e3970a39ff671fc12d74931900876ba7e2478cf4631c7b80805e276e647119f2

Sharing

Copy URL

Twitter E-mail

General

Target

e3970a39ff671fc12d74931900876ba7e2478cf4631c7b80805e276e647119f2
Size

29KB
MD5

ae865597cd213d0ce34dcdd48dc9e4ec
SHA1

246bf498db39085374689025bd1c43e8146f929c
SHA256

e3970a39ff671fc12d74931900876ba7e2478cf4631c7b80805e276e647119f2
SHA512

fa466d41ab25c34c3349a566727db991f6ba3af8feaf364df319e7270b14c98eb66c8a96f4878b8bce706ec2fb919b3dead1ed4ec2f80633f8d1bb0fccb7da40
SSDEEP

192:TdOwUoAVBSOmNaMio0HMQoV37nK37nK37nvo0HVQoY7nId/Kp8BYlIbSHI8RnT+l:rUo2mDdE8MlRp0GSSmxj

Score

N/A

Malware Config

Signatures

Files

e3970a39ff671fc12d74931900876ba7e2478cf4631c7b80805e276e647119f2
.exe windows x86

a921b6af715992cfb1c52482ca5c04da

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

mssign32

PvkPrivateKeyLoad
PvkPrivateKeyLoad
PvkPrivateKeyLoad

mtxoci

MTxOciInit
MTxOciInit
MTxOciInit
MTxOciInit

msoert2

CreateLogFile
CreateLogFile
CreateLogFile
CreateLogFile

nddeapi

NDdeGetTrustedShareA
NDdeGetTrustedShareA
NDdeGetTrustedShareA
NDdeGetTrustedShareA

mlang

ConvertINetReset
ConvertINetReset

kernel32

ReplaceFileA
GetACP
RtlMoveMemory
SetComputerNameA
QueryDosDeviceA
CreateJobObjectW
ReadConsoleOutputW
RegisterWowExec
Beep
_lopen
GetProfileIntW
TerminateProcess
TerminateProcess
GetSystemDirectoryA
ReadFile
ReplaceFileA
GetACP
RtlMoveMemory
SetComputerNameA
QueryDosDeviceA
CreateJobObjectW
ReadConsoleOutputW
RegisterWowExec
Beep
GetProfileIntW
TerminateProcess
TerminateProcess
GetSystemDirectoryA

pdh

PdhCloseLog
PdhCloseQuery
PdhCollectQueryData
PdhCollectQueryDataEx
PdhComputeCounterStatistics
PdhConnectMachineA
PdhConnectMachineW
PdhCreateSQLTablesA
PdhCreateSQLTablesW
PdhEnumLogSetNamesA
PdhEnumLogSetNamesW
PdhEnumMachinesA
PdhEnumMachinesHA
PdhEnumMachinesHW
PdhEnumMachinesW
PdhEnumObjectItemsA
PdhEnumObjectItemsHA
PdhEnumObjectItemsHW
PdhEnumObjectItemsW
PdhEnumObjectsA
PdhEnumObjectsHA
PdhEnumObjectsHW
PdhEnumObjectsW
PdhCloseLog
PdhCloseQuery
PdhCollectQueryData
PdhCollectQueryDataEx
PdhComputeCounterStatistics
PdhConnectMachineA
PdhConnectMachineW
PdhCreateSQLTablesA
PdhCreateSQLTablesW
PdhEnumLogSetNamesA
PdhEnumLogSetNamesW
PdhEnumMachinesA
PdhEnumMachinesHA
PdhEnumMachinesHW
PdhEnumMachinesW
PdhEnumObjectItemsA
PdhEnumObjectItemsHA
PdhEnumObjectItemsHW
PdhEnumObjectItemsW
PdhEnumObjectsA
PdhEnumObjectsHA
PdhEnumObjectsHW
PdhEnumObjectsW
PdhCloseLog
PdhCloseQuery
PdhCollectQueryData
PdhCollectQueryDataEx
PdhComputeCounterStatistics
PdhConnectMachineA
PdhConnectMachineW
PdhCreateSQLTablesA
PdhCreateSQLTablesW
PdhEnumLogSetNamesA
PdhEnumLogSetNamesW
PdhEnumMachinesA
PdhEnumMachinesHA
PdhEnumMachinesHW
PdhEnumMachinesW
PdhEnumObjectItemsA
PdhEnumObjectItemsHA
PdhEnumObjectItemsHW
PdhEnumObjectItemsW
PdhEnumObjectsA
PdhEnumObjectsHA
PdhEnumObjectsHW
PdhEnumObjectsW
PdhCreateSQLTablesW
PdhEnumLogSetNamesA
PdhEnumLogSetNamesW
PdhEnumMachinesA
PdhEnumMachinesHA

msvcrt

fopen
fread

Sections

.text
Size: 2KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.DATA
Size: 10KB - Virtual size: 70KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a921b6af715992cfb1c52482ca5c04da

Headers

File Characteristics

Imports

mssign32

mtxoci

msoert2

nddeapi

mlang

kernel32

pdh

msvcrt

Sections

.text Size: 2KB - Virtual size: 34KB

.DATA Size: 10KB - Virtual size: 70KB

.reloc Size: 13KB - Virtual size: 16KB

.data Size: 2KB - Virtual size: 2KB

.text
Size: 2KB - Virtual size: 34KB

.DATA
Size: 10KB - Virtual size: 70KB

.reloc
Size: 13KB - Virtual size: 16KB

.data
Size: 2KB - Virtual size: 2KB