e0097c6afb781f8f5b86e08406bd9d185fed3b4f64767d31d82aa23c8bba4ecc

Sharing

Copy URL Twitter E-mail

General

Target

e0097c6afb781f8f5b86e08406bd9d185fed3b4f64767d31d82aa23c8bba4ecc
Size

312KB
MD5

613d60129a03d5b76099daaeb3c8d7d6
SHA1

622096663b4cee29aab919e1bdc76a577fc5b96d
SHA256

e0097c6afb781f8f5b86e08406bd9d185fed3b4f64767d31d82aa23c8bba4ecc
SHA512

cb62b48277dd6df1028b2e28e9b150e2d2a92307c357be2d97bc38628118460aa1e72f7c6efc736c06beb1200135db1142f0890317c16d2f2262eb82dcf9b183
SSDEEP

6144:lsf2LNitOXomTOtlc18Q0tI4wsyV4vQ4CUWVR34//ScoWSy1wKtrnh:qfENnYHt218Q0tIcOP+vaIrnh

Score

N/A

Malware Config

Signatures

Files

e0097c6afb781f8f5b86e08406bd9d185fed3b4f64767d31d82aa23c8bba4ecc
.exe windows x86

63e837baa16c04016fc0e20e211f9dba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrChrA
PathIsUNCServerA
PathIsRelativeW
SHGetValueW
StrNCatA
StrPBrkA
PathFindNextComponentA
PathIsSystemFolderW
PathCanonicalizeA
StrIsIntlEqualA
PathFindFileNameW
StrRStrIA
SHSetValueA
PathRenameExtensionW
PathGetArgsW

kernel32

VirtualAllocEx
ExitProcess
LoadLibraryA
GetProcAddress
GetModuleHandleA
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetLastError
HeapFree
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapAlloc
HeapReAlloc
Sleep
IsProcessorFeaturePresent
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId

aclui

ord1
ord2

avifil32

AVIFileCreateStreamW
AVIStreamAddRef
AVIStreamGetFrameClose
AVIFileGetStream
AVIFileInit

msvfw32

ICClose
DrawDibProfileDisplay

uxtheme

GetThemeBackgroundRegion
GetThemeColor
GetThemeAppProperties
SetWindowTheme
OpenThemeData
DrawThemeText

setupapi

SetupDiGetSelectedDevice
SetupGetInfFileListW
SetupSetSourceListW
SetupQueueRenameW
SetupDiGetClassDevsW
SetupAddToSourceListA
SetupDiInstallDevice

comdlg32

GetFileTitleW
GetOpenFileNameA
GetSaveFileNameW
ReplaceTextA
CommDlgExtendedError
ChooseColorW
PrintDlgA
GetOpenFileNameW
PrintDlgW

Sections

.wectyy
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 242KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hxdr
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.erudf
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63e837baa16c04016fc0e20e211f9dba

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

aclui

avifil32

msvfw32

uxtheme

setupapi

comdlg32

Sections

.wectyy Size: 55KB - Virtual size: 54KB

.rdata Size: 242KB - Virtual size: 241KB

.data Size: 8KB - Virtual size: 27KB

.hxdr Size: 5KB - Virtual size: 5KB

.erudf Size: 512B - Virtual size: 32B

.rsrc Size: 512B - Virtual size: 16B

.wectyy
Size: 55KB - Virtual size: 54KB

.rdata
Size: 242KB - Virtual size: 241KB

.data
Size: 8KB - Virtual size: 27KB

.hxdr
Size: 5KB - Virtual size: 5KB

.erudf
Size: 512B - Virtual size: 32B

.rsrc
Size: 512B - Virtual size: 16B