65edbfac1aaa8840bc4a394f0f0199f22a90f30174cf9d137bebede959f21bbb

Sharing

Copy URL Twitter E-mail

General

Target

65edbfac1aaa8840bc4a394f0f0199f22a90f30174cf9d137bebede959f21bbb
Size

119KB
MD5

31af613591783328ec3b97e204a5b752
SHA1

60a955fbf324d1e83a60f9808ebd9c947e7899ee
SHA256

65edbfac1aaa8840bc4a394f0f0199f22a90f30174cf9d137bebede959f21bbb
SHA512

16f7daaee583f4c7e25c13690af14be77e3d3d199273b985069034dd57ff15563844f32d3feedd62e6fb604755a465de54e5d2261371931e3f516919a31f34a0
SSDEEP

1536:/ksFb5kp3j8HyOUXmk39pG9GV6L7DxAtBRPjCMqGOCo3n+0dw5gSqne2u:/23j92ktoLwCVRddw5gpn3u

Score

N/A

Malware Config

Signatures

Files

65edbfac1aaa8840bc4a394f0f0199f22a90f30174cf9d137bebede959f21bbb
.exe windows x86

73717420d584a8e8343f53003be0e249

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

getpeername
connect
WSAStartup
ioctlsocket
select
htons
getsockname
setsockopt
recv
socket
closesocket
send

kernel32

GetLocaleInfoA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetCurrentProcess
TerminateProcess
GetLastError
GetProcAddress
GetSystemInfo
GetModuleHandleA
CloseHandle
FindResourceA
FreeResource
LoadResource
GlobalLock
GlobalAlloc
Sleep
SizeofResource
CreateProcessA
GlobalUnlock
LockResource
GetModuleFileNameA
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
HeapReAlloc
VirtualAlloc
InitializeCriticalSectionAndSpinCount
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
GetSystemTime
IsDebuggerPresent
CreateFileA
GetCurrentProcessId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileAttributesA
CreateDirectoryA
DeleteFileA
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
HeapFree
HeapAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetFileType
SetFilePointer
SetHandleCount
GetStdHandle
DeleteCriticalSection
HeapSize
ExitProcess
MultiByteToWideChar
ReadFile
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount

user32

GetMessageA
SetTimer
KillTimer
WaitForInputIdle
wsprintfA
TranslateMessage
DispatchMessageA

advapi32

CryptDestroyHash
CryptDecrypt
CheckTokenMembership
FreeSid
CryptCreateHash
CryptEncrypt
AllocateAndInitializeSid
CryptAcquireContextA
CryptReleaseContext
GetTokenInformation
CryptDeriveKey
OpenProcessToken
CryptHashData

shell32

ShellExecuteExA
ShellExecuteA

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73717420d584a8e8343f53003be0e249

Headers

DLL Characteristics

File Characteristics

Imports

wsock32

kernel32

user32

advapi32

shell32

Sections

.text Size: 84KB - Virtual size: 83KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 84KB - Virtual size: 83KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB