8d13ba11a36326f9d6b04766f48dd26edb8e4a3f9b9cc3847000e70723b54974 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d13ba11a36326f9d6b04766f48dd26edb8e4a3f9b9cc3847000e70723b54974
Size

816KB
MD5

99268b553c0d39831938991a2c5eb8a0
SHA1

afaea259579ae472fa8161516a5ab2143043c2bf
SHA256

8d13ba11a36326f9d6b04766f48dd26edb8e4a3f9b9cc3847000e70723b54974
SHA512

b1484737a190c0a1e9968caada029c361afdeff5e5a236bc65eac9b55664a341f19439bd1e95c4850308d7e3755d2312abb3de2da66e5a7dfac8382198e85811
SSDEEP

24576:WyVLmqJUNEryNGc02uvCfdbELLjFwx6N:hmOAEru0cWLX

Score

N/A

Malware Config

Signatures

Files

8d13ba11a36326f9d6b04766f48dd26edb8e4a3f9b9cc3847000e70723b54974
.exe windows x86

fd3cf071cf630c59e86fdc449661b638

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindNextVolumeW
CreateEventA
GetLocaleInfoW
GetPrivateProfileIntA
GetModuleHandleA
GetModuleFileNameW
TlsGetValue
GetNumberFormatA
lstrcpynA
VirtualAlloc
GetCurrentProcess
GetStartupInfoW
TlsAlloc
lstrcpynA
GetFullPathNameA
DeleteFileW
lstrcpynA
lstrcpynA
FormatMessageA
lstrlenA
lstrcpynA
TlsAlloc
SetCurrentDirectoryA

vssapi

??0CVssWriter@@QAE@XZ
??1CVssWriter@@UAE@XZ
VssFreeSnapshotProperties
??0CVssJetWriter@@QAE@XZ

Sections

.text
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 797KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ