70e99071c0550b10abf229f2f04037fabff5183e9e0514f1c712ddc20e01af4a

Sharing

Copy URL Twitter E-mail

General

Target

70e99071c0550b10abf229f2f04037fabff5183e9e0514f1c712ddc20e01af4a
Size

820KB
MD5

77020fe3b30581dfd670d8394b4fa7c4
SHA1

f8423c37fbfb3392e9fe70f7fcd6750129e04ee7
SHA256

70e99071c0550b10abf229f2f04037fabff5183e9e0514f1c712ddc20e01af4a
SHA512

0784794012dad962f2a2e66e477649aa8b692915674895e6d04f3daf2a3a12b84a9644aeb48e6b81494286053ee7ef85ae6e6843e3f5b92a8262f8b11eddbaca
SSDEEP

12288:iwRRHJpNqVlzFZs+cyGXQ5hiEWhY60KjQ6CLGD5EmjB12ls07cMkqQU4z2EU:iwRRi0L7XQKEW/HKo+0MkVUQ

Score

N/A

Malware Config

Signatures

Files

70e99071c0550b10abf229f2f04037fabff5183e9e0514f1c712ddc20e01af4a
.exe windows x86

fbe4d8926262dcbaacd608302b37602d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mapi32

ScMAPIXFromSMAPI
ScGenerateMuid@4
FPropCompareProp@12
PpropFindProp@12
HrEntryIDFromSz@12
HrSetOneProp@8
MAPIInitialize@4
FtMulDw@12
ScCopyProps@16
BMAPIGetAddress
UNKOBJ_ScAllocate@12
HrGetOneProp@12
BMAPIGetReadMail
MAPIAllocateBuffer@8
CloseIMsgSession@4
MAPIInitialize
FPropContainsProp@12
cmc_read
GetTnefStreamCodepage
ScCountNotifications@12
HrValidateParameters@8
GetOutlookVersion
UlAddRef@4
RTFSync
UlRelease@4
SetAttribIMsgOnIStg@16
HrValidateIPMSubtree@20
FPropExists@8

glu32

gluCylinder
gluBeginTrim
gluNewNurbsRenderer
gluDeleteNurbsRenderer
gluQuadricDrawStyle
gluDeleteQuadric
gluOrtho2D
gluNurbsCallback
gluNurbsProperty
gluLookAt
gluBuild2DMipmaps
gluPartialDisk
gluBuild1DMipmaps
gluTessEndPolygon
gluTessNormal
gluPwlCurve
gluEndCurve
gluEndPolygon
gluScaleImage

sqlwoa

newMultiByteFromWideChar
_tsystem
_DrawText@20
_FormatMessage@28
_CreateFile@28
_CommDlg_OpenSave_GetFolderPath@12
_CommDlg_OpenSave_GetFilePath@12
_GetModuleFileName@12
_DeleteFile@4
_SendDlgItemMessage@20
_FindResource@12
_CreateDialogIndirectParam@20
_GetUserName@8
_GetFileTitle@12
_DefWindowProc@16

kernel32

HeapQueryInformation
LocalUnlock
lstrcatA
GetEnvironmentStringsA
BaseInitAppcompatCacheSupport
GetFileAttributesA
OutputDebugStringW
GetConsoleTitleA
GlobalSize
SetComputerNameExA
GetLocaleInfoA
LoadLibraryW
GetCurrentThread

rtm

RtmReleaseDestInfo
RtmBlockConvertRoutesToStatic
RtmReleaseChangedDests
RtmDeleteEnumHandle
RtmWriteInstanceConfig
CheckTable
RtmCreateEnumerationHandle
RtmGetLessSpecificDestination
RtmLockDestination

clusapi

ClusterRegDeleteValue
ClusterGroupEnum
EvictClusterNode
OpenClusterNetwork
ClusterRegCloseKey
ClusterNetworkOpenEnum
ClusterGetEnumCount
GetClusterKey
ClusterNodeEnum
SetClusterNetworkPriorityOrder
CloseClusterNode
OpenClusterNetInterface
OpenCluster
GetClusterNetworkState
AddClusterResourceDependency
ClusterRegQueryValue
GetClusterGroupState
GetClusterFromResource
GetNodeClusterState
ClusterResourceTypeEnum

Sections

.text
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 197KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbe4d8926262dcbaacd608302b37602d

Headers

DLL Characteristics

File Characteristics

Imports

mapi32

glu32

sqlwoa

kernel32

rtm

clusapi

Sections

.text Size: 347KB - Virtual size: 346KB

.rdata Size: 113KB - Virtual size: 113KB

.data Size: 197KB - Virtual size: 1.6MB

.rsrc Size: 161KB - Virtual size: 160KB

.reloc Size: 1024B - Virtual size: 820B

.text
Size: 347KB - Virtual size: 346KB

.rdata
Size: 113KB - Virtual size: 113KB

.data
Size: 197KB - Virtual size: 1.6MB

.rsrc
Size: 161KB - Virtual size: 160KB

.reloc
Size: 1024B - Virtual size: 820B