effd8bf2db8fd2100b13ecd4036876dd2c90d7a3076afe29e0d347bfdfbaec10

Sharing

Copy URL

Twitter E-mail

General

Target

effd8bf2db8fd2100b13ecd4036876dd2c90d7a3076afe29e0d347bfdfbaec10
Size

851KB
MD5

0c1b0427cebca55d40be858f25d40140
SHA1

90cdea7eaa5b3d2e1a2abc474b20da74bc3ee6fa
SHA256

effd8bf2db8fd2100b13ecd4036876dd2c90d7a3076afe29e0d347bfdfbaec10
SHA512

96a7e87e8b2d761b6707523f2aeeaac181aa07165b6473323f2473dbda857917148f232d9933a543087bf08811f8ddabb498b9d9468ff0b707a9478c23fdd444
SSDEEP

24576:fH6YJjVaCaTidB8oz6zPRGMfZu6sR6t2q:iYJBdaTxGpY2q

Score

N/A

Malware Config

Signatures

Files

effd8bf2db8fd2100b13ecd4036876dd2c90d7a3076afe29e0d347bfdfbaec10
.dll windows x86

425b64334ee18e882811879422b116dd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
DeleteFileA
CreateDirectoryA
GetModuleFileNameA
ExpandEnvironmentStringsA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
UnmapViewOfFile
GetFullPathNameA
GetFileAttributesA
SetFilePointer
FindClose
VirtualProtect
VirtualAlloc
DuplicateHandle
MapViewOfFile
CreateFileMappingA
GetModuleHandleA
OpenProcess
GetCurrentProcessId
VirtualFree
ReadProcessMemory
WriteFile
DeleteFileW
CreateFileW
SetErrorMode
DebugBreak
GetSystemDirectoryA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
FreeLibrary
OutputDebugStringA
lstrlenA
IsDBCSLeadByte
HeapFree
HeapAlloc
HeapReAlloc
TlsFree
TlsAlloc
GetVersionExA
InitializeCriticalSection
FlushViewOfFile
MapViewOfFileEx
GetFileType
CreateFileMappingW
DeviceIoControl
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LCMapStringW
LCMapStringA
CopyFileA
SetFileAttributesA
CopyFileW
GetFileAttributesW
SetFileAttributesW
InterlockedIncrement
InterlockedDecrement
Sleep
FormatMessageA
GetThreadSelectorEntry
CreateThread
TerminateThread
LoadLibraryW
VirtualQueryEx
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
ResumeThread
HeapCreate
DeleteCriticalSection
LocalFree
HeapDestroy
TlsGetValue
TlsSetValue
GetLastError
CreateFileA
GetFileSize
ReadFile
CloseHandle
EnterCriticalSection
LeaveCriticalSection
LocalAlloc
FindFirstFileA
FindNextFileA
SetLastError
GetEnvironmentVariableA
GetSystemInfo
GetVersionExW
SuspendThread

msvcrt

__dllonexit
_adjust_fdiv
_initterm
_wcsnicmp
isprint
_vsnwprintf
memmove
calloc
wcscat
strncat
_itoa
_vsnprintf
_write
strncpy
_strcmpi
strrchr
tolower
_close
_open
time
wcsncpy
_ltoa
_strnicmp
vsprintf
_stricmp
isspace
ctime
malloc
_strlwr
free
__CxxFrameHandler
fclose
_wcsicmp
_onexit
wcscmp
wcsncmp
_wsplitpath
towlower
__unDName
_CxxThrowException
bsearch
_snwprintf
fread
fseek
_wfopen
fopen
_osver
wcstol
wcsrchr
_wmakepath
wcscpy
_winminor
_winmajor
_wcsdup
ftell
_wgetenv
_mbsicmp
_fullpath
_access
_fsopen
_wfsopen
_sopen
_wsopen
_wfullpath
_get_osfhandle
_read
_lseeki64
_chsize
_open_osfhandle
_mbscmp
_memicmp
_mbsnbcpy
??1type_info@@UAE@XZ
?terminate@@YAXXZ
sprintf
_except_handler3
wcslen
qsort
strchr
strstr
strncmp
isxdigit
??2@YAPAXI@Z
??3@YAXPAX@Z
_splitpath
_purecall
atol

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA

rpcrt4

UuidCreate

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumerateLoadedModules
EnumerateLoadedModules64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindExecutableImage
FindExecutableImageEx
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
StackWalk
StackWalk64
SymAddSymbol
SymCleanup
SymDeleteSymbol
SymEnumLines
SymEnumSourceFiles
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumTypes
SymEnumerateModules
SymEnumerateModules64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindFileInPath
SymFromAddr
SymFromIndex
SymFromName
SymFromToken
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory
SymGetLineFromAddr
SymGetLineFromAddr64
SymGetLineFromName
SymGetLineFromName64
SymGetLineNext
SymGetLineNext64
SymGetLinePrev
SymGetLinePrev64
SymGetModuleBase
SymGetModuleBase64
SymGetModuleInfo
SymGetModuleInfo64
SymGetModuleInfoW
SymGetModuleInfoW64
SymGetOptions
SymGetScope
SymGetSearchPath
SymGetSourceFile
SymGetSourceFileFromToken
SymGetSourceFileToken
SymGetSourceVarFromToken
SymGetSymFromAddr
SymGetSymFromAddr64
SymGetSymFromName
SymGetSymFromName64
SymGetSymNext
SymGetSymNext64
SymGetSymPrev
SymGetSymPrev64
SymGetTypeFromName
SymGetTypeInfo
SymInitialize
SymLoadModule
SymLoadModule64
SymLoadModuleEx
SymMatchFileName
SymMatchString
SymMatchStringW
SymNext
SymPrev
SymRegisterCallback
SymRegisterCallback64
SymRegisterFunctionEntryCallback
SymRegisterFunctionEntryCallback64
SymSearch
SymSetContext
SymSetHomeDirectory
SymSetOptions
SymSetParentWindow
SymSetSearchPath
SymUnDName
SymUnDName64
SymUnloadModule
SymUnloadModule64
UnDecorateSymbolName
UnmapDebugInformation
WinDbgExtensionDllInit
dbghelp
dh
fptr
lm
lmi
omap
srcfiles
stackdbg
sym
symsrv
vc7fpo

Sections

.text
Size: 733KB - Virtual size: 732KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

425b64334ee18e882811879422b116dd

Headers

File Characteristics

Imports

kernel32

msvcrt

advapi32

rpcrt4

Exports

Exports

Sections

.text Size: 733KB - Virtual size: 732KB

.data Size: 10KB - Virtual size: 37KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 49KB - Virtual size: 48KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 733KB - Virtual size: 732KB

.data
Size: 10KB - Virtual size: 37KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 49KB - Virtual size: 48KB

.rmnet
Size: 56KB - Virtual size: 60KB