d16ea4b211a91397060e6c5cae8d5881f28536d7fdc754e5d16c965f556baaa1

Sharing

Copy URL Twitter E-mail

General

Target

d16ea4b211a91397060e6c5cae8d5881f28536d7fdc754e5d16c965f556baaa1
Size

20KB
MD5

bfb324a0bb38a1c1524bc57c4161c8e5
SHA1

9d68743fcf654cb2207aded64435217ce37498bf
SHA256

d16ea4b211a91397060e6c5cae8d5881f28536d7fdc754e5d16c965f556baaa1
SHA512

f0dac2d586597ed4ca1aa621c676c9432aef580adff0359feb79129ddf5d00ed949c382f88a7bb1a3bb245d3521ed9ab8b6d15ae55e7164903f7030c6d5c2126
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XpluCAu8UaWHuqaTlX0wG:zfYh2oCtpXPux2OqaewG

Score

N/A

Malware Config

Signatures

Files

d16ea4b211a91397060e6c5cae8d5881f28536d7fdc754e5d16c965f556baaa1
.dll windows x86

36df56ad47b0b3d1173c2bc36dbc879c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegSetValueExA

kernel32

CreateMutexA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
OutputDebugStringA
ReleaseMutex
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_errno
_iob
_winmajor
abort
calloc
fflush
free
fwrite
malloc
memcpy
sprintf
vfprintf

Exports

Exports

CalcHash
CalcHashW
CheckUnblock
DynamicImports
GetGlobalKey
GetKernel32
GetProcessParent
Inject@4
Injecting
IsPatched
IsStarted
Kernel32Base
KernelGetProcAddressEx
LoopInject@4
MapFileToMemory
PatchDLL
Peb
ResolveDynamicImports
__CloseHandle
__ConnectNamedPipe
__CopyFile
__CreateEvent
__CreateFile
__CreateFileMapping
__CreateMailslot
__CreateNamedPipe
__CreateProcess
__CreateRemoteThread
__CreateService
__CreateToolhelp32Snapshot
__DeleteFile
__ExitProcess
__FindResource
__GetCommandLine
__GetCurrentProcessId
__GetFileSize
__GetFullPathName
__GetKernelObjectSecurity
__GetLongPathName
__GetMailslotInfo
__GetModuleFileName
__GetModuleHandle
__GetProcAddress
__GetProcessId
__GetSystemDirectory
__GetTempFileName
__GetTempPath
__GetTickCount
__GetUserNameW
__GlobalAlloc
__GlobalFree
__LoadLibrary
__LoadResource
__LockResource
__MapViewOfFile
__MessageBox
__NtClose
__NtCreateFile
__NtCreateSection
__NtExtendSection
__NtMapViewOfSection
__NtOpenDirectoryObject
__NtOpenFile
__NtOpenSection
__NtUnmapViewOfSection
__ObReferenceObjectByHandle
__OpenEvent
__OpenProcess
__OpenSCManager
__OpenService
__OpenThread
__Process32First
__Process32Next
__ReadFile
__ReadProcessMemory
__RegOpenKey
__RegQueryValueEx
__ResetEvent
__ResumeThread
__RtlAdjustPrivilege
__RtlInitUnicodeString
__RtlNtStatusToDosError
__SHGetFolderPath
__SetEvent
__SetMailslotInfo
__SizeofResource
__Sleep
__StartService
__SuspendThread
__Thread32First
__Thread32Next
__UnmapViewOfFile
__VirtualAlloc
__VirtualAllocEx
__VirtualFree
__VirtualFreeEx
__WaitForSingleObject
__WinExec
__WriteFile
__WriteProcessMemory
__ZwCreateDirectoryObject
__ZwCreateFile
__ZwCreateSection
__ZwLoadDriver
__ZwMakeTemporaryObject
__ZwQueryInformationProcess
__ZwUnloadDriver
___memset
___strlwr
___strupr
___wcslen
___wcsncpy
__atoi
__lstrcpyn
__lstrlen
__mbstowcs
__memcmp
__memcpy
__memset
__puts
__rand
__srand
__sscanf
__strlwr
__strrchr
__strstr
__time
__wcslen
__wcsncpy
__wsprintf
_strchr
advapi32
emul
hGlobalKey
kernel32
m2
msvcrt
ntdll
shell32
szAutoloadName
szAutoloadPath
szDriverPath
szIsAutoload
user32
xwcslwr

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 712B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36df56ad47b0b3d1173c2bc36dbc879c

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.data Size: 3KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.eh_fram Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 712B

.edata Size: 3KB - Virtual size: 3KB

.idata Size: 1024B - Virtual size: 1016B

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 1024B - Virtual size: 1020B

.text
Size: 7KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.eh_fram
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 712B

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 1016B

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 1024B - Virtual size: 1020B