5d84ca1eef5c14e3a1be82f07a7dc1069141477a0a015845d4059a35b8b8982d

Sharing

Copy URL Twitter E-mail

General

Target

5d84ca1eef5c14e3a1be82f07a7dc1069141477a0a015845d4059a35b8b8982d
Size

32KB
MD5

0d2914fb816feb19f4093c0f962b6f10
SHA1

de9cd47c7af08b3f147dd2c11a1f4afe4cd88af0
SHA256

5d84ca1eef5c14e3a1be82f07a7dc1069141477a0a015845d4059a35b8b8982d
SHA512

945f8190c70324c601037e19cc03384d1d860434f5c8e3992e5459bcdad973f4e6d7e15fca7e5983491ace4d5fc1278a71c5e6516b8f588920410d59e81867e3
SSDEEP

768:L5EDkpG0VUE7ip/qatXf6ZJAiVkkmKoH/MS6eS+:L5EwpL7kqYXgtZmJH/MJeS+

Score

N/A

Malware Config

Signatures

Files

5d84ca1eef5c14e3a1be82f07a7dc1069141477a0a015845d4059a35b8b8982d
.exe windows x86

5b6b488e09f3c1039a05ea7984d16737

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedCompareExchange
CreateThread
LocalFree
CloseHandle
WaitForSingleObject
FreeLibrary
FormatMessageW
LocalAlloc
GetConsoleScreenBufferInfo
GetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
InterlockedExchange
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
Sleep
ExitThread
GetCurrentProcessId
lstrlenW
GetLastError

msvcr80

_initterm
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__winitenv
exit
_XcptFilter
_exit
memset
_cexit
__wgetmainargs
_amsg_exit
wcstok
memcpy
_wtoi
_vsnwprintf_s
_wcsicmp
_initterm_e

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoUninitialize
CoInitializeEx

webengine

IsRegisteredInProc
RemoveAspnetFromIISKey
IsMatchingBitness
CheckIISState
RunningOn64Bit
AspnetLoadResourceDLL
GetExistingVersion
RunAspnetCA
LoadResourceString
ValidateIISPath
RegisterScriptMapsOnVista
GrantAccessToUserAccountOnVista
GrantAccessToUserAccount
RegisterAspNetEx
UnregisterAspNet
RemoveClientScriptFiles
CopyClientScriptFiles
PrintStringToStdOut
CallManagedProtectedConfigAction
IsVista
PrintResourceString
SetRemoteConfigDCOMRegKeys
DetectErrorAndGetLogfileName
ListAspnetInstalledVersions
ListAspnetInstalledIISKeys
RunPkgmgr
PrintResourceStringNoNewLine
GetXSPHeap

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.TOT
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b6b488e09f3c1039a05ea7984d16737

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr80

advapi32

ole32

webengine

Sections

.text Size: 18KB - Virtual size: 17KB

.data Size: 2KB - Virtual size: 15KB

.rsrc Size: 2KB - Virtual size: 1KB

.TOT Size: 9KB - Virtual size: 9KB

.text
Size: 18KB - Virtual size: 17KB

.data
Size: 2KB - Virtual size: 15KB

.rsrc
Size: 2KB - Virtual size: 1KB

.TOT
Size: 9KB - Virtual size: 9KB