c29b5812b41e5f0c7b97ef43cdecb100bad2a18ea1a38ec565b2ababf51a9a45 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c29b5812b41e5f0c7b97ef43cdecb100bad2a18ea1a38ec565b2ababf51a9a45
Size

814KB
MD5

0e824d5ff87a0f0dbdaf818b3f56c200
SHA1

f2d76a3eef91d40d90eef87ad6eb4afc9e7bbd5b
SHA256

c29b5812b41e5f0c7b97ef43cdecb100bad2a18ea1a38ec565b2ababf51a9a45
SHA512

3e7ad15d3d97c5f3531d898fef70bd2d5a9238fe23c95e643ae7a296474351dfa9e8a036804e2373e7a7fa7e05e887606db250a3b39d6790c96152449286f4f7
SSDEEP

12288:OgQ+6TI8MUE4LuNMtLMHQIMXG47Zps+js3auTnB30eAvwNGVGgN2Tqgw7vcpwsF:OgQNk8MUDziwdGos+i2eAHVVEA7vc

Score

N/A

Malware Config

Signatures

Files

c29b5812b41e5f0c7b97ef43cdecb100bad2a18ea1a38ec565b2ababf51a9a45
.exe windows x86

50a5a239d7276b7809e136e7ba6ca8d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetCurrentProcess
SetCurrentDirectoryA
LeaveCriticalSection
GetFullPathNameW
LeaveCriticalSection
FindFirstVolumeW
ReadConsoleW
InterlockedExchange
GetStringTypeA
GetDiskFreeSpaceW
RemoveDirectoryA
GetPrivateProfileIntW
GetComputerNameW
SetEnvironmentVariableW
lstrcatA
GetFileTime
FormatMessageA
GetModuleHandleA

catsrvut

RegDBRestore
StartMTSTOCOM
RegDBBackup
CGMIsAdministrator

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ADATA
Size: 802KB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ