be061169278d1a646b1c75419e187289d33fda553291e0f2374782d3377e7f89

Sharing

Copy URL Twitter E-mail

General

Target

be061169278d1a646b1c75419e187289d33fda553291e0f2374782d3377e7f89
Size

48KB
MD5

0b9d02948fa54dbe38ab23dac8a40ded
SHA1

d7361dcd602cfc2a78587c40fafd96112e2b7b3e
SHA256

be061169278d1a646b1c75419e187289d33fda553291e0f2374782d3377e7f89
SHA512

36d278b7baf9fc5b2c13e01d16f874aee4da4e68d813db9ae8d6025f5ead984946d0949cd56a26ceb54d99bf6159c7bcb927ae5cdade27f88fed87171f31fd66
SSDEEP

1536:tzF5XA6u7iq7Aj9yPpXYxISRX456nIVD:i6I1Aj9EpXYxx145yAD

Score

N/A

Malware Config

Signatures

Files

be061169278d1a646b1c75419e187289d33fda553291e0f2374782d3377e7f89
.exe windows x86

b646b9502cccb413f97564f10554c010

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

esent

JetInit
JetDelete
JetDeleteTable
JetDetachDatabase
JetBackup
JetCreateInstance
JetGetTableIndexInfo
JetGotoPosition
JetMakeKey
JetRestore
JetRenameColumn
JetPrepareUpdate@12
JetPrepareToCommitTransaction
JetFreeBuffer
JetDelete@8
JetEndExternalBackupInstance
JetOSSnapshotThaw
JetDetachDatabase2
JetSeek
JetSetColumn
JetComputeStats
JetResetTableSequential
JetRetrieveColumns
JetInit3
JetGetTableColumnInfo
JetTerm@4
JetCreateDatabase
JetAttachDatabaseWithStreaming
JetOSSnapshotFreeze
JetOpenDatabase

user32

MB_GetString
SetSysColors
OemToCharBuffA
CreateMDIWindowA
MsgWaitForMultipleObjects
GetRawInputBuffer
CharNextW
GetDCEx
GetCursorInfo
GetClassInfoExW
GetMenuCheckMarkDimensions
DrawStateW
LoadKeyboardLayoutA
ScrollWindow
GetClassInfoExA
HiliteMenuItem
EnumDisplaySettingsW
GetScrollRange
CopyIcon
ShowCursor
LookupIconIdFromDirectory
RealChildWindowFromPoint
CliImmSetHotKey

mpr

WNetGetNetworkInformationW
MultinetGetErrorTextW
WNetGetConnection2A
WNetGetUniversalNameA
WNetDisconnectDialog1A
WNetGetConnection3W
WNetUseConnectionA
WNetClearConnections
WNetGetConnection3A
WNetGetConnectionA
MultinetGetConnectionPerformanceA
WNetGetHomeDirectoryW
WNetCloseEnum
WNetAddConnection2W
MultinetGetConnectionPerformanceW
WNetOpenEnumW
WNetAddConnection2A
WNetConnectionDialog2
WNetGetProviderNameW
I_MprSaveConn
WNetConnectionDialog1A
WNetSupportGlobalEnum
WNetOpenEnumA
WNetGetPropertyTextA
WNetGetUniversalNameW
WNetCancelConnectionW
WNetDisconnectDialog1W
WNetGetResourceParentW
WNetSetLastErrorA

ole32

HACCEL_UserMarshal
CoSetState
CoQueryReleaseObject
CoGetContextToken
CoCopyProxy
StgSetTimes
HBITMAP_UserMarshal
OleRegGetMiscStatus
UtGetDvtd16Info
CoIsHandlerConnected
OleCreateEx
STGMEDIUM_UserUnmarshal
HMETAFILE_UserUnmarshal
CoRegisterSurrogateEx
WriteClassStg
STGMEDIUM_UserFree
SNB_UserUnmarshal
DllDebugObjectRPCHook
CoGetInterfaceAndReleaseStream
OleMetafilePictFromIconAndLabel
CoGetMalloc
IsEqualGUID
CreateDataAdviseHolder
UtGetDvtd32Info
CoIsOle1Class
HDC_UserUnmarshal
CreateBindCtx
OleRun
CoGetTreatAsClass
OleCreate

msvcp60

??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z
??_7?$moneypunct@G$0A@@std@@6B@
??0?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z
?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?sqrt@?$_Ctr@N@std@@SANN@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIABV12@II@Z
??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??0?$collate@G@std@@QAE@I@Z
?endl@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
??_7messages_base@std@@6B@
??4?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
?what@logic_error@std@@UBEPBDXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??0overflow_error@std@@QAE@ABV01@@Z

kernel32

GlobalUnfix
LeaveCriticalSection
ConnectNamedPipe
GetSystemWow64DirectoryW
VirtualAlloc
FindVolumeClose
SetMailslotInfo
WaitForMultipleObjects
MoveFileA
PostQueuedCompletionStatus
lstrcpyn
GlobalSize
RegisterWaitForSingleObjectEx
WriteProfileStringA
SetConsoleHardwareState
lstrcmpiA
LoadLibraryA
GetModuleHandleA
FindResourceW
RtlCaptureContext
DisableThreadLibraryCalls
lstrcatW
LocalUnlock
EnumLanguageGroupLocalesW
GetSystemTime

msasn1

ASN1BEREncFlush
ASN1BERDecDouble
ASN1CEREncZeroMultibyteString
ASN1BERDecS32Val
ASN1CEREncGeneralizedTime
ASN1BEREncExplicitTag
ASN1BEREncOctetString
ASN1char16string_free
ASN1BERDecOpenType2
ASN1BERDecU8Val
ASN1BERDecGeneralizedTime
ASN1objectidentifier_free
ASN1intx_add
ASN1octetstring_cmp
ASN1BEREncMultibyteString
ASN1BERDecOpenType
ASN1charstring_cmp
ASN1_CreateDecoder
ASN1BERDecChar32String
ASN1BERDecObjectIdentifier
ASN1BERDecEoid
ASN1BERDotVal2Eoid
ASN1BEREncUTCTime
ASN1EncSetError
ASN1intx2uint32
ASN1intx_free
ASN1CEREncBitString

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b646b9502cccb413f97564f10554c010

Headers

DLL Characteristics

File Characteristics

Imports

esent

user32

mpr

ole32

msvcp60

kernel32

msasn1

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 16KB - Virtual size: 86KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 512B - Virtual size: 244B

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 16KB - Virtual size: 86KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 512B - Virtual size: 244B