f66e9f5f2c145f7e5904bf9a03be18c96ef403738ffab9a132997f629df11ba4

Sharing

Copy URL Twitter E-mail

General

Target

f66e9f5f2c145f7e5904bf9a03be18c96ef403738ffab9a132997f629df11ba4
Size

72KB
MD5

18bff270ae27eb0d53122b82b570ab0c
SHA1

2f7ca8a1c21120f66b38111c6a458d5bda77509b
SHA256

f66e9f5f2c145f7e5904bf9a03be18c96ef403738ffab9a132997f629df11ba4
SHA512

e3467ac87f1631c3de611c35ab10cccf98dc4e62b6f92124517ef34f928cae23a802f81326c1a7cf5375af63f5542ef64d7c901b2cddedfbaed2a92579948715
SSDEEP

768:KMtZrKQRSSeaUSPwGHahkWKspxtIYW2Q9hmfBgQLYJ2nDhr6M7+A2WrpOuUbu:1DrKQRTf/wG6h3Fe8+AYJIX79MuUy

Score

N/A

Malware Config

Signatures

Files

f66e9f5f2c145f7e5904bf9a03be18c96ef403738ffab9a132997f629df11ba4
.exe windows x86

53d0c778a80831858967d619966a6dae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentStrings
VirtualAlloc
IsSystemResumeAutomatic
VirtualAllocEx
ShowConsoleCursor
GetConsoleCharType
OpenJobObjectW
SetUserGeoID
LocalAlloc
Process32NextW
ReadConsoleInputW
ScrollConsoleScreenBufferA
GetPrivateProfileSectionNamesA
InitializeCriticalSection
GetDefaultCommConfigA
SetCommBreak
GetSystemDefaultLCID
EnumerateLocalComputerNamesW
MapUserPhysicalPagesScatter
GetPrivateProfileStringW
LZCopy
GetConsoleKeyboardLayoutNameW
SetConsoleKeyShortcuts
GetTapeStatus
GetAtomNameA
VirtualFreeEx
EraseTape
FindVolumeMountPointClose
GetNumaHighestNodeNumber
LockResource
GetWindowsDirectoryW
Module32First
GetFullPathNameW
CopyFileExA
GetPrivateProfileSectionA
ReadConsoleOutputW
IsDBCSLeadByteEx
EnumSystemCodePagesA
WideCharToMultiByte
PrivCopyFileExW
GetNumaAvailableMemoryNode
HeapCreate
DefineDosDeviceW
GetCurrentThread
EnumUILanguagesA
EnumSystemCodePagesW
WriteConsoleOutputAttribute
GetFileSize
GetPrivateProfileSectionW
DeleteFileA
GetTimeFormatA
ReplaceFileW
RaiseException
PeekNamedPipe
LoadLibraryA
GetConsoleCursorMode
MoveFileWithProgressW
SetTermsrvAppInstallMode
AddRefActCtx
SetProcessWorkingSetSize
QueryPerformanceCounter
LocalFileTimeToFileTime
ContinueDebugEvent
GetDateFormatW
WriteConsoleInputVDMW
GetDefaultCommConfigW
PostQueuedCompletionStatus
Beep
GetConsoleScreenBufferInfo

security

EnumerateSecurityPackagesW
VerifySignature
ApplyControlToken
QuerySecurityPackageInfoA
SealMessage
InitializeSecurityContextW
QueryContextAttributesW
AcceptSecurityContext
RevertSecurityContext
DeleteSecurityPackageA
EncryptMessage
DeleteSecurityPackageW
AddSecurityPackageA
QueryCredentialsAttributesA
ExportSecurityContext
QueryCredentialsAttributesW
ImpersonateSecurityContext
MakeSignature
ImportSecurityContextA
ImportSecurityContextW
InitializeSecurityContextA
QuerySecurityContextToken
DeleteSecurityContext
QueryContextAttributesA
AcquireCredentialsHandleA
FreeContextBuffer
EnumerateSecurityPackagesA
DecryptMessage
CompleteAuthToken
UnsealMessage
AcquireCredentialsHandleW
InitSecurityInterfaceW
FreeCredentialsHandle
AddSecurityPackageW
QuerySecurityPackageInfoW

untfs

?InsertIntoFile@NTFS_ATTRIBUTE@@UAEEPAVNTFS_FILE_RECORD_SEGMENT@@PAVNTFS_BITMAP@@@Z
?ReadList@NTFS_ATTRIBUTE_LIST@@QAEEXZ
?QueryFileReference@NTFS_INDEX_TREE@@QAEEKPAXKPAU_MFT_SEGMENT_REFERENCE@@PAE@Z
??0NTFS_ATTRIBUTE@@QAE@XZ
?NtfsUpcaseCompare@@YGJPBGK0KPBVNTFS_UPCASE_TABLE@@E@Z
?QuerySegmentReference@NTFS_MFT_INFO@@SG?AU_MFT_SEGMENT_REFERENCE@@PAX@Z
?Initialize@NTFS_LOG_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??0NTFS_UPCASE_TABLE@@QAE@XZ
?Initialize@NTFS_BITMAP_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?GetNextAttributeRecord@NTFS_FRS_STRUCTURE@@QAEPAXPBXPAVMESSAGE@@PAE@Z
?SafeQueryAttribute@NTFS_FRS_STRUCTURE@@QAEEKPAVNTFS_ATTRIBUTE@@0@Z
?Resize@NTFS_ATTRIBUTE@@UAEEVBIG_INT@@PAVNTFS_BITMAP@@@Z
?Read@NTFS_ATTRIBUTE@@QAEEPAXVBIG_INT@@KPAK@Z
?Flush@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_BITMAP@@PAVNTFS_INDEX_TREE@@E@Z
?CompareDupInfo@NTFS_MFT_INFO@@SGEPAXPAU_FILE_NAME@@@Z
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEVBIG_INT@@PAVNTFS_MASTER_FILE_TABLE@@@Z
?Initialize@NTFS_BITMAP@@QAEEVBIG_INT@@EPAVLOG_IO_DP_DRIVE@@K@Z
?Initialize@NTFS_ATTRIBUTE_RECORD@@QAEEPAVIO_DP_DRIVE@@PAX@Z
?ReadNext@NTFS_FRS_STRUCTURE@@QAEEVBIG_INT@@@Z
?IsAllocated@NTFS_BITMAP@@QBEEVBIG_INT@@0@Z
?Flush@NTFS_MFT_FILE@@QAEEXZ
?TakeCensus@NTFS_SA@@QAEEPAVNTFS_MASTER_FILE_TABLE@@KPAUNTFS_CENSUS_INFO@@@Z
??0NTFS_FILE_RECORD_SEGMENT@@QAE@XZ
?SetVolumeFlag@NTFS_SA@@QAEEGPAE@Z
?CompareFileName@NTFS_MFT_INFO@@SGEPAXKPAU_FILE_NAME@@PAG@Z
?Initialize@NTFS_CLUSTER_RUN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@VBIG_INT@@KK@Z

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

phjdopg
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

53d0c778a80831858967d619966a6dae

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

security

untfs

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 2KB

phjdopg Size: - Virtual size: 4KB

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 2KB

phjdopg
Size: - Virtual size: 4KB