e7468c3417a018ebbad4cc3821f4a9f636a7b53150dcde87c5eaefbf2983fe5b

Sharing

Copy URL Twitter E-mail

General

Target

e7468c3417a018ebbad4cc3821f4a9f636a7b53150dcde87c5eaefbf2983fe5b
Size

835KB
MD5

fdc4be026f4f1bf0d1ec54d16b68dfcf
SHA1

bfb063eb86b8435c51835b43a9a2c58e86056a98
SHA256

e7468c3417a018ebbad4cc3821f4a9f636a7b53150dcde87c5eaefbf2983fe5b
SHA512

8a765c1b3ec65faec3dbcd9ab6ffe18158c2b505deeeda5fd0c2bfa79fd471022ede65db75f80cac08a6b93156fef3a74b519fcbb712588414b6939de1c6e66a
SSDEEP

24576:FKcnbYsuKKTEcsobSpLE9FJyHN9ydS228:/bYfAISpEnJe9+SB8

Score

N/A

Malware Config

Signatures

Files

e7468c3417a018ebbad4cc3821f4a9f636a7b53150dcde87c5eaefbf2983fe5b
.exe windows x86

f2617d68a1fdf125d49b1ae168b7759a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsValidCodePage
GetSystemTimeAsFileTime
GetConsoleCursorMode
GetFileAttributesA
SetClientTimeZoneInformation
GetTimeZoneInformation
GetFullPathNameA
GetNumberOfConsoleMouseButtons
FindNextVolumeA
InterlockedFlushSList
GlobalDeleteAtom
LoadLibraryA
LocalAlloc
GetStartupInfoA
DebugActiveProcess
SetConsoleInputExeNameW
GetConsoleProcessList
GetVolumeNameForVolumeMountPointA

ntdll

ZwOpenSection
RtlSetAllBits
NtOpenThread
NtOpenSymbolicLinkObject
ZwDebugActiveProcess
RtlExtendedMagicDivide
RtlGetLastNtStatus
RtlNtStatusToDosError
RtlAddAuditAccessAce
RtlpNtOpenKey
NtCreateMailslotFile
RtlInterlockedFlushSList
RtlSplay
RtlSetControlSecurityDescriptor
ZwQueryKey
NtCreateProfile
floor
ZwFsControlFile
ZwImpersonateClientOfPort
RtlGetCurrentDirectory_U
RtlUnicodeStringToCountedOemString
_ui64tow
RtlUniform
NtSetInformationJobObject
NtCreateEvent

user32

PrivateExtractIconExW
MessageBoxTimeoutA
ChildWindowFromPoint
IMPSetIMEA
GetMenu
PeekMessageA
DlgDirListComboBoxA
IsCharUpperW
CheckRadioButton
SetMenuContextHelpId

advapi32

CredReadW
CryptDuplicateKey
WmiNotificationRegistrationA
DecryptFileW
SetThreadToken
SetTraceCallback
FileEncryptionStatusA
DuplicateEncryptionInfoFile
RegisterTraceGuidsA
CryptDestroyKey

Sections

.text
Size: 401KB - Virtual size: 401KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 165KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2617d68a1fdf125d49b1ae168b7759a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

user32

advapi32

Sections

.text Size: 401KB - Virtual size: 401KB

.rdata Size: 104KB - Virtual size: 104KB

.data Size: 165KB - Virtual size: 1.6MB

.rsrc Size: 161KB - Virtual size: 160KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 401KB - Virtual size: 401KB

.rdata
Size: 104KB - Virtual size: 104KB

.data
Size: 165KB - Virtual size: 1.6MB

.rsrc
Size: 161KB - Virtual size: 160KB

.reloc
Size: 1KB - Virtual size: 1KB