b62f7a70c696a8ead64a9999170f7ac7a5ee84c56e5b21e66838f391ed2aefae

Sharing

Copy URL Twitter E-mail

General

Target

b62f7a70c696a8ead64a9999170f7ac7a5ee84c56e5b21e66838f391ed2aefae
Size

43KB
MD5

fb9bd9e6372ef31d7dc17d8b8889cb4a
SHA1

441de87588471e8104611ab9b53a62cda7dfa6cc
SHA256

b62f7a70c696a8ead64a9999170f7ac7a5ee84c56e5b21e66838f391ed2aefae
SHA512

a6a6b421891c81f9da7bcf3b49359d4c209c5d8f846e47b5c3924518439c980b6f38823b31b00d80a50c47692e5bd9805b0f8eae70706966d591dd3b24f358be
SSDEEP

768:7I/TULVQScmYak5KnIIMw9KYSa1umYvPupPg8V/n9eoPWDXkDpSEra:WCrcmXkqM+K61umYvWPgMPkkVm

Score

N/A

Malware Config

Signatures

Files

b62f7a70c696a8ead64a9999170f7ac7a5ee84c56e5b21e66838f391ed2aefae
.exe windows x86

01036ae87336bde25187b3970b6b96f7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

clusapi

ClusterRegEnumValue
GetClusterNetworkKey
GetClusterResourceTypeKey
OnlineClusterGroup
ClusterGroupControl
GetClusterResourceKey
ClusterRegDeleteValue
ClusterGroupGetEnumCount
OfflineClusterResource
FailClusterResource
ClusterResourceEnum
ClusterOpenEnum
ClusterResourceControl
ClusterRegCloseKey
ClusterNetworkCloseEnum
ClusterGroupOpenEnum

advapi32

OpenEventLogW
AddAccessAllowedAce
A_SHAFinal
RegConnectRegistryA
InitializeSid
CredRenameW
SaferiRecordEventLogEntry
I_ScIsSecurityProcess
LsaOpenPolicy
RegOpenKeyW
RegLoadKeyW
CryptDuplicateHash
WmiQueryAllDataMultipleA
LsaCreateTrustedDomainEx
RegQueryMultipleValuesW
UpdateTraceW
LsaQueryForestTrustInformation
GetSecurityInfoExW
GetSecurityDescriptorLength
MD4Final
ElfChangeNotify
ChangeServiceConfigW
SetNamedSecurityInfoExA
GetTrusteeNameW
CredGetSessionTypes

msvcrt

__p__commode
_ismbcdigit
_strtoi64
_getdiskfree
??0bad_cast@@QAE@PBD@Z
_wpgmptr
__set_app_type
_wcsnicmp
_setmode
iswpunct
__RTtypeid
??0exception@@QAE@XZ
__doserrno
_dstbias
?what@exception@@UBEPBDXZ
exit
_execve
_mbsnextc
wprintf
_get_osfhandle

ntdll

RtlUpdateTimer
RtlDeleteTimerQueueEx
ZwOpenObjectAuditAlarm
NtQueueApcThread
ZwRaiseHardError
RtlInterlockedPushListSList
_ltow
RtlAcquireResourceShared
NtWriteVirtualMemory
RtlUpcaseUnicodeStringToAnsiString
ZwFreeUserPhysicalPages
ZwDisplayString
NtCallbackReturn
ZwSetInformationFile
RtlFindClearBits
RtlLeaveCriticalSection
NtSetEvent
RtlUpcaseUnicodeToOemN
RtlCopySidAndAttributesArray

kernel32

MoveFileExW
CreateFileW
VirtualAlloc
GetNumberOfConsoleFonts
InitializeCriticalSection
ConvertThreadToFiber
SetConsoleInputExeNameA
GetWindowsDirectoryA
LoadLibraryA
SetLastError
LZInit
BackupRead
IsDebuggerPresent
OutputDebugStringA
GetPrivateProfileIntW
GetVolumePathNameA
GetEnvironmentStringsW
IsDBCSLeadByte
SetConsoleOS2OemFormat
GetPrivateProfileSectionNamesW
IsValidLocale
Process32FirstW
InitAtomTable
GetProcessAffinityMask

ir50_32

AboutDialogProc
ConfigureDialogProc
DllMain
DriverProc

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

01036ae87336bde25187b3970b6b96f7

Headers

DLL Characteristics

File Characteristics

Imports

clusapi

advapi32

msvcrt

ntdll

kernel32

ir50_32

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 5KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 29KB

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 29KB