af234231b5665a082a61334db92f7a02814a6a428b708f9c2befffb7c86aebdf

Sharing

Copy URL Twitter E-mail

General

Target

af234231b5665a082a61334db92f7a02814a6a428b708f9c2befffb7c86aebdf
Size

64KB
MD5

885de8ef4064d2a0c753abd6f6818248
SHA1

db2e19c1d2c326fa8852d3963a663e0e3c3a56cd
SHA256

af234231b5665a082a61334db92f7a02814a6a428b708f9c2befffb7c86aebdf
SHA512

20ebbba734cb3167124420dcc6a567bc557bbb03db4db3e8623095896e501432d9a1293eec0dfdc4555d920c49ce82e315e00a09599c320f5697912e7524f4b0
SSDEEP

1536:Vfj9oZjr91SAuShInwerpMaOBoDA1DFN+8ucpIOh:Z9oZjr91SAVh8PrevomFPucxh

Score

N/A

Malware Config

Signatures

Files

af234231b5665a082a61334db92f7a02814a6a428b708f9c2befffb7c86aebdf
.exe windows x86

bf03c4f1e77adc0719a84cf4665342a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
LoadLibraryA
VirtualQuery
GetSystemDirectoryA
GetProcAddress
WideCharToMultiByte
CreateFileW
GetCurrentProcessId
GetCPInfo
GetVersion
FindResourceA
IsBadReadPtr
lstrcmpW
LockResource
GetModuleHandleW
GetTickCount
SetLastError
IsBadWritePtr
TlsFree
VirtualFree
TerminateProcess
ExitProcess
FreeEnvironmentStringsW
GetStringTypeW
VirtualAlloc
GetCommandLineW
GetStdHandle
GetCurrentThreadId
RtlUnwind
lstrlenA
GetConsoleMode
GetLastError
LocalAlloc
FindResourceW

ole32

OleRun
CoTaskMemRealloc
CreateILockBytesOnHGlobal
CoGetObjectContext
CoTaskMemFree
CoGetMalloc
CoSetProxyBlanket
StgCreateDocfile
OleRegGetMiscStatus
CoCreateInstance
CoCreateFreeThreadedMarshaler
CreateDataAdviseHolder
WriteClassStm
CoInitializeEx
CoUnmarshalInterface
OleUninitialize
OleRegEnumVerbs
StringFromGUID2
CoGetInterfaceAndReleaseStream
ReadOleStg
CoFreeUnusedLibraries

msvcrt

_vsnwprintf
fprintf
_initterm
wcsncmp
fseek
atol
malloc
memmove
isdigit
_stricmp
??1type_info@@UAE@XZ
_ftol
_ltow
_snprintf
wcscspn
_wcsdup
_CIsqrt
??0exception@@QAE@ABV0@@Z
__set_app_type
_exit
isleadbyte
strncpy
_vsnprintf
fwrite

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerFindFileW
VerQueryValueA

ntdll

RtlCreateUserThread
RtlReleaseResource
RtlGUIDFromString
RtlAcquireResourceExclusive
RtlAppendUnicodeToString
DbgPrint
RtlQueryInformationAcl
RtlCreateEnvironment
NtDuplicateToken
NtDuplicateObject
RtlGetNtProductType
RtlInitializeCriticalSection
RtlGetOwnerSecurityDescriptor
NtQueryAttributesFile
NtQueryObject
NtWriteFile
RtlDeleteCriticalSection
RtlInitializeCriticalSectionAndSpinCount
NtQueryInformationProcess
RtlFormatCurrentUserKeyPath
NtUnmapViewOfSection
RtlQueueWorkItem
RtlSubAuthoritySid
NtCreateFile

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 30KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 483B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf03c4f1e77adc0719a84cf4665342a3

Headers

File Characteristics

Imports

kernel32

ole32

msvcrt

version

ntdll

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 30KB - Virtual size: 91KB

.reloc Size: 512B - Virtual size: 483B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 30KB - Virtual size: 91KB

.reloc
Size: 512B - Virtual size: 483B