a496df3073227ac1068ea63b6e07e71927b160c322bfb6e0b8a065c9736ea0b5

Sharing

Copy URL Twitter E-mail

General

Target

a496df3073227ac1068ea63b6e07e71927b160c322bfb6e0b8a065c9736ea0b5
Size

552KB
MD5

acc9c4b9bed52ee5168941c4eb67f216
SHA1

c9f91408e959ef838dd07e9230b5f5297b105326
SHA256

a496df3073227ac1068ea63b6e07e71927b160c322bfb6e0b8a065c9736ea0b5
SHA512

79f15ef816b85d261e14e2fb7a21e5dbc0705bcafb354d6c8c86cf89f051d4559e3cca8dfe5bc75fb40a4c5d5397b1a336743d28642b79051c100db3d45e487d
SSDEEP

12288:QeFLooOsWpI+1na0TvETBcYH10Jq0xhbMLlGBzkZWwAsQwS:/RSI+vvEmYHn0xagFwAsNS

Score

N/A

Malware Config

Signatures

Files

a496df3073227ac1068ea63b6e07e71927b160c322bfb6e0b8a065c9736ea0b5
.exe windows x86

0611997f2d8f6c65cd863e977df9b179

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
GlobalLock
VirtualAlloc
GlobalAlloc
CompareStringW
GetDriveTypeW
UnmapViewOfFile
GetSystemDirectoryA
HeapSize
GetFileAttributesW
GetSystemTimeAsFileTime
HeapDestroy
HeapReAlloc
GetFileSize
GetProcessHeap
lstrcpyW
DeleteFileW
lstrcmpW
GetStartupInfoA
GetLocaleInfoW
FindNextFileW
LCMapStringA
HeapAlloc
SetConsoleCtrlHandler
FreeEnvironmentStringsW

ulib

??1PATH_ARGUMENT@@UAE@XZ
?GetStandardOutput@PROGRAM@@UAEPAVSTREAM@@XZ
?Get_Standard_Output_Stream@@YGPAVSTREAM@@XZ
?Strcat@WSTRING@@QAEEPBV1@@Z
?QueryDirectory@SYSTEM@@SGPAVFSN_DIRECTORY@@PBVPATH@@E@Z
?IsValueSet@ARGUMENT@@QAEEXZ
?QueryString@WSTRING@@QBEPAV1@KK@Z
??0PROGRAM@@IAE@XZ
?Put@ARRAY@@UAEEPAVOBJECT@@@Z
?Fatal@PROGRAM@@UBAXKKPADZZ
?Display@MESSAGE@@QAAEPBDZZ
?Initialize@WSTRING@@QAEEPBGK@Z
??0LONG_ARGUMENT@@QAE@XZ
??0DSTRING@@QAE@XZ
??0STREAM_MESSAGE@@QAE@XZ
??1DSTRING@@UAE@XZ
?Initialize@PATH@@QAEEPBV1@E@Z
?Compare@OBJECT@@UBEJPBV1@@Z

msvcrt

_strnicmp
??3@YAXPAX@Z
_iob
__winitenv
printf
strncmp
??2@YAPAXI@Z
atoi
wcslen
fputs
__mb_cur_max
exit
_initterm
_adjust_fdiv
strchr
__p__commode
wcscpy
__set_app_type
fopen
__wgetmainargs
_acmdln

ntdll

RtlInitAnsiString
RtlQueryRegistryValues
RtlTimeToTimeFields
RtlCopySid
RtlInitializeGenericTable
wcslen
_aulldiv
memmove
NtTerminateProcess
NtWaitForSingleObject
NtTerminateThread
RtlComputeCrc32
RtlValidSecurityDescriptor
RtlFormatMessage
RtlUnwind
NtOpenKey
NtSetInformationFile
NtQueryVirtualMemory
RtlOemToUnicodeN
NtQueryInformationThread

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0611997f2d8f6c65cd863e977df9b179

Headers

File Characteristics

Imports

kernel32

ulib

msvcrt

ntdll

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 28KB - Virtual size: 43KB

.rsrc Size: 1024B - Virtual size: 960B

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 28KB - Virtual size: 43KB

.rsrc
Size: 1024B - Virtual size: 960B