a277f07950d59d48034a09a64d86ed42852f61431f223e541263a88ea71d4265

Sharing

Copy URL

Twitter E-mail

General

Target

a277f07950d59d48034a09a64d86ed42852f61431f223e541263a88ea71d4265
Size

842KB
MD5

ea5e86b4066615bb0ff288df3baecef8
SHA1

aa5473d272f8020167506a1120c0180c769e22d5
SHA256

a277f07950d59d48034a09a64d86ed42852f61431f223e541263a88ea71d4265
SHA512

6275c02935e92bbaaeddb94c85e37de9acf2e0968a1097e9a869bc72b1105533547fef1f0b4fe9a4289dad56c8bfe57565b636ea3fe28f6432fd13375bb15828
SSDEEP

24576:Lr6lPk9NmVv6ZVPFEiI03+u8katd0AH0UyEL78f:LygkyZw6uu8katN778

Score

N/A

Malware Config

Signatures

Files

a277f07950d59d48034a09a64d86ed42852f61431f223e541263a88ea71d4265
.exe windows x86

4e8b833c2a3c84c8986c2c52cb37aa93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

esent

JetGotoBookmark
JetSetTableSequential
JetSetColumn
JetPrepareToCommitTransaction
JetOpenFile
JetIdle
JetCreateTableColumnIndex2
JetInit@4
JetDeleteColumn
JetGetAttachInfo
JetAddColumn
JetOpenTempTable2
JetCreateTable
JetBeginSession
JetBeginTransaction2
JetGetTableColumnInfo
JetEnumerateColumns
JetRestoreInstance
JetGetCurrentIndex
JetResetTableSequential
JetMove@16
JetStopService
JetGetSystemParameter
JetBeginTransaction
JetGetTruncateLogInfoInstance
JetPrepareUpdate@12
JetGetCursorInfo
JetDelete@8
JetSetSessionContext
JetGetLS
JetOpenDatabase
JetStopBackup
JetOSSnapshotPrepare
JetGetBookmark
JetGetSecondaryIndexBookmark
JetTruncateLog
JetCreateInstance2
JetSetColumnDefaultValue
JetCreateInstance
JetMove
JetCommitTransaction
JetPrepareUpdate
JetSetCurrentIndex2
JetSetColumns

kernel32

BuildCommDCBAndTimeoutsW
SetConsoleOutputCP
FindFirstVolumeMountPointA
GetModuleHandleA
GetConsoleAliasExesLengthA
GetConsoleAliasW
IsBadWritePtr
EnumDateFormatsExW
OutputDebugStringA
GetLogicalDriveStringsW
ScrollConsoleScreenBufferW
GetCPInfoExW
SetConsoleMode
FreeLibraryAndExitThread
ClearCommBreak
WritePrivateProfileSectionW
DeleteFileW
GetCurrentThreadId
GetPrivateProfileIntA
HeapValidate
VirtualAlloc
GetProfileIntA
SetCurrentDirectoryA
LoadLibraryA
FileTimeToLocalFileTime

wsock32

WSASetBlockingHook
recvfrom
GetTypeByNameW
WSAAsyncGetProtoByNumber
recv
WSAIsBlocking
inet_ntoa
SetServiceA
WSACleanup
WSARecvEx
ioctlsocket
NPLoadNameSpaces
shutdown
SetServiceW
EnumProtocolsA
socket

netapi32

NetValidateName
NetGetJoinInformation
NetapipBufferAllocate
DsGetSiteNameA
NetBrowserStatisticsGet
NetLocalGroupGetMembers
RxNetAccessGetUserPerms
NetWkstaUserSetInfo
NetRemoveAlternateComputerName
NetReplExportDirEnum
NetSessionGetInfo
Netbios
I_NetServerPasswordGet
NetWkstaSetInfo
DsValidateSubnetNameA
DsAddressToSiteNamesW
NetpwNameCanonicalize
NetApiBufferAllocate
RxNetAccessEnum
NetConnectionEnum
NetUserGetLocalGroups
NetWkstaTransportEnum
NetConfigSet
NetScheduleJobAdd
NetpAllocFtinfoEntry

Sections

.text
Size: 479KB - Virtual size: 479KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 356KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e8b833c2a3c84c8986c2c52cb37aa93

Headers

DLL Characteristics

File Characteristics

Imports

esent

kernel32

wsock32

netapi32

Sections

.text Size: 479KB - Virtual size: 479KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 356KB - Virtual size: 1.8MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 348B

.text
Size: 479KB - Virtual size: 479KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 356KB - Virtual size: 1.8MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 348B