abc0945f96caa547d2c6e8e729cbaa815cda07887cb7ec7a43d5bc7003568dc6

Sharing

Copy URL Twitter E-mail

General

Target

abc0945f96caa547d2c6e8e729cbaa815cda07887cb7ec7a43d5bc7003568dc6
Size

106KB
MD5

027c5cfc71b7e02b678cb73cf01b85fe
SHA1

03d0a2246f19653b3005dc2db7e10b18cdb3e0d9
SHA256

abc0945f96caa547d2c6e8e729cbaa815cda07887cb7ec7a43d5bc7003568dc6
SHA512

4339ee41363f05763e186b2682181ccad1ba77e542174be7e45ef1a4ed398be33b77694cb01ef50902fa10db9f239c43007346697d5445815d5b78df65b80f41
SSDEEP

1536:HwAtcXEFBxUlreb1sURf97lnUgCP3mW3aUG24TUsYh0FMdGQ7mAPalaoOC:Q9EFvCrYRVRnb038D40F2CoC

Score

N/A

Malware Config

Signatures

Files

abc0945f96caa547d2c6e8e729cbaa815cda07887cb7ec7a43d5bc7003568dc6
.exe windows x86

078a0f381f26c36fc8bb842a95742a13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
IsBadStringPtrW
SetFileShortNameA
ReplaceFileW
RegisterConsoleOS2
GetTapeStatus
IsValidCodePage
GetThreadLocale
IsDebuggerPresent
TryEnterCriticalSection
GetModuleHandleA
AddAtomA
SetHandleInformation
GetConsoleInputExeNameW
GetUserDefaultLCID
EnumDateFormatsExA
LocalFlags
SetComPlusPackageInstallStatus
GetSystemDirectoryW
GetSystemDefaultLCID
GlobalMemoryStatus
EnterCriticalSection
GetACP
LoadLibraryA
SetTapePosition
WriteConsoleOutputA
FillConsoleOutputCharacterW
RegisterConsoleVDM
IsValidLocale
GlobalGetAtomNameA
UnregisterWait
VirtualAlloc
OpenEventA
LeaveCriticalSection
BaseCheckAppcompatCache
CreateRemoteThread
CreateDirectoryExA
CreateActCtxA
FindCloseChangeNotification
WriteFileGather
GetBinaryTypeA

netapi32

I_NetServerPasswordSet
NetReplExportDirLock
I_BrowserSetNetlogonState
NetDfsSetInfo
I_NetServerAuthenticate3
I_NetLogonControl
RxNetAccessAdd
NetDfsAddStdRootForced
DsAddressToSiteNamesExW
NlBindingSetAuthInfo
DsAddressToSiteNamesA
NetWkstaTransportDel
NetpwNameCanonicalize
RxNetAccessGetInfo
NetpwPathCanonicalize
NetRemoteComputerSupports
NetpIsRemote
NetWkstaTransportAdd
DsRoleGetDcOperationProgress
NetServerEnum
NetpMergeFtinfo
I_NetServerGetTrustInfo
NetApiBufferFree
NetServerDiskEnum
NetUserModalsSet
NetReplImportDirEnum
NetGetJoinInformation
NetDfsGetInfo
NetDfsRemove
I_NetDfsIsThisADomainName
I_NetServerPasswordGet
DsGetDcSiteCoverageA
NetAuditClear
DsGetDcNameWithAccountA
RxNetAccessDel
DsGetDcCloseW
NetUseAdd

lz32

LZInit
LZClose
CopyLZFile
LZCloseFile
LZStart
LZCreateFileW
LZSeek
LZOpenFileW
LZCopy
GetExpandedNameA
LZDone
LZOpenFileA
LZRead

msvcp60

?_Init@?$numpunct@D@std@@IAEXABV_Locinfo@2@@Z
?copy@?$char_traits@G@std@@SAPAGPAGPBGI@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAF@Z
?close@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??_7length_error@std@@6B@
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Nanv@?$_Ctr@M@std@@SAMM@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?exp@std@@YA?AV?$complex@O@1@ABV21@@Z
??Kstd@@YA?AV?$complex@M@0@ABMABV10@@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
??8std@@YA_NABV?$complex@N@0@0@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??4?$basic_fstream@GU?$char_traits@G@std@@@std@@QAEAAV01@ABV01@@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Makpat@?$_Mpunct@G@std@@AAEXAAUpattern@money_base@2@DDD@Z
_Stold
??4?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?grouping@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z
?eof@?$char_traits@D@std@@SAHXZ
??Kstd@@YA?AV?$complex@M@0@ABV10@0@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1ostrstream@std@@UAE@XZ
?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ
??Hstd@@YA?AV?$complex@O@0@ABOABV10@@Z

esent

JetRenameTable
JetGotoBookmark
JetResetSessionContext
JetSetCurrentIndex2
JetOpenTempTable2
JetAttachDatabaseWithStreaming
JetBackupInstance
JetUpgradeDatabase
JetEndSession
JetCreateIndex2
JetDBUtilities
JetGetInstanceInfo
JetSetLS
JetDupCursor
JetOSSnapshotThaw
JetIndexRecordCount
JetUnregisterCallback
JetRestore
JetGetLogInfoInstance
JetBeginTransaction
JetBeginExternalBackup
JetCloseFile
JetBeginExternalBackupInstance
JetGetSystemParameter
JetUpdate
JetCloseTable
JetGetLS
JetRetrieveColumn@32
JetIntersectIndexes
JetDeleteTable
JetRetrieveKey
JetCompact

msvcrt

__set_app_type
exit
__getmainargs
__p__commode

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

078a0f381f26c36fc8bb842a95742a13

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

netapi32

lz32

msvcp60

esent

msvcrt

Sections

.text Size: 63KB - Virtual size: 63KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 62KB - Virtual size: 240KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 63KB - Virtual size: 63KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 62KB - Virtual size: 240KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB