f7cb42ce44873e1cdde06014a8f9658191032355f172b2bf42125f0228319a5f

Sharing

Copy URL Twitter E-mail

General

Target

f7cb42ce44873e1cdde06014a8f9658191032355f172b2bf42125f0228319a5f
Size

595KB
MD5

1a97c73e4190b7f0ebe4b8346295c710
SHA1

f7e5c926fd2da6ca444a81cc521cca9e002560cd
SHA256

f7cb42ce44873e1cdde06014a8f9658191032355f172b2bf42125f0228319a5f
SHA512

5b5b05fcf7eb3c4d3afdd31dd15748eba9ba3e75067fd6f94ceb52150fe93656055d4563f7a97c2d1f9aaee2d8656b01275724cc0541d62c2e192be60ee2c916
SSDEEP

12288:iiaKePJQ2f4p3ydPa2SHGo3gMBGqUtxOKQngwf0H07WwB6Lg:YKePJ3xVa2SHGo3gwGqUWgz07xB6Lg

Score

N/A

Malware Config

Signatures

Files

f7cb42ce44873e1cdde06014a8f9658191032355f172b2bf42125f0228319a5f
.exe windows x64

646e6e2fb09423ba72c5d0840393a9ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

empxcore

ord2
ord1
ord3

ggstub

ord12
ord11
ord9
ord10

wscore

ord1
ord2
ord3

scansts

ord7

kernel32

GetLastError
GetModuleFileNameW
WideCharToMultiByte
GetLongPathNameW
Sleep
GetTickCount
CloseHandle
SetEvent
CreateEventA
WaitForSingleObject
WaitForMultipleObjects
GetExitCodeProcess
LeaveCriticalSection
ProcessIdToSessionId
GetCurrentProcessId
GetProcAddress
GetModuleHandleA
GetPrivateProfileIntA
OutputDebugStringA
GetCurrentThreadId
GetModuleFileNameA
FreeLibrary
LoadLibraryA
LocalFree
LocalAlloc
ReadFile
WriteFile
WaitNamedPipeA
CreateFileA
EnterCriticalSection
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
CreateProcessA

user32

LoadStringA
LoadStringW

advapi32

SetServiceStatus
RegSetValueExA
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
QueryServiceStatus
RegOpenKeyExA
RegQueryValueExW
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
DeleteService
CreateServiceA
RegCloseKey
DeregisterEventSource
RegCreateKeyA
RegCreateKeyExA

msvcr90

__C_specific_handler
?terminate@@YAXXZ
__crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
wcsrchr
_wcsicmp
_beginthreadex
memset
??3@YAXPEAX@Z
_vsnprintf
strncpy
vsprintf
sprintf
_stricmp
printf
_localtime64
_time64
__CxxFrameHandler3
??2@YAPEAX_K@Z
_write
_close
strftime
_lseek
?_open@@YAHPEBDHH@Z
_access
_vsnwprintf
_amsg_exit
__getmainargs
_XcptFilter
_exit
_cexit
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
?_type_info_dtor_internal_method@type_info@@QEAAXXZ

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp1
Size: 560KB - Virtual size: 1.8MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

646e6e2fb09423ba72c5d0840393a9ac

Headers

DLL Characteristics

File Characteristics

Imports

empxcore

ggstub

wscore

scansts

kernel32

user32

advapi32

msvcr90

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.vmp1 Size: 560KB - Virtual size: 1.8MB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.vmp1
Size: 560KB - Virtual size: 1.8MB