ad9298e70188390ca48c68276aa8e94a6641b9f96550015f3996223918aa4566

Sharing

Copy URL Twitter E-mail

General

Target

ad9298e70188390ca48c68276aa8e94a6641b9f96550015f3996223918aa4566
Size

703KB
MD5

679b85ca2d30c216bfc4588a937a5c3c
SHA1

d5018a07c845be9745f0dc64edf850407fe7d70a
SHA256

ad9298e70188390ca48c68276aa8e94a6641b9f96550015f3996223918aa4566
SHA512

6c3b7ae6a4a0cabddfddb64ff10d238546b399dcc43184baf0d2bb66d0c6495427c7610f8fb8d0a7a11c30b84873eeb82367e4628f4c31680f3589f2e19b761f
SSDEEP

12288:FS5Xd6ocP6F/zIJaeRU46zgypd/4aKf8D2zKKSKt4gzc7PS1NiMO5D:FjobbIJay6zgkFrkpc7oiMO5

Score

N/A

Malware Config

Signatures

Files

ad9298e70188390ca48c68276aa8e94a6641b9f96550015f3996223918aa4566
.exe windows x86

936f00410f282ee04f75381b3aabbaee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RemoveDirectoryA
SetCurrentDirectoryA
CreateFileA
CloseHandle
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualProtect
GetProcAddress
LoadLibraryA
CreateDirectoryA
GetCurrentThreadId
WaitForSingleObject
DeleteCriticalSection
FreeLibrary
GetTickCount
GetCommandLineW
SetEvent
Sleep
CreateEventA
GetCurrentProcessId
GetTempPathA
GetModuleFileNameW
VirtualFree
SizeofResource
LoadResource
GetModuleHandleA
VirtualAlloc
FindResourceW
GetLastError
HeapFree
ReadFile
GetCommandLineA
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
GetSystemTimeAsFileTime
HeapAlloc
GetProcessHeap
IsDebuggerPresent
IsProcessorFeaturePresent
SetFilePointer
MultiByteToWideChar
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
RtlUnwind
SetLastError
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetStdHandle
FlushFileBuffers
GetConsoleCP
CreateFileW
GetFileAttributesExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
OutputDebugStringW
LoadLibraryW
WriteConsoleW
SetEndOfFile
GetStringTypeW
LCMapStringW
HeapSize

advapi32

BuildSecurityDescriptorW
AddAccessAllowedAceEx
CryptDuplicateHash

comctl32

InitCommonControlsEx
ImageList_Remove
ImageList_Replace

Sections

.text
Size: 103KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.yuqio
Size: 558KB - Virtual size: 560KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

936f00410f282ee04f75381b3aabbaee

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

comctl32

Sections

.text Size: 103KB - Virtual size: 104KB

.rdata Size: 19KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 16KB

.rsrc Size: 10KB - Virtual size: 12KB

.reloc Size: 6KB - Virtual size: 8KB

.yuqio Size: 558KB - Virtual size: 560KB

.text
Size: 103KB - Virtual size: 104KB

.rdata
Size: 19KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 16KB

.rsrc
Size: 10KB - Virtual size: 12KB

.reloc
Size: 6KB - Virtual size: 8KB

.yuqio
Size: 558KB - Virtual size: 560KB