b94d360abe9df1ee8c27c39b727f92f3c51fc44914a27ac085d46519625459b8

Sharing

Copy URL

Twitter E-mail

General

Target

b94d360abe9df1ee8c27c39b727f92f3c51fc44914a27ac085d46519625459b8
Size

315KB
MD5

987e157993bcb5fc20a99f1855d16f9d
SHA1

4d2060949a65dc4d6148063f2fd1af7cee99adf1
SHA256

b94d360abe9df1ee8c27c39b727f92f3c51fc44914a27ac085d46519625459b8
SHA512

b60faaae86852d8b33f6869bf687284bbe7a6463a73f6f416418a4c8d0fa42cd12c824688c8e45a9e5f757a83ee980dc4df0e69b1adeedd10a579fc34269ac9d
SSDEEP

6144:HMNohmsvZ6ilPEoq2gVdRZ93LED1RhFgWZy4CJjTeStf+VBAH0R:HMNo4sv8UNQdn9sRhFgWZy4EzGAH0R

Score

N/A

Malware Config

Signatures

Files

b94d360abe9df1ee8c27c39b727f92f3c51fc44914a27ac085d46519625459b8
.exe windows x86

ad954c607416ec333a937f892e0f0a0c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
_CIsinh
malloc
free
fseek
ftell
fread
fclose
atof
atoi
sscanf
strlen
sprintf
strcpy
_strdup
realloc
strncmp
strspn
strncpy
strtoul
isdigit
strncat
fflush
__p__iob
exit
getenv
fopen
fgets
isspace
strchr
isalpha
feof
time
fwrite
memmove
_errno
isalnum
strstr
isupper
tolower
islower
toupper
strtol
_unlink
strerror
_stat
_rmdir
isxdigit

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
CloseHandle
InitializeCriticalSection
GetExitCodeProcess
FreeLibrary
HeapFree
LoadLibraryA
GetProcAddress
HeapAlloc
EnterCriticalSection
HeapReAlloc
LeaveCriticalSection
TlsGetValue
TlsSetValue
TlsAlloc
InterlockedExchange
LoadLibraryExA
FormatMessageA
GetCurrentThreadId
MoveFileExA
GetLastError
CreateDirectoryA
CreateFileA
MultiByteToWideChar
DeviceIoControl
LocalFree
RemoveDirectoryA
GetFileAttributesExA
SleepEx
GetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
WaitForMultipleObjects
GetCurrentProcess
GetCurrentThread
DuplicateHandle
CreateSemaphoreA
CreateThread
ReleaseSemaphore

advapi32

GetUserNameA

secur32

FreeCredentialsHandle
DeleteSecurityContext
InitializeSecurityContextA
FreeContextBuffer
AcquireCredentialsHandleA

wsock32

WSAStartup
WSACleanup
setsockopt
WSAGetLastError
closesocket
socket
connect
htonl
send
WSASetLastError
recv
getsockopt
getsockname
ntohl
ntohs
select
htons
ioctlsocket
inet_ntoa
gethostbyname

shfolder

SHGetFolderPathA

Sections

.code
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad954c607416ec333a937f892e0f0a0c

Headers

File Characteristics

Imports

msvcrt

kernel32

advapi32

secur32

wsock32

shfolder

Sections

.code Size: 9KB - Virtual size: 9KB

.text Size: 67KB - Virtual size: 66KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 6KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 4KB

.code
Size: 9KB - Virtual size: 9KB

.text
Size: 67KB - Virtual size: 66KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 4KB