c36387964312107000e9735217e63766fca53e1267661716779c4879e7ced19f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c36387964312107000e9735217e63766fca53e1267661716779c4879e7ced19f
Size

69KB
MD5

4b1aa1fffa7c6d1b00e43f121109ce27
SHA1

bdbf7774163f18f0f1fb065d504984fd642f3615
SHA256

c36387964312107000e9735217e63766fca53e1267661716779c4879e7ced19f
SHA512

0c53dd16628eeba561ba0d714c78d0259bcdde08fa4b62aa533b2ca4816d48d9332117ed8260175bed86658fc3b6f6dd3f0c1639891c79c44c612635f5cecbb2
SSDEEP

1536:BTlRq96LFyrzk+nv7lf3RgdUGPYrQzTen:BTlY9prVvhf3ToYr

Score

N/A

Malware Config

Signatures

Files

c36387964312107000e9735217e63766fca53e1267661716779c4879e7ced19f
.exe windows x86

d0e6428bffe1a0dacf33471b9337c0da

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFullPathNameA
lstrcpynA
VirtualAlloc
TlsAlloc
FindNextVolumeW
DeleteFileW
TlsGetValue
GetLocaleInfoW
GetNumberFormatA
GetModuleHandleA
GetModuleFileNameW
lstrcpynA
GetCurrentProcess
TlsAlloc
lstrcpynA
CreateEventA
lstrcpynA
GetStartupInfoW
lstrcpynA
GetPrivateProfileIntA
SetCurrentDirectoryA
lstrlenA
FormatMessageA

vssapi

VssFreeSnapshotProperties
??0CVssWriter@@QAE@XZ
IsVolumeSnapshotted
??1CVssWriter@@UAE@XZ

Sections

.text
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE