32

normaliz

msvcr100

Sections

.text Size: 377KB - Virtual size: 377KB

.rdata Size: 66KB - Virtual size: 65KB

.data Size: 2KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 377KB - Virtual size: 377KB

.rdata
Size: 66KB - Virtual size: 65KB

.data
Size: 2KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 19KB - Virtual size: 18KB