48b0296f5d41d6f948986b58a8844e3266521b170639cd2a9972193aebd867fc

Sharing

Copy URL Twitter E-mail

General

Target

48b0296f5d41d6f948986b58a8844e3266521b170639cd2a9972193aebd867fc
Size

525KB
MD5

0dc2416657025248f6e132ede2f29be0
SHA1

7fa6ec22a2e702142562d338252cf1c6ec53938a
SHA256

48b0296f5d41d6f948986b58a8844e3266521b170639cd2a9972193aebd867fc
SHA512

be3445c241ded98a39d4e31e88f4e96bd235652078a26e6ad96dfef480521e4abafa1959e31adbcbb69923082055e0d9926c4defd8411e3e9762fd3b5eb9ca9d
SSDEEP

12288:5Xs5zyXFBZ3iHI/qqn41dgXdKU44P3BwWuSOS+m26bEL:dHeICsbwW7XG

Score

N/A

Malware Config

Signatures

Files

48b0296f5d41d6f948986b58a8844e3266521b170639cd2a9972193aebd867fc
.exe windows x64

ffc6eebe492057f0ad89da0c93ccaf02

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

kernel32

DelayLoadFailureHook
LoadLibraryExA
CloseHandle
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
LeaveCriticalSection
SetThreadpoolWait
CreateThreadpoolWait
WaitForSingleObject
EnterCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
DeleteCriticalSection
InitializeCriticalSection
CompareStringW
GetCurrentProcess
HeapSetInformation
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OpenProcess
K32GetModuleFileNameExW
OpenThread
GetThreadContext
RtlCompareMemory
DuplicateHandle
GetThreadPriority
GetCurrentThread
SetThreadPriority
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OutputDebugStringA
SetErrorMode
GetLastError
SetEnvironmentVariableW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

msvcrt

_wtoi
_wtoi64
_wcsicmp
_vsnprintf
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memset
__CxxFrameHandler3
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_vsnwprintf

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ShipAssert
NtQueryInformationProcess
EtwTraceMessage
DbgPrint

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ffc6eebe492057f0ad89da0c93ccaf02

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

faultrep

Sections

.text Size: 21KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 768B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 154B

.vmp0 Size: 500KB - Virtual size: 1.8MB

.text
Size: 21KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 768B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 154B

.vmp0
Size: 500KB - Virtual size: 1.8MB