0188f7fdfc426916e3fe61f9402c66c5bd095376a497b8802269c4c1ce1194cf

Sharing

Copy URL Twitter E-mail

General

Target

0188f7fdfc426916e3fe61f9402c66c5bd095376a497b8802269c4c1ce1194cf
Size

40KB
MD5

5a6f47d199cecb12a90cf28bebec3cf0
SHA1

aa0c8e9dc9fbb35db0a2f5e94f3871e230fe2a16
SHA256

0188f7fdfc426916e3fe61f9402c66c5bd095376a497b8802269c4c1ce1194cf
SHA512

ad4611960427c5fb03505448c57388596e53efc8e3d419e60d1a093ac55f51ca663592ba1cff8419d031d98390f8822e7a4eba71933d7160231a41ef98b4ca75
SSDEEP

384:6xfP9C54CG9xupI3jWaQirbz+4E0Xkk91iC+9iQV/:6te4CCxupeVxak9BuiQ

Score

N/A

Malware Config

Signatures

Files

0188f7fdfc426916e3fe61f9402c66c5bd095376a497b8802269c4c1ce1194cf
.dll windows x86

66679d1e3b49821b59c537921542d587

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlPopFrame
RtlAddressInSectionTable
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ZwQueryInformationFile
RtlPushFrame
qsort
RtlComputeCrc32
RtlUnwind
NtQueryVirtualMemory
wcscpy
ZwSetInformationFile
ZwSetEaFile
ZwCreateFile
ZwDeleteFile
wcstoul
ZwQueryDirectoryFile
ZwQueryEaFile
RtlTimeToSecondsSince1980
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
memcpy
RtlNtStatusToDosError
RtlInterlockedPopEntrySList
RtlInterlockedPushEntrySList
memset
ZwSetLowEventPair
ZwWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwCreateEventPair
_stricmp
ZwCreateEvent
ZwQueryInformationToken
ZwOpenProcessToken
ZwOpenEvent
ZwWriteFile
ZwReadFile
wcsrchr
LdrProcessRelocationBlock
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwQueryVolumeInformationFile
ZwOpenFile
RtlExpandEnvironmentStrings_U
RtlFreeUnicodeString
ZwClose
ZwQueryValueKey
ZwOpenKey
swprintf
RtlFormatCurrentUserKeyPath
RtlPrefixUnicodeString
RtlGetCurrentPeb
RtlExitUserThread
ZwProtectVirtualMemory
LdrGetProcedureAddress
RtlInitAnsiString
LdrLoadDll
RtlInitUnicodeString
RtlAddVectoredExceptionHandler
RtlNumberGenericTableElementsAvl
RtlGetFrame

kernel32

CreateThread
DeleteCriticalSection
LocalAlloc
InitializeCriticalSection
SleepEx
Sleep
FreeLibrary
VirtualFree
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
VirtualAlloc
GetVersion
LoadLibraryW
QueueUserWorkItem
GetModuleHandleW
GetSystemTimeAsFileTime
GetTickCount
GetLastError
BindIoCompletionCallback
DeleteTimerQueueTimer
CreateTimerQueueTimer
LocalFree

advapi32

MD5Final
MD5Update
CryptAcquireContextW
CryptImportKey
CryptGenRandom
CryptDestroyKey
CryptReleaseContext
CryptCreateHash
CryptSetHashParam
CryptVerifySignatureW
CryptDestroyHash
MD5Init

mswsock

AcceptEx

ws2_32

WSAStartup
WSACleanup
WSASocketW
WSAGetLastError
closesocket
bind
listen
WSAIoctl
WSARecv
WSASend
setsockopt
WSASendTo
WSARecvFrom

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

66679d1e3b49821b59c537921542d587

Headers

File Characteristics

Imports

ntdll

kernel32

advapi32

mswsock

ws2_32

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 4KB