629943853e69d7888cd92b87fe624f52338b941e87abf9d12c664f6e9bf2dbca

Sharing

Copy URL Twitter E-mail

General

Target

629943853e69d7888cd92b87fe624f52338b941e87abf9d12c664f6e9bf2dbca
Size

347KB
MD5

059770ef19979261193e92a4e27db154
SHA1

069620651cd26e64e725bc0a5c610e2a922924f3
SHA256

629943853e69d7888cd92b87fe624f52338b941e87abf9d12c664f6e9bf2dbca
SHA512

4af23ffce411d581d86e14a1a8e75f90c69e1fa905af02babe7d94411a23d2725c0b87097bbad1d936253170bf58a9245ee124141f9d0d86338c54ee99c9ed9f
SSDEEP

6144:ebqwG+fWfBJDzEDPoJGkNVxjkZKECs5NYVxLAOGAmosNFpFxQoEevZZUDkkg40A:eqxn2A8kZjkYEJYVvcLjxQJev3UDkL40

Score

N/A

Malware Config

Signatures

Files

629943853e69d7888cd92b87fe624f52338b941e87abf9d12c664f6e9bf2dbca
.exe windows x86

20cc194720a3a64d41fa0d78c9d8ddc6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

dbnmpntw

ConnectionWriteOOB
ConnectionObjectSize
ConnectionClose
ConnectionMode
ConnectionServerEnum
ConnectionOpenW
ConnectionTransact
ConnectionCheckForData
ConnectionWrite
ConnectionServerEnumW
ConnectionRead
ConnectionOpen
ConnectionErrorW
ConnectionError
ConnectionVer

crtdll

_j0
fopen
__dllonexit
freopen
_cabs
printf
tolower
wctomb
_ftime
_mbsspn
_beginthread
clock
feof
_strncnt
_snwprintf
_CIsinh
_fstat
memset
_winver_dll
strcspn
iswcntrl

kernel32

DeleteCriticalSection
ReadConsoleInputW
FindResourceW
GetEnvironmentStringsW
VirtualAlloc
IsValidLocale
SetConsolePalette
LoadLibraryA
SwitchToThread
OutputDebugStringA
CreateWaitableTimerW
GetHandleInformation
GlobalFree
DefineDosDeviceW
LocalReAlloc
SetEnvironmentVariableA
SetComputerNameExA
WideCharToMultiByte
IsDebuggerPresent
SetLastError
_lread
CopyFileExW
WriteProcessMemory
lstrlenA
InitializeCriticalSection
InvalidateConsoleDIBits

ntdll

RtlMoveMemory
RtlFreeHandle
RtlNtPathNameToDosPathName
ZwQueryInformationToken
RtlValidAcl
NtConnectPort
NtGetDevicePowerState
memset
ZwSetInformationProcess
ZwAlertResumeThread
ZwPrivilegeObjectAuditAlarm
ZwCreateKey
RtlEqualString
ZwQueryTimer
LdrGetProcedureAddress
ZwCompressKey
towlower
DbgUiContinue
NtOpenEventPair
LdrFindResourceDirectory_U
RtlAcquireResourceShared
ZwExtendSection
RtlSetSecurityDescriptorRMControl
RtlCopySid
DbgQueryDebugFilterState
RtlUlongByteSwap
RtlExitUserThread
RtlUnicodeStringToOemSize
ZwResetEvent
atoi
RtlStartRXact
RtlIdentifierAuthoritySid
RtlCreateUnicodeStringFromAsciiz
ZwReleaseKeyedEvent
RtlLargeIntegerToChar
ZwCreateJobSet
RtlCreateHeap
ZwUnloadDriver
NtReleaseMutant
NtNotifyChangeMultipleKeys
ZwQueryObject
RtlTimeToSecondsSince1970
CsrCaptureTimeout
RtlIpv6AddressToStringW
NtFreeUserPhysicalPages

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20cc194720a3a64d41fa0d78c9d8ddc6

Headers

File Characteristics

Imports

dbnmpntw

crtdll

kernel32

ntdll

Sections

.text Size: 94KB - Virtual size: 94KB

.rdata Size: 137KB - Virtual size: 136KB

.data Size: 96KB - Virtual size: 491KB

.rsrc Size: 18KB - Virtual size: 18KB

.text
Size: 94KB - Virtual size: 94KB

.rdata
Size: 137KB - Virtual size: 136KB

.data
Size: 96KB - Virtual size: 491KB

.rsrc
Size: 18KB - Virtual size: 18KB