00cf4a688c73e1f3b8b07ddf7edacb8aa8b7d6d7c5dd1928f2e3ef546cf18955

Sharing

Copy URL Twitter E-mail

Reason

config extraction: missing cfgextr callback for rule "Gozi_FJ_loader"

General

Target

00cf4a688c73e1f3b8b07ddf7edacb8aa8b7d6d7c5dd1928f2e3ef546cf18955
Size

209KB
MD5

170b5d89081ab54204bf04e8255c51a2
SHA1

8a459d822993e03aa8d8f8090f9a8566fd44ead7
SHA256

00cf4a688c73e1f3b8b07ddf7edacb8aa8b7d6d7c5dd1928f2e3ef546cf18955
SHA512

463b971c199c2f18d4d0b22889a1b50acf2f5cc6afbe5edcd4e077e1df14807eb8015335689e730645f8939e9ab9c4aaaf11366460c93f3085e928b103ec5446
SSDEEP

3072:cuFRc5LyfC5M8Hsae1sXk8pkLXYLxurtUBtKhPUPMatXx2dPsxHxuR3bJyIiPL+q:cG4PGaeqUjLohXNP9tBYPvOL+T+

Score

N/A

Malware Config

Signatures

Files

00cf4a688c73e1f3b8b07ddf7edacb8aa8b7d6d7c5dd1928f2e3ef546cf18955
.exe windows x86

20830addac3ddc58b8486e4b65c1db07

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwQueryInformationProcess
RtlNtStatusToDosError
NtUnmapViewOfSection
NtGetContextThread
NtMapViewOfSection
NtCreateSection
NtSetContextThread
ZwQueryInformationToken
ZwOpenProcess
RtlRandom
ZwClose
ZwOpenProcessToken
NtQueryVirtualMemory

shlwapi

StrChrA
StrRChrA

kernel32

VirtualProtectEx
CreateProcessW
CreateFileA
lstrlenA
WaitForSingleObject
GetTickCount
GetWindowsDirectoryA
WriteFile
OpenProcess
Sleep
CreateProcessA
TerminateProcess
GetSystemDirectoryA
lstrcatA
FindFirstFileA
GetLastError
lstrcmpiA
CopyFileA
SetFileAttributesA
FindClose
LocalAlloc
OpenEventA
GetModuleFileNameA
FindNextFileA
GetModuleHandleA
CloseHandle
GetTempPathA
LocalFree
lstrcpyA
GetCommandLineA
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleW
GetProcAddress
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetThreadContext
lstrcmpA
ResumeThread
SuspendThread
SwitchToThread
InterlockedIncrement
WriteProcessMemory
VirtualAllocEx
ReadFile
ReadProcessMemory
SetFilePointer
GetFileSize
GetVersion

user32

GetWindowThreadProcessId
wsprintfA
GetShellWindow

advapi32

RegOpenKeyExA
RegQueryValueExA
CreateProcessAsUserW
CreateProcessAsUserA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

20830addac3ddc58b8486e4b65c1db07

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

kernel32

user32

advapi32

shell32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 159KB - Virtual size: 160KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 159KB - Virtual size: 160KB