bd337c506abc31b7e219cdfc23627e4ca0f78d59425de901cf063ca72126744b

General

Target

bd337c506abc31b7e219cdfc23627e4ca0f78d59425de901cf063ca72126744b
Size

358KB
MD5

8997ce3dc84c26ee28c0674df3aa1d2d
SHA1

d983c1ea7f8ceafe5a2c49b6581f66e2975f16ce
SHA256

bd337c506abc31b7e219cdfc23627e4ca0f78d59425de901cf063ca72126744b
SHA512

0f151018e26e49773a33cdbc328899ecd7694785c2de5d97ca9736558ad4f32ac6ad503d7ed1d84bd9bfca702c0ad78df5269d32eb0f1f38bd767c0fd74f799b
SSDEEP

6144:ZQJRmV3sYHwq7+yzETXfLVeLIR8mFJ5jPg0tGjyHkB9oDGNFauof/su3ilAvzjDt:btssxQzTR95xHKovuo3Z3ilAvzKg2U1

Score

N/A

Malware Config

Signatures

Files

bd337c506abc31b7e219cdfc23627e4ca0f78d59425de901cf063ca72126744b
.exe windows x86

83d1c9561490f0d8fb90bf7a6f121721

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtDelayExecution
NtOpenSymbolicLinkObject
wcscmp
RtlInitializeSid
RtlValidRelativeSecurityDescriptor
NtTerminateProcess
NtQueryValueKey
NtOpenProcessToken

ulib

??1DSTRING@@UAE@XZ
??1STRING_ARGUMENT@@UAE@XZ
??1PATH_ARGUMENT@@UAE@XZ
?Initialize@PATH_ARGUMENT@@QAEEPADE@Z
?Initialize@PATH@@QAEEPBV1@E@Z
?DisplayMessage@PROGRAM@@UBAEKW4MESSAGE_TYPE@@PADZZ
??0LONG_ARGUMENT@@QAE@XZ
?Initialize@CLASS_DESCRIPTOR@@QAEEXZ
?QueryDirectory@SYSTEM@@SGPAVFSN_DIRECTORY@@PBVPATH@@E@Z

kernel32

GetStartupInfoA
GetThreadLocale
GetLastError
GetCurrentProcess
GetProcessHeap
InterlockedExchange
GetSystemTimeAsFileTime
InterlockedDecrement
InterlockedIncrement
GetTickCount
GetVolumeNameForVolumeMountPointW
GetSystemDirectoryA
FindFirstFileW

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83d1c9561490f0d8fb90bf7a6f121721

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

ulib

kernel32

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 2KB - Virtual size: 24KB

.rsrc Size: 1024B - Virtual size: 936B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 2KB - Virtual size: 24KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 1KB - Virtual size: 1KB