fab0afd1a8bbe36b8ff4a7157764ad22434a292b629b67bec525cdb550161064

Sharing

Copy URL Twitter E-mail

General

Target
fab0afd1a8bbe36b8ff4a7157764ad22434a292b629b67bec525cdb550161064
Size 645KB
Sample221106-mttjgsaear
SHA256 fab0afd1a8bbe36b8ff4a7157764ad22434a292b629b67bec525cdb550161064
MD5 1ad77928009825b615b9a8e90abe0e10
SHA1 76e0d078d2d3bec754eff424e34bd11191fdd80f
SHA512 5113905178aea5f1e6fd0276b79d26ba276c4a68fad713089c8a7a77b4fb8b8bd93bd0bb934e43c0cfef78dc7df80227c8361bbe8002f9f9ab7b1a20c78f62a9
SSDEEP 12288:NtKe6Zv23YdqMGHGSX1388BxGVI43GVpinJMcOf9GUfRNNgh0Ti2T:d6Zv2jbW1SaRsRTdT
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

fab0afd1a8bbe36b8ff4a7157764ad22434a292b629b67bec525cdb550161064

.exe 645KB

fab0afd1a8bbe36b8ff4a7157764ad22434a292b629b67bec525cdb550161064

IMPHASH 6f259aa39ae2d65ed9443828fb4ac812
SHA256 fab0afd1a8bbe36b8ff4a7157764ad22434a292b629b67bec525cdb550161064
MD5 1ad77928009825b615b9a8e90abe0e10
SHA1 76e0d078d2d3bec754eff424e34bd11191fdd80f
SHA512 5113905178aea5f1e6fd0276b79d26ba276c4a68fad713089c8a7a77b4fb8b8bd93bd0bb934e43c0cfef78dc7df80227c8361bbe8002f9f9ab7b1a20c78f62a9
SSDEEP 12288:NtKe6Zv23YdqMGHGSX1388BxGVI43GVpinJMcOf9GUfRNNgh0Ti2T:d6Zv2jbW1SaRsRTdT
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

54576

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

GetUserNameA RegOpenKeyExA RegCreateKeyA RegQueryValueExA RegCloseKey RegSetValueExA RegDeleteValueA RegDeleteKeyA RegEnumKeyA RegEnumValueA LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges OpenSCManagerA EnumServicesStatusA CloseServiceHandle OpenServiceA ControlService StartServiceA

gdi32

GetStockObject CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits DeleteDC

kernel32

GetVersion GetWindowsDirectoryA GetSystemDirectoryA GetModuleFileNameA GetVolumeInformationA Sleep DeleteFileA OpenProcess TerminateProcess OpenMutexA CreateMutexA CloseHandle SetErrorMode GetLastError CreateThread CopyFileA MoveFileA RemoveDirectoryA CreateDirectoryA CreateFileA GetFileTime CompareFileTime GetFileSize SetFilePointer WriteFile SetFileTime LoadLibraryA GetProcAddress FreeLibrary GetVersionExA GetComputerNameA GetLocaleInfoA GetSystemTime GetLocalTime GlobalMemoryStatus GetTickCount WideCharToMultiByte GetDriveTypeA FindFirstFileA FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileA FindClose GetCurrentProcess SetPriorityClass GetCurrentProcessId CreateProcessA GetStdHandle GetFileType ReadFile ExitProcess GetCommandLineA GetStartupInfoA GetModuleHandleA TlsAlloc TlsFree TlsSetValue TlsGetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentStrings FreeEnvironmentStringsA GlobalAlloc GlobalFree

mpr

WNetAddConnection2A WNetCancelConnectionA WNetOpenEnumA WNetEnumResourceA WNetCloseEnum

rasapi32

RasEnumEntriesA RasGetEntryDialParamsA

user32

MessageBoxA LoadCursorA LoadIconA RegisterClassA CreateWindowExA ShowWindow SetTimer GetMessageA TranslateMessage DispatchMessageA MessageBeep PostMessageA GetSystemMetrics mouse_event GetDoubleClickTime DefWindowProcA OemToCharBuffA EnumDisplaySettingsA CharToOemA PostQuitMessage GetCursorPos KillTimer CharUpperBuffA GetDC ReleaseDC ExitWindowsEx EnumWindows GetWindowTextA GetClassNameA GetWindowThreadProcessId IsWindowVisible GetWindowPlacement

wsock32

WSAStartup closesocket WSACleanup accept WSAAsyncSelect recv send recvfrom htons socket bind listen gethostname gethostbyname ntohl ioctlsocket WSAAsyncGetHostByName connect

Name

.text

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.exc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sdata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE