73ecbb8ee4100efcf16245105d7e5111d25f5bd5627c5740a8234c86ef3bfbfe

Sharing

Copy URL Twitter E-mail

General

Target

73ecbb8ee4100efcf16245105d7e5111d25f5bd5627c5740a8234c86ef3bfbfe
Size

564KB
MD5

2c0c5e620b434829b433e71a6e7667f0
SHA1

eb0abd77b2af25b0c066513f1344b50cd11fd84b
SHA256

73ecbb8ee4100efcf16245105d7e5111d25f5bd5627c5740a8234c86ef3bfbfe
SHA512

1a33cc1be1e3e5e683e3f47531f5229e44dd882ef77dfb36de48b78dbb0451642c6a7617ea724f570e29a511f946be3a4d68ad00f502da2a01a71c5741bc97d9
SSDEEP

12288:RBExdF409YMoKZzzWZOzBe+fKkdw8dtKYMU1v30ca3tZ5:RBExdF40SKZzS+fKytKYMUx3DCtZ5

Score

N/A

Malware Config

Signatures

Files

73ecbb8ee4100efcf16245105d7e5111d25f5bd5627c5740a8234c86ef3bfbfe
.exe windows x86

229592193c052d5c7a1e3881ffccc659

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
strnlen
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_strnicmp
_snprintf_s
_mbsrchr
strstr
realloc
sprintf_s
strchr
memcpy
_access
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_set_invalid_parameter_handler
strrchr
strncat_s
_stricmp
strcpy_s
strncpy_s
strcat_s
memset
malloc
free
_mbsicmp
_mbsstr
_mbsnbicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
wcstombs
_mbschr
_crt_debugger_hook

kernel32

GetProcAddress
LoadLibraryA
InterlockedIncrement
InterlockedDecrement
SetLastError
CloseHandle
CreateProcessA
FreeEnvironmentStringsA
GetEnvironmentStrings
WideCharToMultiByte
GetModuleHandleA
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameA
GetLastError
GetPrivateProfileIntA
GetPrivateProfileStringA
LocalFree
GetFileAttributesA
SetFileAttributesA
FreeLibrary
CreateDirectoryA
CopyFileA
GetTempFileNameA
MoveFileA
DeleteFileA
MultiByteToWideChar
GetACP
FindClose
FindNextFileA
FindFirstFileA
GetVersionExA
GetShortPathNameA
GetCurrentDirectoryA
WritePrivateProfileStringA
GetWindowsDirectoryA
WinExec
OutputDebugStringA
MoveFileExA
GetSystemDirectoryA

user32

DdeCreateDataHandle
DdeCreateStringHandleA
DdeInitializeA
DdeDisconnect
DdeClientTransaction
PostThreadMessageA
LoadStringA
DdeUninitialize
DdeFreeStringHandle
DdeAccessData
DdeUnaccessData
DdeFreeDataHandle
DdeConnect

advapi32

RegDeleteKeyA
CryptHashData
RegSetValueA
RegCreateKeyA
RegQueryValueExA
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegEnumValueA
RegSetValueExA

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
StringFromCLSID
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance

ctxmui

CTXMUI_FormatMessageA
CTXMUI_ParseCommandLineA
CTXMUI_MessageBoxA
CTXMUI_LoadResourceLibraryW

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

229592193c052d5c7a1e3881ffccc659

Headers

DLL Characteristics

File Characteristics

Imports

msvcr80

kernel32

user32

advapi32

ole32

ctxmui

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 2KB

.vmp0 Size: 500KB - Virtual size: 1.6MB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 2KB

.vmp0
Size: 500KB - Virtual size: 1.6MB