30ec2730321cf17778320c6edd2e71f0263a9a45b9a18ad606037c15e4cea019

Sharing

Copy URL Twitter E-mail

General

Target

30ec2730321cf17778320c6edd2e71f0263a9a45b9a18ad606037c15e4cea019
Size

149KB
MD5

f341280c47f7f73bc89f5539d1a97eb8
SHA1

44d19dd4bec1e0177870a7395eece02590046588
SHA256

30ec2730321cf17778320c6edd2e71f0263a9a45b9a18ad606037c15e4cea019
SHA512

ec753c16f5f9abe3a4b44fc40ac09b4befda9dd43e9a749708e3678a685f7a2204db081c2e0ef1e23bf8416995c7d0aaf00aaca58be59718490a4919dbed72ef
SSDEEP

3072:kJ3vARo5C7grM3hP3UL9QPbOSZ6KgT2vGhxEuYRoioBsHszSv/:klD5CZx3UL9+bOXKyf/iQsH4Sv/

Score

N/A

Malware Config

Signatures

Files

30ec2730321cf17778320c6edd2e71f0263a9a45b9a18ad606037c15e4cea019
.zip
Details.Pdf_____________________________________________________________.exe
.exe windows x86

1c905d3d4c93b0360c86a969e3123c38

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlUnwind
NtQueryInformationFile
NtClose
NtReadFile
NtWriteFile

shlwapi

PathCombineW

kernel32

InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
SetLastError
TlsFree
DecodePointer
GetCurrentProcess
GetTickCount
GetCurrentThread
GetProcessHeap
GetProcessTimes
GetCurrentThreadId
GetCurrentProcessId
GetThreadTimes
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
InterlockedCompareExchange
HeapDestroy
HeapCreate
HeapSize
MultiByteToWideChar
SetUnhandledExceptionFilter
CreateDirectoryW
GetFileAttributesW
CreateFileW
GetLastError
SetFileAttributesW
GetModuleHandleW
GetProcAddress
LocalFree
GetFileType
GetSystemTimeAsFileTime
GetVersionExW
GetThreadContext
SetThreadContext
CreateProcessW
VirtualFreeEx
TerminateProcess
GetModuleFileNameW
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
ResumeThread
CreateThread
CreateMutexW
IsProcessorFeaturePresent
InitializeCriticalSection
Sleep
LeaveCriticalSection
OpenMutexW
EnterCriticalSection
CreateEventW
DeleteCriticalSection
WTSGetActiveConsoleSessionId
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
LCMapStringW
GetStringTypeW
LoadLibraryW
GetNativeSystemInfo
WaitForSingleObject
HeapSetInformation
GetCommandLineA

user32

GetFocus
GetCapture
GetKBCodePage
GetForegroundWindow
GetDesktopWindow
GetActiveWindow
GetShellWindow
GetOpenClipboardWindow
GetClipboardOwner

advapi32

RegCloseKey
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExW

shell32

SHGetFolderPathW
ShellExecuteExW
ord680

ole32

CoInitializeEx

Sections

.text
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c905d3d4c93b0360c86a969e3123c38

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

shlwapi

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 55KB - Virtual size: 54KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 3KB - Virtual size: 27KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 55KB - Virtual size: 54KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 3KB - Virtual size: 27KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 5KB - Virtual size: 5KB