a0723318f5cfa430f48a2aeaecb0840f5b970453e789b6810ff869eaeb049c1d

Sharing

Copy URL Twitter E-mail

General

Target

a0723318f5cfa430f48a2aeaecb0840f5b970453e789b6810ff869eaeb049c1d
Size

552KB
MD5

05cafe6f2adfade4e15be4e77b0ff2e0
SHA1

a05b5bc696f427735da1f000ec5618c380cd6a8f
SHA256

a0723318f5cfa430f48a2aeaecb0840f5b970453e789b6810ff869eaeb049c1d
SHA512

3b935d4a5df15b4ca3d2279fff8a9a697ebb077c4796265fb4224375bce2c63df57702a8db4e8506a7027f171e6d37d60ba37774fa41f8597f64f5e280a3d1e5
SSDEEP

12288:MZnWY9ijBl7h+puTrwjSI1kmmc9F6y/vA:MIj/7h+puGXmc9Yy/I

Score

N/A

Malware Config

Signatures

Files

a0723318f5cfa430f48a2aeaecb0840f5b970453e789b6810ff869eaeb049c1d
.exe windows x86

88f5b8a224e2f6213bcef481dff428b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW

kernel32

UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount
LocalAlloc
CloseHandle
GetCommandLineW
LocalFree
GetLastError
CreateMutexW
GetCurrentProcess
SetUnhandledExceptionFilter

msvcrt

_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_vsnwprintf
_wcsicmp

crypt32

CryptStringToBinaryW
CertFreeCertificateContext
CryptBinaryToStringW

shell32

CommandLineToArgvW

efsadu

EfsUIUtilKeyBackup
EfsUIUtilSelectCard
EfsUIUtilPromptForPin
EfsUIUtilEnrollEfsCertificate
EfsUIUtilInstallDra
EfsUIUtilEncryptMyDocuments
EfsUIUtilShowBalloonAndWait

efsutil

EfsUtilGetCurrentKey

ntdll

RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp1
Size: 540KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

88f5b8a224e2f6213bcef481dff428b6

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

crypt32

shell32

efsadu

efsutil

ntdll

Sections

.text Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 920B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 604B

.vmp1 Size: 540KB - Virtual size: 1.6MB

.text
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 920B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 604B

.vmp1
Size: 540KB - Virtual size: 1.6MB