ce60892b1599cf53d990b32201572aaa2d778fcebd06b224b44ea051f85b7475

Sharing

Copy URL Twitter E-mail

General

Target

ce60892b1599cf53d990b32201572aaa2d778fcebd06b224b44ea051f85b7475
Size

332KB
MD5

0990cddfa6cfa123f070f85e0d82ac60
SHA1

0160c207e161303e5f5f87b76fbd64b5d05f771d
SHA256

ce60892b1599cf53d990b32201572aaa2d778fcebd06b224b44ea051f85b7475
SHA512

6f031b9072014e83ba2a4185f1b04c323bb2460b6ea8251d750dde89f3bd51e03e7e2966e36da4bf8d7cca5b059d78b8900cf012549f818dbbcfce6f89277342
SSDEEP

6144:EnsGlgAsmodXrZPUfbYNo/sHipddaH3k:EsGlbsmojPUfkaUL

Score

N/A

Malware Config

Signatures

Files

ce60892b1599cf53d990b32201572aaa2d778fcebd06b224b44ea051f85b7475
.dll windows x86

e3a2d4b67862032b601d2afdd576b6aa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

SymGetModuleInfo64
SymLoadModule64
SymGetOptions
SymSetOptions
SymGetSymFromAddr64
SymGetLineFromAddr64
SymGetModuleBase64
SymInitialize
SymCleanup
SymLoadModule
SymFunctionTableAccess64
StackWalk64

kernel32

GetVersionExA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetLastError
HeapAlloc
GetCurrentProcessId
SetLastError
IsBadWritePtr
HeapFree
GetProcessHeap
WriteFile
lstrlenW
OutputDebugStringW
GetThreadContext
GetCurrentProcess
IsDebuggerPresent
GetProcAddress
LoadLibraryW
SearchPathW
GetProfileIntW
CreateFileA
GetModuleFileNameA
WideCharToMultiByte
GetACP
IsBadStringPtrW
MultiByteToWideChar
IsBadStringPtrA
RaiseException
IsBadCodePtr
SetUnhandledExceptionFilter
lstrcpynW
lstrlenA
FormatMessageW
GetModuleHandleW
IsBadReadPtr
ReadProcessMemory
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
ExitProcess
LocalFree
GetModuleFileNameW
OutputDebugStringA
VirtualQueryEx
DebugBreak
GetVersionExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
VirtualProtect
VirtualQuery
HeapReAlloc
HeapCreate
InitializeCriticalSection
HeapDestroy
TlsSetValue
TlsGetValue
GetPrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileSectionW
TlsAlloc
TlsFree
CloseHandle
CreateFileW
GetCurrentThreadId
OpenProcess
ResumeThread
SuspendThread
OpenThread
SetThreadPriority
GetThreadPriority
FreeLibrary
LocalAlloc
GlobalLock
GlobalAlloc
GetLocaleInfoW
LockResource
LoadResource
FindResourceExW
InterlockedExchange
GetCurrentThread
GlobalUnlock

advapi32

RegCreateKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

msvcr71d

_strcmpi
__CppXcptFilter
_stricmp
_adjust_fdiv
_malloc_dbg
_initterm
_free_dbg
free
memset
__CxxFrameHandler
??3@YAXPAX@Z
wcscpy
wcscmp
memcpy
wcscat
wcslen
strcat
strcpy
strlen
_except_handler3
??_V@YAXPAX@Z
??_U@YAPAXIHPBDH@Z
strrchr
wcsstr
malloc
realloc
_local_unwind2
_CrtDoForAllClientObjects
_CrtCheckMemory
_CrtDbgReport
_CrtSetDumpClient
isprint
bsearch
_CrtSetDbgFlag
_CrtDumpMemoryLeaks
_CrtSetAllocHook
_wcsicmp
_splitpath
_wtol
wcstok
_itow
wcsrchr
wcsncpy
_wcslwr
iswspace
vswprintf
abs
swprintf
_vsnprintf
_vsnwprintf
_CRT_RTC_INIT
__security_error_handler
__dllonexit
_onexit

comctl32

ord17

Exports

Exports

AddClientDV
AddCrashHandlerLimitModule
AddDiagAssertModule
AllocAndFillProcessModuleList
BSUAnsi2Wide
BSUGetModuleBaseNameA
BSUGetModuleBaseNameW
BSUGetModuleFileNameExA
BSUGetModuleFileNameExW
BSUIsInteractiveUser
BSUSetCurrentThreadNameA
BSUSetCurrentThreadNameW
BSUSetThreadNameA
BSUSetThreadNameW
BSUSymInitializeA
BSUSymInitializeW
BSUWide2Ansi
CreateCurrentProcessCrashDumpA
CreateCurrentProcessCrashDumpW
DiagAssertA
DiagAssertW
DiagOutputA
DiagOutputW
GetFaultReason
GetFirstStackTraceString
GetLimitModuleCount
GetLimitModulesArray
GetLoadedModules
GetNextStackTraceString
GetProcessThreadIds
GetRegisterString
GetSuperAssertionCount
HookImportedFunctionsByNameA
HookImportedFunctionsByNameW
HookOrdinalExportA
HookOrdinalExportW
IsMiniDumpFunctionAvailable
IsNT
IsNT4
IsServer2003
IsServer2003orBetter
IsW2K
IsW2KorBetter
IsXP
IsXPorBetter
MemStressInitializeA
MemStressInitializeW
MemStressTerminate
SetCrashHandlerFilter
SetDiagAssertFile
SetDiagAssertOptions
SetDiagOutputFile
SnapCurrentProcessMiniDumpA
SnapCurrentProcessMiniDumpW
SuperAssertionA
SuperAssertionW
ValidateAllBlocks

Sections

.text
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e3a2d4b67862032b601d2afdd576b6aa

Headers

File Characteristics

Imports

dbghelp

kernel32

advapi32

version

msvcr71d

comctl32

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 169KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 4KB - Virtual size: 12KB

.idata Size: 8KB - Virtual size: 5KB

.didat Size: 4KB - Virtual size: 3KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 12KB - Virtual size: 10KB

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 172KB - Virtual size: 169KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 4KB - Virtual size: 12KB

.idata
Size: 8KB - Virtual size: 5KB

.didat
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 12KB - Virtual size: 10KB

.rmnet
Size: 60KB - Virtual size: 60KB