efef3d6da8a7129ebaa682504b2a93b756d1a1992e5cf1261715e716022ec8b4

Sharing

Copy URL Twitter E-mail

General

Target

efef3d6da8a7129ebaa682504b2a93b756d1a1992e5cf1261715e716022ec8b4
Size

52KB
MD5

0d3b9b6d854639945d5775bb6cf1aea2
SHA1

7420fbbe6c6f0621d5a226301306f481a48df18e
SHA256

efef3d6da8a7129ebaa682504b2a93b756d1a1992e5cf1261715e716022ec8b4
SHA512

3cece359c5f1ecb4d20767cd0bd4feb1393586dd06ac1f56fe6c91dd54605f9fa6a36c2e1082d1384e6bdebfc3d4e58ea1b468a1781b265e9d702572143fa7b0
SSDEEP

1536:YwRhNYZpgpuFeRRw7LsqhiAV7eE8eqLhGJwfB+Xm/G7EnFL:ZdYZbFeLw7Lsq4AIEiVGKf0GG7EFL

Score

N/A

Malware Config

Signatures

Files

efef3d6da8a7129ebaa682504b2a93b756d1a1992e5cf1261715e716022ec8b4
.exe windows x86

a9567e26aeb2cc45c0a7984f7c362c64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

DbgPrint
RtlInitUnicodeString
NtOpenKey
NtClose

api-ms-win-core-localregistry-l1-1-0

RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW

api-ms-win-core-processthreads-l1-1-0

SetThreadPriority
GetCurrentThread
CreateThread
GetCurrentProcess
CreateProcessW
OpenProcessToken

user32

CharNextW
GetKeyboardLayout
GetSyvtemMetrics
ExitWindowsEx
MessageBoxW
LoadStringW
LoadRemoteFonts
DefWindowProcW
RegisterClassExW
DestroyWindow
CreateWindowExW
SyvtemParametersInfoW

userenv

ord175

msvcrt

_ismbblead
_XcptFilter
_exit
_cexit
exit
_wcsicmp
memset
memmove
_vsnwprintf
_initterm
_acmdln
_amsg_exit
__setusermatherr
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__getmainargs
__p__commode

kernel32

GetSyvtemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedExchange
LoadLibraryA
RegOpenKeyExA
RegQueryValueExA
ExpandEnvironmentStringsA
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
HeapSetInformation
SetCurrentDirectoryW
FormatMessageW
GetFileAttributesExW
GetSyvtemDirectoryW
SetLastError
ExpandEnvironmentStringsW
GetUserDefaultLangID
SetEvent
OpenEventW
Sleep
WaitForSingleObject
CloseHandle
GetLastError
SetEnvironmentVariableW
SearchPathW
GetCurrentThreadId
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
LocalAlloc
LocalFree
GetVersionExW
lstrlenW

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

dnsokfy
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a9567e26aeb2cc45c0a7984f7c362c64

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

user32

userenv

msvcrt

kernel32

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 29KB

dnsokfy Size: - Virtual size: 4KB

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 29KB

dnsokfy
Size: - Virtual size: 4KB