a1ee2886c945d84563403e2c0eb10ea7b0b30c780d5e14a723de0711376128d5

General

Target

a1ee2886c945d84563403e2c0eb10ea7b0b30c780d5e14a723de0711376128d5
Size

150KB
MD5

a4d81faa56f1257068ce2817be2ee66f
SHA1

60d50a4647be2ef92e8b6f9532ca129bc9b60cd7
SHA256

a1ee2886c945d84563403e2c0eb10ea7b0b30c780d5e14a723de0711376128d5
SHA512

eadb713a36ac54ce286df8018377729003a720e8465f0dd1dc1264566b86b63c1d1dd1feb618b2d5fad02693527ae287dccbd0ec6aed43a5b4ff62aa8a96ad66
SSDEEP

3072:YbcRdVe6HebP1UsKWk9NWM3iRh7P9bFJ:gcRbI1URWsNnu5lh

Score

N/A

Malware Config

Signatures

Files

a1ee2886c945d84563403e2c0eb10ea7b0b30c780d5e14a723de0711376128d5
.exe windows x86

b4950f2048d0fc99efdd0f4ae96d816e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSARecvFrom

ntdll

RtlQueueWorkItem
NtClose
NtCreateFile
RtlUnwind
RtlNtStatusToDosError
NtImpersonateThread
wcsncpy
RtlInitUnicodeString
NtOpenFile
NtAllocateVirtualMemory
RtlFreeHeap
NtDeviceIoControlFile
wcsstr

rtutils

TracePutsExA
TraceRegisterExA
TraceDeregisterA
TracePrintfExA
TraceDeregisterExA
TracePrintfA
TraceDumpExA

kernel32

lstrlenW
ResetEvent
SetLastError
lstrcpyW
GetQueuedCompletionStatus
SetEvent
LeaveCriticalSection
InitializeCriticalSection
InterlockedIncrement
Beep
GetCurrentProcess
GlobalFree
GetLastError
InterlockedDecrement
WaitForSingleObject
BindIoCompletionCallback
SleepEx
CreateEventA
GetConsoleCP
Sleep
DeleteCriticalSection
EnterCriticalSection
GetConsoleOutputCP

advapi32

StartServiceA
RegisterServiceCtrlHandlerA
ControlService
OpenServiceA
SetServiceStatus
CloseServiceHandle
OpenSCManagerA
QueryServiceStatus

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b4950f2048d0fc99efdd0f4ae96d816e

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

ntdll

rtutils

kernel32

advapi32

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 139KB - Virtual size: 139KB

.reloc Size: 512B - Virtual size: 28B

.data Size: 1KB - Virtual size: 352KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 139KB - Virtual size: 139KB

.reloc
Size: 512B - Virtual size: 28B

.data
Size: 1KB - Virtual size: 352KB