812ea19b55da82b7958219474879be27b64d62bcaf66c5c02cbfab72b2bafeb4

Sharing

Copy URL Twitter E-mail

General

Target

812ea19b55da82b7958219474879be27b64d62bcaf66c5c02cbfab72b2bafeb4
Size

276KB
MD5

dad41c150d67c025a340395d52f850c2
SHA1

0afe056e538dc622cc677dc69bae5f4cf942e245
SHA256

812ea19b55da82b7958219474879be27b64d62bcaf66c5c02cbfab72b2bafeb4
SHA512

9d6f4d0b9d845ce43faaba87db556ea06c16826d2d8f41da230e75f335f2155c1349544007213ea90de76cccff57f71079c19c50ff6f577ae510f032952a05ce
SSDEEP

3072:M7i2C1BC1dYhPL9SJrY7g4Lu0PRGS2NR6YkwRTGnKRIwHO1TrZmHmfuGvVW9:M7i2C+1dpW7d7ID6qsKkTzvV

Score

N/A

Malware Config

Signatures

Files

812ea19b55da82b7958219474879be27b64d62bcaf66c5c02cbfab72b2bafeb4
.dll windows x86

af0390be365501ae6ab08ff71294bc6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
lstrlenW
HeapFree
HeapAlloc
GetSystemWindowsDirectoryW
RaiseException
CreateEventW
WaitForSingleObjectEx
CloseHandle
GetTickCount
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
CreateDirectoryW
GetFileAttributesW
GetFullPathNameW
GetLastError
SetFilePointerEx
SetErrorMode
GetWindowsDirectoryW
SetLastError
FindFirstFileExW
GetModuleFileNameW
FreeLibrary
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
GetComputerNameW
SetEvent
ResetEvent
CreateEventA
CompareStringW
GetCalendarInfoA
GetFileSizeEx
ExitProcess
UnhandledExceptionFilter

user32

FlashWindow
GetAncestor
CharToOemA

advapi32

DeregisterEventSource
RegisterEventSourceW

ole32

CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
CoInitializeEx
PropVariantClear

msvcrt

strncmp
memchr
wcschr
memset
wcsncmp
wcstol
malloc
wcsstr
iswdigit
iswxdigit
memmove
wcsrchr
exit
swscanf
free

rpcrt4

RpcBindingFromStringBindingW
RpcBindingFree
RpcEpResolveBinding
RpcBindingSetOption
NDRCContextBinding
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqDone
RpcSsDestroyClientContext
RpcStringBindingParseW
RpcBindingSetAuthInfoExW
RpcSsGetContextBinding

ws2_32

WSALookupServiceEnd

Exports

Exports

ASyntaxFileLines
ATheOneA
ClientsFirstAbove
ContinuationAWhitespace
DirectorySingle
FormsSection
MustAllDefiningTimeStarting
OptionFirstDoesLinesTrailing
SeveralAsConfiguration
ValidValuesStart
ValueSubversionAreExceptionWith
ValueTheNameThisBoolean
WithNewlineA
WithinShareValueBrokenDirectives

Sections

.text
Size: 240KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af0390be365501ae6ab08ff71294bc6d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

msvcrt

rpcrt4

ws2_32

Exports

Exports

Sections

.text Size: 240KB - Virtual size: 236KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 155KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 240KB - Virtual size: 236KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 155KB

.reloc
Size: 4KB - Virtual size: 1KB