9995fb24697a409c7f5862508987e26fe1fd119cfa77c8f0724721b89e1badc0

Sharing

Copy URL Twitter E-mail

General

Target

9995fb24697a409c7f5862508987e26fe1fd119cfa77c8f0724721b89e1badc0
Size

155KB
MD5

0c1837e0fa2f0b4118df3ed1da7137a0
SHA1

a9d404d78b492eb67f12c045362c88253859e405
SHA256

9995fb24697a409c7f5862508987e26fe1fd119cfa77c8f0724721b89e1badc0
SHA512

16c4de52b513f9d33c805f24d7901862580de2efa1a6b5c8528e55e8bdeb64cddf38e83ef830909a51b895a6081220bf88e48d0b662e6afa65ed81dd0af8e44d
SSDEEP

3072:w18h1E8Nko2jdinTCqzZvEmEmZ7Zw5LZNc8QsNHXkJDliC6h3h7bmgDtgF8AvZ5m:wKocugTnvEmEmWZNc8QsNHCDliltDK8Z

Score

N/A

Malware Config

Signatures

Files

9995fb24697a409c7f5862508987e26fe1fd119cfa77c8f0724721b89e1badc0
.exe windows x86

5f12b97f80fe2ab2237067c49403de99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

_stricmp
_strnicmp
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
strerror
realloc
atoi
memmove
islower
isdigit
modf
_environ
_wenviron
fprintf
__iob_func
wcsncmp
isalpha
wcschr
_errno
_strtoi64
memchr
_close
tolower
bsearch
malloc
free
memcpy
signal
strncmp
memset
strchr
strrchr
strstr
exit
_getpid

wsock32

ntohl
WSAStartup
WSACleanup

kernel32

GetCurrentThreadId
LoadLibraryA
GetVersionExA
SetEvent
ReleaseMutex
GetProcAddress
SetErrorMode
LoadLibraryExW
FreeLibrary
GetEnvironmentVariableW
GetCommandLineW
GlobalFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsFree
TlsAlloc
SetCurrentDirectoryW
GetCurrentDirectoryW
GetCurrentProcessId
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetFileAttributesExW
GetFullPathNameW
GetFileType
LocalFree
RemoveDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetStdHandle
DeleteFileW
CreateFileW
CloseHandle
SetStdHandle
GetFileInformationByHandle
DeviceIoControl
LockFile
LockFileEx
UnlockFile
UnlockFileEx
TerminateProcess
InterlockedExchange
InterlockedCompareExchange
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FormatMessageA
GetCurrentProcess
GetOverlappedResult
CancelIo
WaitForSingleObject
ReadFile
GetLastError
PeekNamedPipe
WriteFile
CreateEventA
SetFilePointer
SetLastError
Sleep
GetSystemTimeAsFileTime

advapi32

FreeSid
AllocateAndInitializeSid
GetSecurityInfo
GetNamedSecurityInfoA
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW

shell32

CommandLineToArgvW

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5f12b97f80fe2ab2237067c49403de99

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

wsock32

kernel32

advapi32

shell32

Sections

.text Size: 49KB - Virtual size: 48KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 83KB - Virtual size: 84KB

.text
Size: 49KB - Virtual size: 48KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 83KB - Virtual size: 84KB