6ff9d3bf7e479a5df6fd00bf49fc579a8c33a0991ce96c76fbb2361faab9915c

Sharing

Copy URL Twitter E-mail

General

Target

6ff9d3bf7e479a5df6fd00bf49fc579a8c33a0991ce96c76fbb2361faab9915c
Size

105KB
MD5

8fa595234d9a32af386012e2aff4972d
SHA1

bd081dfb7eb1ec62add7443a3a08676d50a0f4df
SHA256

6ff9d3bf7e479a5df6fd00bf49fc579a8c33a0991ce96c76fbb2361faab9915c
SHA512

323ee3fdfb2dfbd755e098eed263ec157af5b8e160e46bd83f9a1475ac684a637daa37c9cdc5b46a944adf96add0259744482813dea6b8759b6b960563cc57ba
SSDEEP

3072:ys2kpHrCchtJx2/01nf/2LNZMnW+/IR1+RQcFMpL:ys2k/3P1HWZM6v+R8

Score

N/A

Malware Config

Signatures

Files

6ff9d3bf7e479a5df6fd00bf49fc579a8c33a0991ce96c76fbb2361faab9915c
.exe windows x86

6b86ee8eb27738ea9e09cf6a9fc00274

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
strcmp
memmove
strlen
strcpy
strcat
sprintf
_stricmp
memcpy
malloc
free
fseek
ftell
fread
fclose
atof
atoi
sscanf
_strdup
realloc
strncmp
strspn
strncpy
strtoul
isdigit
strncat
fflush
__p__iob
exit
getenv
fopen
fgets
isspace
strchr
isalpha
feof
time
fwrite
_errno
isalnum
strstr
isupper
tolower
islower
toupper
strtol
_unlink
strerror
_stat
_rmdir
isxdigit

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
CreateFileA
SetFilePointer
SetEndOfFile
HeapAlloc
WriteFile
HeapFree
WideCharToMultiByte
HeapReAlloc
ReadFile
InterlockedExchange
FormatMessageA
LoadLibraryExA
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
MoveFileExA
GetLastError
CreateDirectoryA
MultiByteToWideChar
DeviceIoControl
LocalFree
RemoveDirectoryA
GetFileAttributesExA
LoadLibraryA
GetProcAddress
FreeLibrary
SleepEx
GetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose

user32

CallWindowProcA

advapi32

GetUserNameA

secur32

FreeCredentialsHandle
DeleteSecurityContext
InitializeSecurityContextA
FreeContextBuffer
AcquireCredentialsHandleA

wsock32

WSAStartup
WSACleanup
setsockopt
WSAGetLastError
closesocket
socket
connect
htonl
send
WSASetLastError
recv
getsockopt
getsockname
ntohl
ntohs
select
htons
ioctlsocket
inet_ntoa
gethostbyname

shfolder

SHGetFolderPathA

Sections

.code
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6b86ee8eb27738ea9e09cf6a9fc00274

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

secur32

wsock32

shfolder

Sections

.code Size: 8KB - Virtual size: 8KB

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 6KB - Virtual size: 8KB

.code
Size: 8KB - Virtual size: 8KB

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 6KB - Virtual size: 8KB