5d22655d0274df6d45f34529362d1e08398da6c52395147fb811d8d6065bbacf

Sharing

Copy URL Twitter E-mail

General

Target

5d22655d0274df6d45f34529362d1e08398da6c52395147fb811d8d6065bbacf
Size

328KB
MD5

b2e58f155d9c34d4a6ba61fb074f115b
SHA1

aeea2f29f2287f13fe4ee6daa741d8f3cddfafe6
SHA256

5d22655d0274df6d45f34529362d1e08398da6c52395147fb811d8d6065bbacf
SHA512

1bfe8b53cf0440d09869f68b876d41da8c5f2be4156cb3ef943e9ca73300426c3bcf29d76c59bb8ad4937c3e467264443d93b2f43d426b898e83b2f608473f32
SSDEEP

6144:KSqW5GYcUi+BzOTQj0jDQRPQyp5eFrOXJCyV6:Kgi/ypIFY8F

Score

N/A

Malware Config

Signatures

Files

5d22655d0274df6d45f34529362d1e08398da6c52395147fb811d8d6065bbacf
.exe windows x86

10f9cc6e21015218faf17cc4ec2f2590

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

fermatau

?exists@FilePath@@SA_NPBG_N@Z
?setName@FilePath@@SA?AVCString@WTL@@ABV23@0_N@Z
?deinit@Fermata@@YAXXZ
?init@Fermata@@YAXXZ
?getFolder@SpecialFolder@@SA?AVCString@WTL@@W4FolderID@1@@Z
?makePath@FilePath@@SA?AVCString@WTL@@PBG0_N@Z
?create@FontCache@Fermata@@SAPAV12@XZ

brandingres

?GetInstance@GizeConfig@@SAPAV1@XZ

kernel32

InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
lstrlenA
FreeLibrary
GetThreadLocale
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
FlushInstructionCache
VirtualQuery
GetVersion
SetLastError

user32

DestroyWindow

advapi32

RegCloseKey

ole32

CoInitialize
CoUninitialize
CoCreateInstance

mslurt

_except_handler3
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_initterm
__wgetmainargs
__dllonexit
_onexit
_controlfp
_adjust_fdiv
_wcmdln
exit
_XcptFilter
_exit
__CxxFrameHandler
??2@YAPAXI@Z
free
_CxxThrowException
wcscpy
_wtoi
_wfullpath
getenv
swprintf
wcslen
vswprintf
memmove
wcstol

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 192KB - Virtual size: 496KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

10f9cc6e21015218faf17cc4ec2f2590

Headers

File Characteristics

Imports

fermatau

brandingres

kernel32

user32

advapi32

ole32

mslurt

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 6KB

.rsrc Size: 28KB - Virtual size: 24KB

.vmp0 Size: 192KB - Virtual size: 496KB

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 28KB - Virtual size: 24KB

.vmp0
Size: 192KB - Virtual size: 496KB