f70fde4db36b90f4f97d64dbfe6b3cc2d45db8da88c5919d9d78f66053066e11

General

Target

f70fde4db36b90f4f97d64dbfe6b3cc2d45db8da88c5919d9d78f66053066e11
Size

324KB
MD5

74229f74a36e68217ff285b0e0542539
SHA1

dbed1c256280f63eb05aa4fd755a36298136124a
SHA256

f70fde4db36b90f4f97d64dbfe6b3cc2d45db8da88c5919d9d78f66053066e11
SHA512

ca5ab18623af4d582baec0deb69b7673885fd11dfaba827473f7c844f770a4f510393d7b05961ec2e05358463552e08fea29baee59bd383c62591800ebebf763
SSDEEP

6144:4VlmWPc/AWPlKALXqo1jmUZxL6xQGQm9UmM7I+6cw:4VM4YAWxLXqs76ve7I+L

Score

N/A

Malware Config

Signatures

Files

f70fde4db36b90f4f97d64dbfe6b3cc2d45db8da88c5919d9d78f66053066e11
.exe windows x86

bae3fd28966367876d7cd73639328a51

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTokenInformation
CreateProcessAsUserA
DuplicateTokenEx
OpenThreadToken
SetThreadToken
LookupAccountSidA
ImpersonateSelf
GetUserNameA

xolehlp

DtcGetTransactionManagerExA

kernel32

GetStringTypeW
GetProcAddress
LoadLibraryA
CloseHandle
GetEnvironmentVariableA
GetCurrentThread
HeapFree
GetProcessHeap
DuplicateHandle
GetCurrentProcess
OpenProcess
Sleep
QueueUserAPC
GetProcessIdOfThread
OpenThread
MultiByteToWideChar
HeapAlloc
GetCommandLineA
GetVersion
ExitProcess
RtlUnwind
RaiseException
TerminateProcess
HeapReAlloc
HeapSize
GetModuleHandleA
GetModuleFileNameA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
WriteFile
GetLastError
FlushFileBuffers
SetFilePointer
SetUnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
IsBadReadPtr
IsBadCodePtr
SetStdHandle
ReadFile
LCMapStringA
LCMapStringW
GetStringTypeA

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 4KB - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tc
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bae3fd28966367876d7cd73639328a51

Headers

File Characteristics

Imports

advapi32

xolehlp

kernel32

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 16KB - Virtual size: 18KB

.sxdata Size: 4KB - Virtual size: 124B

.tc Size: 248KB - Virtual size: 248KB

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 18KB

.sxdata
Size: 4KB - Virtual size: 124B

.tc
Size: 248KB - Virtual size: 248KB