d87c4b92e7b23627731f9b7321cf8915bc83a6b2fe1b85afdf41feb17b749ba0

Sharing

Copy URL Twitter E-mail

General

Target

d87c4b92e7b23627731f9b7321cf8915bc83a6b2fe1b85afdf41feb17b749ba0
Size

45KB
MD5

051c869c05d64c875a00ca5fe6228194
SHA1

c26a44c96b1a4ce2903a78393529c6683b4b5d60
SHA256

d87c4b92e7b23627731f9b7321cf8915bc83a6b2fe1b85afdf41feb17b749ba0
SHA512

59633e2bf4c7e5ebe95ff726c12dd4515b20086dc6e864421936bb8158c8ccc1de768c0ec26c3f38441d55e0bf80c2765fd2a963b05df6e2ecc69c4e8acca837
SSDEEP

768:rKgGXefEhguK0iMG45iVDCuorZv1LWAPizQy0WljCljBe6/DQlr4xdap:+gJfsg30XB5iDCuW1LWAPi1rj8jUMQ9z

Score

N/A

Malware Config

Signatures

Files

d87c4b92e7b23627731f9b7321cf8915bc83a6b2fe1b85afdf41feb17b749ba0
.exe windows x86

1d3b508a0a3c1db621a13364146d2a4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
ZwQueryInformationFile
ZwCreateFile
ZwWriteFile
strlen
swprintf
wcsrchr
_wcsicmp
ZwFsControlFile
ZwCreateSection
ZwMapViewOfSection
ZwImpersonateThread
ZwFlushVirtualMemory
ZwUnmapViewOfSection
ZwCreateSymbolicLinkObject
ZwLoadDriver
ZwSetSecurityObject
ZwReadFile
RtlRandom
strrchr
LdrFindResource_U
LdrAccessResource
ZwSetEvent
RtlEqualUnicodeString
ZwCreateEvent
ZwOpenThread
ZwOpenProcess
ZwQuerySystemInformation
LdrFindEntryForAddress
RtlNtStatusToDosError
memset
wcslen
ZwSetValueKey
ZwCreateKey
wcstoul
RtlInitUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
ZwQueryKey
RtlComputeCrc32
sprintf
RtlIpv4AddressToStringA
ZwClose
ZwOpenKey
ZwQueryValueKey
ZwSuspendThread
ZwQueryInformationThread
_stricmp
ZwResumeThread
ZwSetContextThread
ZwWriteVirtualMemory
ZwSetInformationFile
ZwDelayExecution
ZwWaitForSingleObject
ZwGetContextThread
RtlExitUserThread
RtlCreateUserThread
ZwDuplicateObject
RtlDosPathNameToNtPathName_U
ZwOpenFile
ZwQueryInformationProcess
RtlAdjustPrivilege
RtlImageNtHeader
memcpy
_allshr

kernel32

LoadLibraryW
ExitProcess
GetTickCount
FreeLibrary
GetProcAddress
GetVersion
GetModuleHandleW
HeapFree
GetProcessHeap
HeapAlloc
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
GetSystemDefaultLangID

advapi32

MD5Final
MD5Update
MD5Init

ws2_32

WSAStartup
WSASend
WSARecv
WSAIoctl
bind
closesocket
WSAGetLastError
WSASocketW
WSACleanup

rpcrt4

UuidCreateSequential

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d3b508a0a3c1db621a13364146d2a4f

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

advapi32

ws2_32

rpcrt4

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 464B

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 464B

.rsrc
Size: 2KB - Virtual size: 2KB