2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4

Sharing

Copy URL Twitter E-mail

General

Target

2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4
Size

48KB
MD5

bb7cc4ecb7b5c4e5e39d221384db9f30
SHA1

06eddfe5140d297b0164c54628944ca18f389799
SHA256

2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4
SHA512

2bc0436870d2c8c84c5edab47cd76bdffe02c2843da71c61d449c3a890b669ecb7e289bab48fece6636500a0d92458a31ef86a7029d660df51f02901ba188e60
SSDEEP

768:Q04zEXA5cgLGr72RzvBlyZhSVgt8JcyX98IiF8:/44QXLVRzSZhSICtSF8

Score

N/A

Malware Config

Signatures

Files

2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4
.dll windows x86

333d60e22737e29bf106df01fd22c5b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

ZwUnmapViewOfSection
RtlTimeToSecondsSince1980
qsort
ZwQueryEaFile
ZwQueryDirectoryFile
wcstoul
ZwSetEaFile
ZwSetInformationFile
wcscpy
RtlPushFrame
ZwMapViewOfSection
RtlAddressInSectionTable
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
RtlInitializeGenericTableAvl
ZwQueryInformationFile
RtlInsertElementGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlComputeCrc32
RtlUnwind
NtQueryVirtualMemory
RtlNtStatusToDosError
RtlInterlockedPopEntrySList
RtlInterlockedPushEntrySList
ZwSetLowEventPair
ZwWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwCreateEventPair
strcmp
_stricmp
ZwDeleteFile
ZwQuerySystemInformation
RtlAdjustPrivilege
ZwAdjustPrivilegesToken
ZwOpenThreadTokenEx
ZwImpersonateThread
ZwOpenThread
ZwCreateSection
ZwCreateFile
strcpy
memset
ZwSetValueKey
ZwCreateEvent
ZwQueryInformationToken
ZwOpenProcessToken
ZwOpenEvent
ZwWriteFile
ZwReadFile
wcsrchr
LdrProcessRelocationBlock
RtlImageDirectoryEntryToData
RtlImageNtHeader
memcpy
ZwQueryVolumeInformationFile
ZwOpenFile
RtlExpandEnvironmentStrings_U
RtlFreeUnicodeString
ZwClose
ZwQueryValueKey
ZwOpenKey
swprintf
RtlFormatCurrentUserKeyPath
wcslen
RtlPrefixUnicodeString
RtlGetCurrentPeb
RtlExitUserThread
ZwProtectVirtualMemory
LdrGetProcedureAddress
RtlInitAnsiString
LdrLoadDll
RtlInitUnicodeString
RtlAddVectoredExceptionHandler
RtlPopFrame
RtlGetFrame

kernel32

CreateThread
DeleteCriticalSection
LocalAlloc
InitializeCriticalSection
SleepEx
Sleep
FreeLibrary
VirtualFree
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
VirtualAlloc
GetVersion
LoadLibraryW
QueueUserWorkItem
GetModuleHandleW
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
DeleteTimerQueueTimer
CreateTimerQueueTimer
LocalFree

advapi32

MD5Final
MD5Update
CryptAcquireContextW
CryptImportKey
CryptGenRandom
CryptDestroyKey
CryptReleaseContext
CryptCreateHash
CryptSetHashParam
CryptVerifySignatureW
CryptDestroyHash
MD5Init

mswsock

AcceptEx

ws2_32

WSAStartup
WSACleanup
WSASocketW
WSAGetLastError
closesocket
bind
listen
WSAIoctl
WSARecv
WSASend
setsockopt
WSASendTo
WSARecvFrom

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

333d60e22737e29bf106df01fd22c5b3

Headers

File Characteristics

Imports

ntdll

kernel32

advapi32

mswsock

ws2_32

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 4KB