f50f295816d38964d8abf9ad473ca5b04a324dfd6dc8b22a720928d13d857ae3

Sharing

Copy URL Twitter E-mail

General

Target

f50f295816d38964d8abf9ad473ca5b04a324dfd6dc8b22a720928d13d857ae3
Size

100KB
MD5

004313dc5657556b434cd3b8b187e7b3
SHA1

e4cf5d42d2def34ebc35b155dca46f64f1aec74d
SHA256

f50f295816d38964d8abf9ad473ca5b04a324dfd6dc8b22a720928d13d857ae3
SHA512

d8983546c4ad54c9defdc5a0f03f802aa7fdbf0d2ffd21d7c708f9b679283d19fe19f0171b1afa024cb1d09ee576286dc97281cf9bbd54f14ec8320b089eae43
SSDEEP

1536:xj6Xk0CJAEabq9ugKyQy7+RVk2mRoapYwW5nC5Ziiw2bzUipuYGdaZM:xjNLJALq9My3yRoFYJC5ZZHUixGdwM

Score

N/A

Malware Config

Signatures

Files

f50f295816d38964d8abf9ad473ca5b04a324dfd6dc8b22a720928d13d857ae3
.exe windows x86

5c60030737cb07e324c4daceae1a3aba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineW
wnsprintfA
wnsprintfW

kernel32

TlsGetValue
TlsAlloc
ExitProcess
GetModuleHandleW
ExitThread
OpenProcess
UnmapViewOfFile
MapViewOfFileEx
GetFileSizeEx
CreateFileMappingW
GetFileSize
SetEndOfFile
MoveFileExW
TlsSetValue
FreeLibrary
LoadLibraryA
LocalFree
SetEvent
WaitForMultipleObjects
GetEnvironmentVariableW
GetTempFileNameW
FindFirstFileW
CreateDirectoryW
CopyFileW
GetTempPathW
InitializeCriticalSection
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
GetCurrentThreadId
CreateProcessW
GetLogicalDrives
GetFileAttributesW
ReadFile
CreatePipe
DuplicateHandle
GetProcAddress
GetModuleHandleA
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileInformationByHandle
InterlockedIncrement
CreateRemoteThread
ReadProcessMemory
VirtualProtectEx
WideCharToMultiByte
MultiByteToWideChar
GetNativeSystemInfo
GetVersionExW
GetSystemTimeAsFileTime
GetLastError
SetFilePointer
CreateThread
GetVolumeInformationW
GetCurrentProcessId
ReleaseMutex
CreateEventW
ResetEvent
SetThreadPriority
GetModuleFileNameW
Sleep
GetCurrentThread
SignalObjectAndWait
WaitForSingleObject
CreateMutexW
GetComputerNameA
DeleteFileW
CloseHandle
EnterCriticalSection
FlushFileBuffers
CreateFileW
LeaveCriticalSection
WriteFile
InterlockedDecrement
FindClose
GetDriveTypeW

advapi32

GetSecurityDescriptorSacl
SetNamedSecurityInfoW
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegSetValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenThreadToken
OpenProcessToken
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptGenKey
CryptCreateHash
CryptEncrypt
CryptReleaseContext
CryptDuplicateHash
CryptVerifySignatureW
CryptAcquireContextW
CryptExportKey
CryptGetHashParam
EqualSid
GetLengthSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHGetFolderPathW

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c60030737cb07e324c4daceae1a3aba

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

shell32

Sections

.text Size: 56KB - Virtual size: 56KB

code Size: 8KB - Virtual size: 8KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 12KB - Virtual size: 12KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 56KB - Virtual size: 56KB

code
Size: 8KB - Virtual size: 8KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 12KB - Virtual size: 12KB

.reloc
Size: 8KB - Virtual size: 8KB