6b29e41638d81bc8204c2d1743225cb6a5f27693cf98d7156eca0b4c4bb7f4c1

Sharing

Copy URL Twitter E-mail

General

Target

6b29e41638d81bc8204c2d1743225cb6a5f27693cf98d7156eca0b4c4bb7f4c1
Size

743KB
MD5

1ade9e598cb4ea9d3434af5b09403b00
SHA1

cefc371734ec7513725be3eafafcda33b3dddddf
SHA256

6b29e41638d81bc8204c2d1743225cb6a5f27693cf98d7156eca0b4c4bb7f4c1
SHA512

d837252bd2b409ec05cdc4149fa10f57ace07cffbb387e21b00eb9ae6df5f71988b213d046cc3a2af70c70403011c0a0afc4801ffb8b2411a54d7526e2b7bb43
SSDEEP

12288:d9G6DMzHMMHMMMyMMMZMMMVcR9bzOXmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMm:nGLbMMHMMMvMMZMMMKzb6XmMMMiMMMzd

Score

N/A

Malware Config

Signatures

Files

6b29e41638d81bc8204c2d1743225cb6a5f27693cf98d7156eca0b4c4bb7f4c1
.exe windows x86

596e1a03d17824154e0fc0d4f4699fab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EventWrite
GetTraceEnableFlags
RegQueryValueExW
EventUnregister
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
RegOpenKeyExW
EventRegister
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW

kernel32

Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
TerminateProcess
CreateFileW
lstrlenW
VerifyVersionInfoW
GetLastError
GetProcAddress
LocalAlloc
IsWow64Process
HeapSetInformation
GetFileTime
DeleteCriticalSection
CloseHandle
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
GetCurrentProcess
VerSetConditionMask
SetDllDirectoryW
CreateProcessW
SetErrorMode
RaiseException
LoadLibraryA
GetSystemDefaultLCID
GetUserDefaultLCID
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersionExA
FreeLibrary
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentDirectoryW
GetCommandLineW

user32

IsWindowEnabled
LoadStringW
CharNextW
GetWindowThreadProcessId
AllowSetForegroundWindow
SendMessageTimeoutW
FindWindowExW
MessageBoxW
IsWindowVisible

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
iswalpha
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
wcsncmp
iswspace
_vsnwprintf
memset

shlwapi

ord154
SHGetValueW
SHRegGetValueW
SHSetValueW
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
ord158
PathFindFileNameW
UrlCreateFromPathW
StrStrW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoInitialize

urlmon

ord410
ord111

iertutil

ord42
ord32
ord44
ord325
ord9
ord31
ord163
ord650
ord58

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 693KB - Virtual size: 693KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ngaut
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

596e1a03d17824154e0fc0d4f4699fab

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

shell32

ole32

urlmon

iertutil

Sections

.text Size: 26KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 693KB - Virtual size: 693KB

.reloc Size: 1KB - Virtual size: 1KB

.ngaut Size: 4KB - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 693KB - Virtual size: 693KB

.reloc
Size: 1KB - Virtual size: 1KB

.ngaut
Size: 4KB - Virtual size: 4KB