a253f6a460d504eaffa14fd1e6ee02b409993949e46a0262b739df6bea764f37

Sharing

Copy URL Twitter E-mail

General

Target

a253f6a460d504eaffa14fd1e6ee02b409993949e46a0262b739df6bea764f37
Size

201KB
MD5

5419d3f7c8b68c9495550569c677814a
SHA1

1ca7d3548ac896ec521703cf569051a55b837942
SHA256

a253f6a460d504eaffa14fd1e6ee02b409993949e46a0262b739df6bea764f37
SHA512

fc65c81304eaf96611aef1eea9ec5c69459f6f77a30d417437890fa4824e9065c933d8b3ba47e8f5292c7d8a4a533a3c059b6fb079f1c953202f7350e5d33a72
SSDEEP

3072:/M5KPx1Eh9rndeaDzlRyT9ovPfXgmF7DT/6+tiZmGGYzDW/MJOmC/rIFKkbdFeRq:kgZWfrd+qvXPF76XtZDU4Omb0kBgR

Score

N/A

Malware Config

Signatures

Files

a253f6a460d504eaffa14fd1e6ee02b409993949e46a0262b739df6bea764f37
.exe windows x86

af3fa90bab1816be6141b9014d85ea5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenThreadToken
SystemFunction006
ElfDeregisterEventSource
LsaQueryTrustedDomainInfo
LsaAddAccountRights
CreatePrivateObjectSecurityEx
RegCloseKey
RegQueryValueExA
LsaEnumerateTrustedDomains
EqualPrefixSid
RegGetKeySecurity
AddAccessAllowedObjectAce
CreateCodeAuthzLevel
ElfCloseEventLog
RegNotifyChangeKeyValue
RegOpenKeyExA

kernel32

DeleteCriticalSection
LoadLibraryA
GetCPInfoExA
CancelIo
EnterCriticalSection
ExitProcess
LocalShrink
InterlockedIncrement
WaitForSingleObject
SetEvent
LeaveCriticalSection
Sleep
GetModuleHandleA
VirtualProtect
CreateEventA
LocalReAlloc
FileTimeToSystemTime
GetThreadLocale
CloseHandle
GetACP
GetLastError
VirtualAlloc
SetLocalTime
GlobalDeleteAtom
GlobalSize
VirtualFree
GetProcAddress
TlsGetValue
IsDBCSLeadByteEx
SetConsoleCursorPosition
MultiByteToWideChar
InitializeCriticalSection
VirtualQuery
GetConsoleOutputCP
FreeLibrary

msvcrt

vsprintf
strtoul
malloc
strcpy
fopen
atoi
fclose
strlen
fputc
tolower
getenv
strcspn
fgets
fflush
putc
memmove
localeconv
strcmp
qsort
setlocale
_isctype
fwrite
_vsnprintf
strstr
strncmp
calloc
memcpy
strchr
sprintf
_errno
__p__commode
free
_iob
_strnicmp
wcslen
abort
_stricmp
realloc
strncpy
wcschr
vfprintf
bsearch
fputwc
vfwprintf
_vsnwprintf
__dllonexit

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

af3fa90bab1816be6141b9014d85ea5b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

Sections

.text Size: 62KB - Virtual size: 61KB

.data Size: 47KB - Virtual size: 46KB

.rata Size: 57KB - Virtual size: 57KB

.bss Size: - Virtual size: 72KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 31KB - Virtual size: 30KB

.text
Size: 62KB - Virtual size: 61KB

.data
Size: 47KB - Virtual size: 46KB

.rata
Size: 57KB - Virtual size: 57KB

.bss
Size: - Virtual size: 72KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 31KB - Virtual size: 30KB