e9f25f2bfbf811a3c456ba15a689d0ef5c107f1f4300c4b41675bbf626230acb

Sharing

Copy URL Twitter E-mail

General

Target

e9f25f2bfbf811a3c456ba15a689d0ef5c107f1f4300c4b41675bbf626230acb
Size

2.9MB
MD5

5f2d4f63825b0fd5975a11e8d5368e5a
SHA1

9cda9a3e10c44e622186f3d0a978bd6956b723f3
SHA256

e9f25f2bfbf811a3c456ba15a689d0ef5c107f1f4300c4b41675bbf626230acb
SHA512

de2790b432a25b145f6578d898f54b4371a05f14c191509c3a0acabbb816f376829c6acb80ca9ee51736085c749ffbf1760569460d35a82ae18ce2ae931d9d43
SSDEEP

49152:DIWotkjXqG1nSQvUg/JpYYc0J7RiC4PafPfEwp0NCFdK4pw+HR0oBJIpTUlsheTF:botkjXOQ470HiNvwp0NCppwkCpo6Ci0T

Score

N/A

Malware Config

Signatures

Files

e9f25f2bfbf811a3c456ba15a689d0ef5c107f1f4300c4b41675bbf626230acb
.exe windows x86

9c67a4925654cd6a2a14af776b2ad105

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcp60

_Toupper

cryptnet

CertDllVerifyRevocation
CryptUninstallCancelRetrieval
CryptFlushTimeValidObject
CryptInstallCancelRetrieval
CryptRetrieveObjectByUrlA
DllRegisterServer
CryptGetTimeValidObject
CryptGetObjectUrl
LdapProvOpenStore
I_CryptNetGetHostNameFromUrl
I_CryptNetEnumUrlCacheEntry
DllUnregisterServer
CryptCancelAsyncRetrieval
CertDllVerifyCTLUsage
I_CryptNetGetUserDsStoreUrl
CryptRetrieveObjectByUrlW

msvbvm60

__vbaVarTextTstEq
__vbaLateIdStAd
rtcGetTimeVar
__vbaR4Sgn
PutMemNewObj
__vbaCyAbs
__vbaCyErrVar
rtcSendKeys
__vbaLsetFixstrFree
EVENT_SINK_QueryInterface
__vbaVarTextLikeVar
__vbaVarTextCmpNe
__vbaVarZero
rtcSplit
__vbaMidStmtVar
__vbaRsetFixstrFree
TipInvokeMethod
rtDecFromVar
__vbaVarTextTstGe
__vbaVarTextCmpGe
__vbaR8IntI4
__vbaAryRebase1Var
TipUnloadProject
rtcGetDayOfMonth
rtcVarFromVar
__vbaLbound
GetMem2
GetMem1
__vbaLdZeroAry
__vbaHresultCheckNonvirt
__vbaStrUI1
__vbaOnError
rtcMIRR
rtcBstrFromAnsi
rtcCos
__vbaFreeObjList
__vbaCyMul
__vbaVarCmpGt
__vbaPut4
__vbaStrToUnicode
BASIC_CLASS_AddRef
__vbaCyForNext
EbGetErrorInfo
_CIlog
Zombie_GetTypeInfoCount
__vbaPutFxStr3

kernel32

CreateDirectoryExA
CreateProcessInternalW
Thread32Next
LoadLibraryExA
ResetWriteWatch
TlsFree
DeleteFiber
GetStdHandle
CreateMutexW
GetProcAddress
EscapeCommFunction
VirtualFreeEx
WriteFileGather
QueueUserAPC
HeapQueryInformation
GetConsoleAliasesLengthW
GetLocaleInfoA
GetDiskFreeSpaceW
SetTapePosition
VirtualAlloc
SwitchToFiber
IsDBCSLeadByteEx
FlushConsoleInputBuffer
GetOverlappedResult
_lcreat
SignalObjectAndWait
Heap32Next
GetAtomNameW
WriteFileEx
GetLastError
GetProfileStringW
SetEnvironmentVariableA
PrivMoveFileIdentityW
GetVDMCurrentDirectories
LoadLibraryA
GetVolumeInformationW
MulDiv
GetDateFormatA
GetConsoleAliasExesLengthA
TlsGetValue
IsBadHugeWritePtr
VirtualUnlock
DnsHostnameToComputerNameA
EnumUILanguagesA
GetPrivateProfileSectionNamesW
CompareFileTime
SetConsoleCP
Process32First
RequestDeviceWakeup
MultiByteToWideChar

Sections

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 14.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 670KB - Virtual size: 669KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9c67a4925654cd6a2a14af776b2ad105

Headers

File Characteristics

Imports

msvcp60

cryptnet

msvbvm60

kernel32

Sections

.rsrc Size: 11KB - Virtual size: 11KB

.data Size: - Virtual size: 14.0MB

.text Size: 670KB - Virtual size: 669KB

.tls Size: 512B - Virtual size: 4KB

.rsrc
Size: 11KB - Virtual size: 11KB

.data
Size: - Virtual size: 14.0MB

.text
Size: 670KB - Virtual size: 669KB

.tls
Size: 512B - Virtual size: 4KB