ef6972756120ec16b698e25db2869a5d8c1f12a1b93d4ba57ef7d3ca475437a6

Sharing

Copy URL Twitter E-mail

General

Target

ef6972756120ec16b698e25db2869a5d8c1f12a1b93d4ba57ef7d3ca475437a6
Size

284KB
MD5

d1a8b65e6241387052109468becb15a0
SHA1

3423675e08471dba9bb9c568bc71492a04093d84
SHA256

ef6972756120ec16b698e25db2869a5d8c1f12a1b93d4ba57ef7d3ca475437a6
SHA512

b93e1b91e44deb4049720310afefcd66c5a3a387a0591027aecf47ed8effa66331ba7e86388d6f076a98c517f4a31a6c0857290b7eba377d31ee40a2763d2a16
SSDEEP

6144:pJG0Be7qywSAqT1Fi/AxILJXiNuGgRsN:pM0Be7qywSAqTqAxILJiNuG5N

Score

N/A

Malware Config

Signatures

Files

ef6972756120ec16b698e25db2869a5d8c1f12a1b93d4ba57ef7d3ca475437a6
.dll windows x86

6d5de578f7b910cd8cd28311bfac5278

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

pncrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
_findclose
_purecall
_findnext
_findfirst
sscanf
_ismbcspace
strncpy
strtok
strchr
printf
_endthreadex
_beginthreadex
sprintf
_ftol
_vsnprintf
free
_stricmp
_ftime
_stat
_itoa
_putenv
_strcmpi
??3@YAXPAX@Z
??2@YAPAXI@Z
rand
memmove
atoi
strstr
strncmp
realloc
malloc
strrchr

kernel32

Sleep
CreateEventA
SetEvent
DeleteCriticalSection
LeaveCriticalSection
GetVersion
GetSystemInfo
GetProcAddress
GetVersionExA
SetErrorMode
LoadLibraryA
FreeLibrary
InterlockedDecrement
ResetEvent
GetLastError
WaitForSingleObject
CloseHandle
GetCurrentThreadId
GetThreadPriority
SetThreadPriority
ResumeThread
SuspendThread
GetTickCount
DisableThreadLibraryCalls
InitializeCriticalSection
InterlockedIncrement
GetSystemDirectoryA
EnterCriticalSection

user32

CharNextA
GetSystemMetrics
PeekMessageA
DispatchMessageA
GetMessageA
PostMessageA
PostThreadMessageA
KillTimer
SetTimer
CharLowerA

advapi32

RegOpenKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegSetValueA
RegOpenKeyA
RegQueryValueA

Exports

Exports

RNGetRootObjectContext
RNGetRootObjectFactory
RNSetupObjectBroker
RNShutdownObjectBroker
SetDLLAccessPath

Sections

.text
Size: 128KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6d5de578f7b910cd8cd28311bfac5278

Headers

File Characteristics

Imports

pncrt

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 126KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 968B

.reloc Size: 8KB - Virtual size: 6KB

.rmnet Size: 116KB - Virtual size: 116KB

.text
Size: 128KB - Virtual size: 126KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 968B

.reloc
Size: 8KB - Virtual size: 6KB

.rmnet
Size: 116KB - Virtual size: 116KB