371a19bd2ac4af89f12ae31f385861c79ab8940f7eec2ae9af6d7f090433205f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

371a19bd2ac4af89f12ae31f385861c79ab8940f7eec2ae9af6d7f090433205f
Size

816KB
MD5

5a1927bb52ba0c53501fb448f183c12d
SHA1

fc120b69e3dbed5490a0d346f0575462f09cc990
SHA256

371a19bd2ac4af89f12ae31f385861c79ab8940f7eec2ae9af6d7f090433205f
SHA512

053bcf1a0965b758e9bba339f74e33304783a40bbe5cd9fcaf4f7572b067d50678abd61e23fea2c4780c3034aeec5f7d206a7c024eab86e2aa776140d996e87f
SSDEEP

12288:zcy/QMf4wIJ25FsGbhgdBk945UmDEwKxjqajtckXGyPcNH6HKtVgoxhknDnxlWQl:9rAVoP94jEwKYY+knPc8q0oEnDnp

Score

N/A

Malware Config

Signatures

Files

371a19bd2ac4af89f12ae31f385861c79ab8940f7eec2ae9af6d7f090433205f
.exe windows x86

16c287257fe076adb057443f22a7808a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileW
CreateEventA
GetCurrentProcess
VirtualAlloc
lstrcpynA
lstrlenA
GetFullPathNameA
GetStartupInfoW
GetModuleHandleA
FindNextVolumeW
GetPrivateProfileIntA
lstrcpynA
TlsGetValue
TlsAlloc
GetNumberFormatA
lstrcpynA
GetLocaleInfoW
SetCurrentDirectoryA
lstrcpynA
GetModuleFileNameW
TlsAlloc
lstrcpynA
FormatMessageA

vssapi

??0CVssJetWriter@@QAE@XZ
??0CVssWriter@@QAE@XZ
VssFreeSnapshotProperties
??1CVssWriter@@UAE@XZ

Sections

.text
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 797KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ