1f10602bdb8f903bd461be376155d69bf7159829a94688c2d2125e79330ec6b4

Sharing

Copy URL Twitter E-mail

General

Target

1f10602bdb8f903bd461be376155d69bf7159829a94688c2d2125e79330ec6b4
Size

121KB
MD5

07a110e2e2aa57edb02b676a50521e50
SHA1

fadb41031293114e9684a829651cfee3e89fa940
SHA256

1f10602bdb8f903bd461be376155d69bf7159829a94688c2d2125e79330ec6b4
SHA512

d8cc37d47dfa1a2f8c01d1dd19b46ba825bf5285b0c3f92f2edbef41ff26261c2c26693ab583ef66d0f6ba961f08f2f359915e9b53203e74d25585f8fd4c0670
SSDEEP

3072:uSj5irAACebr+AqMX+CMsJ1hgdT9tYJq5c7Y1nHsvAj/rZIBeR44mpWrsTSyXdm3:3j5icACebr+AqMX+CMsJ1hgdT9tYJq54

Score

N/A

Malware Config

Signatures

Files

1f10602bdb8f903bd461be376155d69bf7159829a94688c2d2125e79330ec6b4
.exe windows x86

f7b8cbe869a343f05f6a7a889e7b5a1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??1type_info@@UAE@XZ
__CxxFrameHandler3
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_controlfp
_XcptFilter
toupper
_vsnwprintf_s
__RTDynamicCast
memcpy_s
_except_handler4_common
memmove_s
??0exception@@QAE@ABQBD@Z
_exit
_cexit
__wgetmainargs
_callnewh
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
malloc
free
_CxxThrowException
wcsstr
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_purecall
wcstol
_wtoi
exit
_ui64tow_s

ntdll

EtwTraceMessage
EtwGetTraceEnableFlags
EtwEventRegister
EtwEventWrite
EtwEventUnregister
RtlNtStatusToDosErrorNoTeb
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel

api-ms-win-core-localregistry-l1-1-0

RegDeleteTreeW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW

slc

SLGetWindowsInformationDWORD

kernel32

InterlockedDecrement
GetCurrentProcess
TerminateProcess
CreateBoundaryDescriptorW
GetCurrentThreadId
GetTickCount
CreateMutexExW
WaitForSingleObject
HeapSetInformation
SleepEx
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedIncrement
Sleep
InterlockedExchange
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
AddSIDToBoundaryDescriptor
CreatePrivateNamespaceW
OpenPrivateNamespaceW
DeleteBoundaryDescriptor
GetSystemTimeAsFileTime
UnhandledExceptionFilter
QueryPerformanceCounter
GetProcAddress
DelayLoadFailureHook
LocalFree
GetLastError
CloseHandle
DeviceIoControl
CreateFileW
ClosePrivateNamespace
GetCurrentProcessId
ReleaseMutex

appidapi

AppIDEncodeAttributeString
AppIDFreeAttributeString

rpcrt4

UuidToStringW
UuidFromStringW
RpcStringFreeW

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

qarzjub
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f7b8cbe869a343f05f6a7a889e7b5a1d

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

slc

kernel32

appidapi

rpcrt4

Sections

.text Size: 78KB - Virtual size: 78KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 37KB

qarzjub Size: - Virtual size: 4KB

.text
Size: 78KB - Virtual size: 78KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 37KB

qarzjub
Size: - Virtual size: 4KB