095fe6bf149473390d41b335650f516fbc986aa400ad87e310ef3e5151f0b534

Sharing

Copy URL Twitter E-mail

General

Target

095fe6bf149473390d41b335650f516fbc986aa400ad87e310ef3e5151f0b534
Size

734KB
MD5

0c2e981dbb146b557f33abf70d02dec0
SHA1

02216951f2ef508dad43fd801afe224fc7161dda
SHA256

095fe6bf149473390d41b335650f516fbc986aa400ad87e310ef3e5151f0b534
SHA512

a22ad8ba99818ea8f75e46b4df77c77de423c39c1f5596b389eade61cd0c668dfe2e9f91b9c4676365bbef6154e5b717aff3c1b93d39120dfee8a2ee2c910c05
SSDEEP

12288:a9G6DMzHMMHMMMyMMMZMMMVcR9bzOXmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMP:WGLbMMHMMMvMMZMMMKzb6XmMMMiMMMzd

Score

N/A

Malware Config

Signatures

Files

095fe6bf149473390d41b335650f516fbc986aa400ad87e310ef3e5151f0b534
.exe windows x86

34ab8235aec436c7a4f8e2509bdb2a1d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

EventWrite
GetTraceEnableFlags
RegQueryValueExW
EventUnregister
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
RegOpenKeyExW
EventRegister
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW

kernel32

Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
TerminateProcess
CreateFileW
lstrlenW
VerifyVersionInfoW
GetLastError
GetProcAddress
LocalAlloc
IsWow64Process
HeapSetInformation
GetFileTime
DeleteCriticalSection
CloseHandle
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
LoadLibraryW
GetModuleHandleW
GetCurrentProcess
VerSetConditionMask
SetDllDirectoryW
CreateProcessW
SetErrorMode
GetCommandLineW
RaiseException
LoadLibraryA
GetSystemDefaultLCID
GetUserDefaultLCID
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersionExA
FreeLibrary
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentDirectoryW
InitializeCriticalSection

user32

IsWindowEnabled
LoadStringW
CharNextW
GetWindowThreadProcessId
SendMessageTimeoutW
FindWindowExW
MessageBoxW
IsWindowVisible
AllowSetForegroundWindow

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
iswalpha
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
wcsncmp
iswspace
_vsnwprintf
memset

shlwapi

ord154
SHGetValueW
SHRegGetValueW
SHSetValueW
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
ord158
PathFindFileNameW
UrlCreateFromPathW
StrStrW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoInitialize

urlmon

ord410
ord111

iertutil

ord32
ord44
ord325
ord9
ord31
ord163
ord650
ord42
ord58

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 693KB - Virtual size: 693KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ngaut
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

34ab8235aec436c7a4f8e2509bdb2a1d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

shlwapi

shell32

ole32

urlmon

iertutil

Sections

.text Size: 26KB - Virtual size: 25KB

.data Size: 2KB - Virtual size: 1KB

.rsrc Size: 693KB - Virtual size: 693KB

.reloc Size: 1KB - Virtual size: 1KB

.ngaut Size: 4KB - Virtual size: 4KB

.text
Size: 26KB - Virtual size: 25KB

.data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 693KB - Virtual size: 693KB

.reloc
Size: 1KB - Virtual size: 1KB

.ngaut
Size: 4KB - Virtual size: 4KB