0dffcba4c1328dc65461c801c51a83dde78c9e70664a02b8b5c30de7e5d64dcf

Sharing

Copy URL Twitter E-mail

General

Target

0dffcba4c1328dc65461c801c51a83dde78c9e70664a02b8b5c30de7e5d64dcf
Size

536KB
MD5

07af7adf89e6b0a232db206e881943c0
SHA1

44f74ccd0274a2bda0d330fbe094fe2274d9d806
SHA256

0dffcba4c1328dc65461c801c51a83dde78c9e70664a02b8b5c30de7e5d64dcf
SHA512

b88ce338ce1359ff8f7d8fa75af4b923d91f31a5ede267a65f1a21b441c314ba782f656c195b737e2b59fc900e815d2384753db0b570f5ef030c0f41901d2476
SSDEEP

12288:1vhcZQ7QcCd9HpbX5ASGfKkyyMLE6MW1AU6BPnnAz+p1qp6:1vPQcCd9Jb5ASGfKkTMLE6MW1AUKPAzM

Score

N/A

Malware Config

Signatures

Files

0dffcba4c1328dc65461c801c51a83dde78c9e70664a02b8b5c30de7e5d64dcf
.exe windows x86

b249b72c79dce3481a9d4310b423c53f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
SetConsoleTextAttribute
HeapAlloc
GetLastError
FindClose
FindNextFileW
FindFirstFileW
SetThreadLocale
GetSystemDefaultLCID
GetLocaleInfoW
GetThreadLocale
GetUserDefaultUILanguage
SetEvent
InterlockedExchange
LocalFree
WriteFile
WriteConsoleW
GetFileType
FormatMessageW
GetModuleHandleW
GetModuleFileNameW
ReadConsoleW
MultiByteToWideChar
ReadFile
SetConsoleMode
GetConsoleMode
SystemTimeToFileTime
FreeLibrary
GetConsoleScreenBufferInfo
CloseHandle
CreateFileW
GetLocalTime
WaitForSingleObject
GetVersionExW
SetConsoleCtrlHandler
CreateEventW
ReleaseMutex
LeaveCriticalSection
CreateThread
EnterCriticalSection
TerminateThread
GetExitCodeThread
CreateMutexW
InitializeCriticalSection
GetComputerNameW
DeleteCriticalSection
HeapValidate
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
GetProcessHeap
HeapFree
LoadLibraryW
GetConsoleOutputCP

msvcrt

wcstod
wcstok
wcsncpy
wprintf
_getmbcp
wcsstr
_wcslwr
_wtoi
fclose
fwprintf
_wfopen
fgetws
_sleep
??2@YAPAXI@Z
_c_exit
_exit
_wcsnicmp
_cexit
__winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
wcslen
_except_handler3
_wcsicmp
_vsnwprintf
exit
??3@YAXPAX@Z
_wtol
_wsplitpath
wcscmp
_XcptFilter
_wmakepath

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

user32

LoadStringW
CharToOemW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

pdh

PdhEnumObjectItemsW
PdhEnumObjectsW
PdhOpenLogW
PdhUpdateLogW
PdhCollectQueryData
PdhGetFormattedCounterArrayW
PdhExpandWildCardPathW
PdhOpenQueryW
PdhAddCounterW
PdhCloseLog
PdhCloseQuery

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b249b72c79dce3481a9d4310b423c53f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

advapi32

user32

version

pdh

Sections

.text Size: 28KB - Virtual size: 27KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 6KB - Virtual size: 6KB

.vmp0 Size: 500KB - Virtual size: 1.6MB

.text
Size: 28KB - Virtual size: 27KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 6KB - Virtual size: 6KB

.vmp0
Size: 500KB - Virtual size: 1.6MB