b21b4646bd93ba5d57bf4a022c3cbbc6c30bd270ed75a1074915ecc6ec0abeba

Sharing

Copy URL Twitter E-mail

General

Target

b21b4646bd93ba5d57bf4a022c3cbbc6c30bd270ed75a1074915ecc6ec0abeba
Size

163KB
MD5

2fb3ea918050a5ab46d2b52bbbf669ad
SHA1

982713554f3c8e2de73cddaaedffb854bae39cd5
SHA256

b21b4646bd93ba5d57bf4a022c3cbbc6c30bd270ed75a1074915ecc6ec0abeba
SHA512

6a9bd75bb6d127b1e6cc52c015d9deac6aa030c772a09f26f57d681ec86dc462ca4b9b596cc6fdfe9f239176dc1084f04c6e0dc86c4d8d8bd35e5a7c8a4aca33
SSDEEP

3072:zWQ5L7vJbCeNr2zrV8+Y6YE1sm5uoeKl+:62L7vdCeF2zuDPo

Score

N/A

Malware Config

Signatures

Files

b21b4646bd93ba5d57bf4a022c3cbbc6c30bd270ed75a1074915ecc6ec0abeba
.exe windows x86

6fbfb960521d7d51611d90730fa08f7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageA
RaiseException
RtlUnwind
GetStartupInfoW
HeapAlloc
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetTimeZoneInformation
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
CloseHandle
FreeEnvironmentStringsW
GetModuleHandleA
InterlockedCompareExchange
GetProcessHeap
lstrlenA
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime

advapi32

RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW

shell32

ord680

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize

oleaut32

SysStringLen
VariantInit
VariantClear
SysAllocString
SysFreeString

shlwapi

PathRemoveArgsW
PathStripPathW
PathMakePrettyW
PathRemoveExtensionW
SHGetValueW

wininet

SetUrlCacheEntryInfoW
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindCloseUrlCache

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fbfb960521d7d51611d90730fa08f7a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

Sections

.text Size: 121KB - Virtual size: 121KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 121KB - Virtual size: 121KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 9KB - Virtual size: 9KB