495a7b33759cffb07e84d552b6255c232d7b20be0179a3519e7fbc72595a10e7

Sharing

Copy URL Twitter E-mail

General

Target

495a7b33759cffb07e84d552b6255c232d7b20be0179a3519e7fbc72595a10e7
Size

356KB
MD5

3479242e994bbcfdef911952a6de9a32
SHA1

3dd75b0ceacaf9fe8aeb7ccde0f950fe0a636463
SHA256

495a7b33759cffb07e84d552b6255c232d7b20be0179a3519e7fbc72595a10e7
SHA512

ed8410106ef0dab8069bb9395eec722a6cc9a78473201ec489864949f6c2efeb547ae5107312c88f076ea74ecb34ad54810d921fa25f22bb1659c8b18b0e68f8
SSDEEP

6144:1kfPL2/OxPZfucLFMuLPUY+TmObc305WfSh2IZslfLgT7ZiBoH+E3:yfPuOxPPMQPUW0wSh2IZsljlBoe

Score

N/A

Malware Config

Signatures

Files

495a7b33759cffb07e84d552b6255c232d7b20be0179a3519e7fbc72595a10e7
.dll windows x86

ab2f3844dd2a1e6917bb0c5ffd90217a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

hpltkrn14nu

ord282
ord283
ord190
ord141
ord109
ord129
ord221
ord100
ord308
ord137
ord192
ord191
ord310
ord188
ord189
ord125
ord116
ord285
ord126
ord101
ord134
ord179
ord174
ord175
ord183
ord249
ord248
ord284
ord293
ord294
ord292
ord222

kernel32

IsBadReadPtr
Sleep
InterlockedDecrement
InterlockedIncrement
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
InterlockedExchange
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
GetSystemTimeAsFileTime

msvcr80

_except_handler4_common
_encode_pointer
_malloc_crt
_encoded_null
free
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
memmove
_local_unwind4
wcsrchr
memchr
qsort
memcmp
wcscpy
memset
memcpy
__CxxFrameHandler3
wcscmp

Exports

Exports

DllMain
fltComment
fltCompressBuffer
fltDeletePage
fltDeleteTag
fltEndCompressBuffer
fltEnumTags
fltGetExtension
fltGetMarkers
fltGetStamp
fltGetTag
fltInfo
fltLoad
fltLoadBuffer
fltLoadCMP
fltSave
fltSaveBuffer
fltSaveCMP
fltSetComment
fltSetStamp
fltSetTag
fltStartCompressBuffer
fltTransform

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab2f3844dd2a1e6917bb0c5ffd90217a

Headers

File Characteristics

Imports

hpltkrn14nu

kernel32

msvcr80

Exports

Exports

Sections

.text Size: 232KB - Virtual size: 231KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 100KB - Virtual size: 99KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 232KB - Virtual size: 231KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 100KB - Virtual size: 99KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 5KB