afe5a6d62b645b3517cf1740bd4b688fda5332b936003e6b72e4cfcc4925dfc2

Sharing

Copy URL Twitter E-mail

General

Target

afe5a6d62b645b3517cf1740bd4b688fda5332b936003e6b72e4cfcc4925dfc2
Size

144KB
MD5

9c8cff7da38ba65e04a3210556c20447
SHA1

a33003885e4f2ff531d442b7deea12408693e8ff
SHA256

afe5a6d62b645b3517cf1740bd4b688fda5332b936003e6b72e4cfcc4925dfc2
SHA512

89b3e314671b0cf2abb2a774f55b502cf099a9d7f0fbff01d780abd6bcd020cb0a3274b796508386cfc414cf2513c0a6ad0367584598fe2310b0c8263c82cc42
SSDEEP

3072:yOdOQZqdOJ8NDHzD21epSHjpWB3r8y3e4qBXUjZlsV:yOdOQ8O8NLO1lCDe46Uj

Score

N/A

Malware Config

Signatures

Files

afe5a6d62b645b3517cf1740bd4b688fda5332b936003e6b72e4cfcc4925dfc2
.dll windows x86

d5e31d9ebe438899e90ed3e2676705ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentVariableA
GetSystemDirectoryA
GlobalFree
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceA
lstrlenA
CreateProcessA
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
WinExec
GetLastError
WaitForSingleObject
CreateFileA
GetFileSize
ReadFile
CloseHandle
TerminateProcess
DeleteFileA
GetSystemInfo
HeapFree
HeapAlloc
ExitProcess
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
SetFilePointer
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers
VirtualProtect

user32

ExitWindowsEx

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken

urlmon

URLDownloadToFileA

Exports

Exports

KillProcess
KillProcess_deinit
KillProcess_init
ProcessView
ProcessView_deinit
ProcessView_init
about
about_deinit
about_init
backshell
backshell_deinit
backshell_init
cmdshell
cmdshell_deinit
cmdshell_init
downloader
downloader_deinit
downloader_init
open3389
open3389_deinit
open3389_init
regread
regread_deinit
regread_init
regwrite
regwrite_deinit
regwrite_init
shut
shut_deinit
shut_init

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5e31d9ebe438899e90ed3e2676705ae

Headers

File Characteristics

Imports

kernel32

user32

advapi32

urlmon

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 80KB - Virtual size: 78KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 80KB - Virtual size: 78KB

.reloc
Size: 8KB - Virtual size: 4KB