8faf07b4890c8567f0018a27557a953f2e0a1aa4dbef355de60da4c2270bbbdd

Sharing

Copy URL

Twitter E-mail

General

Target

8faf07b4890c8567f0018a27557a953f2e0a1aa4dbef355de60da4c2270bbbdd
Size

196KB
MD5

f5c37ff0e853f59bf03d6b747feba1cc
SHA1

25fe6d3c94caaf47ce157cea735f4a404f86b2ab
SHA256

8faf07b4890c8567f0018a27557a953f2e0a1aa4dbef355de60da4c2270bbbdd
SHA512

f53b5ef58b3da5b27b4ab3a363b1904607fc5d222b46b9217aeb9242d680faee0afef8a27fa64ee2fa67499a5f0a223b3c8d2a45a2f9946a7aa287b1fc3b43bb
SSDEEP

3072:Up1uTeLfvOF5jgROLAr+m8KO5YRKGwFeMtle:UKTOfmF5joOY+mw57ll

Score

N/A

Malware Config

Signatures

Files

8faf07b4890c8567f0018a27557a953f2e0a1aa4dbef355de60da4c2270bbbdd
.dll windows x64

6a79dd269a02f2b5ad1bf65203190de2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

psapi

EnumProcessModules
GetModuleInformation

kernel32

TlsFree
GetCurrentThreadId
VirtualFree
VirtualAlloc
GetSystemInfo
GetLastError
GetCurrentProcess
GetProcAddress
GetModuleFileNameA
LoadLibraryW
GetCurrentProcessId
GetFullPathNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
SetEvent
GetModuleHandleA
CloseHandle
GetThreadContext
SetThreadContext
WaitForSingleObject
OpenProcess
Thread32First
ReadProcessMemory
Thread32Next
VirtualAllocEx
OpenThread
CreateEventW
TlsAlloc
DuplicateHandle
WriteProcessMemory
SuspendThread
ResumeThread
TlsGetValue
CreateProcessW
CreateRemoteThread
TlsSetValue
TerminateProcess
SetLastError
GetExitCodeThread
WaitForMultipleObjects
FatalAppExitW
GetModuleFileNameW
CreateFileW
HeapAlloc
HeapFree
IsBadReadPtr
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
DeleteCriticalSection
GetModuleHandleW
GetVersionExW
LoadLibraryA
HeapCreate
HeapDestroy
FreeLibrary
CreateToolhelp32Snapshot
FlsSetValue
GetCommandLineA
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
RtlUnwindEx
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
ExitProcess
FlsGetValue
FlsFree
FlsAlloc
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
ReadFile
HeapReAlloc
FlushFileBuffers
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
HeapSize

advapi32

StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
OpenProcessToken

Exports

Exports

DbgAttachDebugger
DbgDetachDebugger
DbgGetProcessIdByHandle
DbgGetThreadIdByHandle
DbgHandleToObjectName
DbgIsAvailable
DbgIsEnabled
GacCreateContext
GacInstallAssembly
GacReleaseContext
GacUninstallAssembly
HookCompleteInjection
LhBarrierBeginStackTrace
LhBarrierCallStackTrace
LhBarrierEndStackTrace
LhBarrierGetAddressOfReturnAddress
LhBarrierGetCallback
LhBarrierGetCallingModule
LhBarrierGetReturnAddress
LhBarrierPointerToModule
LhEnumModules
LhInstallHook
LhIsThreadIntercepted
LhSetExclusiveACL
LhSetGlobalExclusiveACL
LhSetGlobalInclusiveACL
LhSetInclusiveACL
LhUninstallAllHooks
LhUninstallHook
LhUpdateModuleInformation
LhWaitForPendingRemovals
RhCreateAndInject
RhCreateStealthRemoteThread
RhGetProcessToken
RhInjectLibrary
RhInstallDriver
RhInstallSupportDriver
RhIsAdministrator
RhIsX64Process
RhIsX64System
RhWakeUpProcess
RtlCreateSuspendedProcess
RtlGetLastError
RtlGetLastErrorString
RtlInstallService

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6a79dd269a02f2b5ad1bf65203190de2

Headers

DLL Characteristics

File Characteristics

Imports

psapi

kernel32

advapi32

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 72KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 66KB - Virtual size: 90KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 73KB - Virtual size: 72KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 66KB - Virtual size: 90KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 5KB - Virtual size: 4KB