ad9948f73d9eb524a199ffa769af499f8e090c7e231cb3a9f353ca53399405b1

Sharing

Copy URL Twitter E-mail

General

Target

ad9948f73d9eb524a199ffa769af499f8e090c7e231cb3a9f353ca53399405b1
Size

47KB
MD5

8f1ae82197c70c7760345589888447a6
SHA1

8fe7168f5579d397494871042f7506f2f0bb001f
SHA256

ad9948f73d9eb524a199ffa769af499f8e090c7e231cb3a9f353ca53399405b1
SHA512

2c9ab4070a756843507f7e915a005b1dc168fcb7030c9a982dc62d14ab02ac239dcfd9b64a3d451d19e6244e7de22c6bc1bc04782bc9d60b296137f9ffc2b474
SSDEEP

768:6cXf/a2hhBEypYWUKz69DcYMMCjIHYODunBhpXWdJtAfm5RZPyccBNiC7f1JoAmr:6MBhh8B2MCjIHYODqBhg8fm5RZPVcB/+

Score

N/A

Malware Config

Signatures

Files

ad9948f73d9eb524a199ffa769af499f8e090c7e231cb3a9f353ca53399405b1
.exe windows x86

8862259279b87e8574f3d8165033ad99

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sqlwoa

_GetWindowLong@8
_WinHelp@16
newWideCharFromMultiByte
_TextOut@20
_GetTextExtentPoint@16
_GetProp@8
_DeleteFile@4
_LoadIcon@8
_CommDlg_OpenSave_GetFilePath@12
_GetTextExtentPoint32@16
_GetFileTitle@12
_GetTextMetrics@8
_FreeEnvironmentStrings@4
_GetDlgItemText@16
_GetWindowTextLength@4
_CommDlg_OpenSave_GetSpec@12
_MAKEINTRESOURCE@4
_CreateFont@56
_GetObject@12
AllocConvertMultiSZNameToA
_DrawText@20
_GetWindowText@12
_SetWindowLong@12
_CharUpper@4
_GetClassInfo@12
_GetSaveFileName@4
_CallWindowProc@20
_MoveFile@8
_SetProp@12
_CommDlg_OpenSave_GetFolderPath@12
_TranslateAccelerator@12
newMultiByteFromWideCharSize
_IsDialogMessage@8
_DefWindowProc@16
newMultiByteFromWideCharEx

ntdll

NtSetBootOptions
ZwClearEvent
RtlpEnsureBufferSize
RtlCaptureStackBackTrace
ZwQueryMutant
RtlGetVersion
RtlCreateRegistryKey
wcslen
RtlDosSearchPath_Ustr
ZwSecureConnectPort
NtQueryOpenSubKeys
ZwCreateWaitablePort
NtSetHighEventPair
CsrCaptureMessageMultiUnicodeStringsInPlace
RtlCompareMemoryUlong
RtlSecondsSince1970ToTime
LdrSetDllManifestProber
RtlCopySidAndAttributesArray
RtlSetIoCompletionCallback
ZwQueryDirectoryObject
NtUnloadKey
NtTestAlert
RtlQueryProcessLockInformation
ispunct
ZwLoadKey2
ZwDebugActiveProcess
_allmul
_snprintf
ZwReadFile
RtlVerifyVersionInfo
NtPlugPlayControl
RtlMultiAppendUnicodeStringBuffer
NtLockRegistryKey
_stricmp

kernel32

GetProfileIntW
GetCurrentThread
DefineDosDeviceA
SetCalendarInfoA
CreateTimerQueue
GetShortPathNameW
FindFirstChangeNotificationW
OpenJobObjectW
EnumSystemLocalesA
WriteConsoleOutputAttribute
VirtualAlloc
SetLastConsoleEventActive
SetHandleContext
SetConsoleLocalEUDC
GetCPInfoExA
FillConsoleOutputAttribute
SetConsoleActiveScreenBuffer
lstrcmpiW
LoadLibraryA
FreeEnvironmentStringsA
SetTermsrvAppInstallMode
EnumResourceTypesA
HeapCreate
SetVolumeMountPointW
LocalAlloc
LZSeek
AttachConsole
FreeUserPhysicalPages
GetSystemDefaultUILanguage
lstrcmpiA
GetACP

iashlpr

AllocateAttributes
ShutdownIas
MemFreeIas
MemReallocIas
FreeAttributes
DoRequest
InitializeIas
MemAllocIas
ConfigureIas

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8862259279b87e8574f3d8165033ad99

Headers

DLL Characteristics

File Characteristics

Imports

sqlwoa

ntdll

kernel32

iashlpr

Sections

.text Size: 35KB - Virtual size: 34KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 336B

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 336B

.rsrc
Size: 5KB - Virtual size: 4KB