3eaa8dd3e17b6bd73cd7eb056aa2168a2309988a0ad8e0042fbce54ea262ccb0

Sharing

Copy URL Twitter E-mail

General

Target

3eaa8dd3e17b6bd73cd7eb056aa2168a2309988a0ad8e0042fbce54ea262ccb0
Size

633KB
MD5

02367faac42ac388930638e7484ead10
SHA1

2c6e44c2556d2ffc697bc27ab2078c905e4be660
SHA256

3eaa8dd3e17b6bd73cd7eb056aa2168a2309988a0ad8e0042fbce54ea262ccb0
SHA512

d729498a77c8f1383d8cdba06175ea3ef1e8fe504c83acb68906cd2ab1a601a7653f9909410b5cc33d2451507d360f630e50b8e65d70b43944774009af23e5d5
SSDEEP

12288:s8oIyVriohhymA63FziDLbdqRIkguAhuSES8l1C1VxJwjj:uFVriohhJ3ZiDLhHkTAMmxJoj

Score

N/A

Malware Config

Signatures

Files

3eaa8dd3e17b6bd73cd7eb056aa2168a2309988a0ad8e0042fbce54ea262ccb0
.exe windows x64

240f4e74361bde4965be9ee15732ccf6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LCMapStringW
CloseHandle
HeapSetInformation
SetThreadPreferredUILanguages
GetModuleHandleW
GetCommandLineA
GetCurrentProcessId
RegisterApplicationRestart
GetConsoleOutputCP
WideCharToMultiByte
GetStdHandle
WriteFile
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
GetCommandLineW
CreateProcessW
LoadLibraryExA
DelayLoadFailureHook
UnhandledExceptionFilter
Sleep
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess

msvcrt

exit
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
memset
_cexit
_exit
__C_specific_handler
__wgetmainargs
_vsnwprintf
atoi
isspace
mbstowcs
strspn
setlocale
_vsnprintf
_XcptFilter
__CxxFrameHandler3

wbemcomn

?GetMemLogObject@@YAPEAVCMemoryLog@@XZ
?Write@CMemoryLog@@QEAAXJ@Z
?DebugTrace@@YAHDPEBDZZ
?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z
?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z
?EnablePrivilege@@YAHKJ@Z
?GetWMIADAPCmdLine@@YAPEAGH@Z

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwTraceMessage

shell32

CommandLineToArgvW

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 556KB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

240f4e74361bde4965be9ee15732ccf6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

wbemcomn

ntdll

shell32

Sections

.text Size: 12KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 14KB

.pdata Size: 512B - Virtual size: 444B

.rsrc Size: 63KB - Virtual size: 62KB

.reloc Size: 556KB - Virtual size: 2.4MB

.text
Size: 12KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 14KB

.pdata
Size: 512B - Virtual size: 444B

.rsrc
Size: 63KB - Virtual size: 62KB

.reloc
Size: 556KB - Virtual size: 2.4MB