0e04cb8a972105f1a5148ab63581cdbf1dfb6631bf64328c2e7074efbf047bc2

Sharing

Copy URL Twitter E-mail

General

Target

0e04cb8a972105f1a5148ab63581cdbf1dfb6631bf64328c2e7074efbf047bc2
Size

480KB
MD5

40f413ffb7d62ab6a5f5c292deac5370
SHA1

e7d71bc6b6c80bffaa66c8698301640782ce58c7
SHA256

0e04cb8a972105f1a5148ab63581cdbf1dfb6631bf64328c2e7074efbf047bc2
SHA512

d1033f16b7c48288601434ed4fcb6517f1f97487c9aa821b2f3c32e7e1390d5646f2dcea613efc47f5d36e36d2e00b003359520b3f836563cd725a5f53d41fed
SSDEEP

12288:9YA/Q23auv1NxG/V9r450imbsKq1TFnwt5A27:z42quv1NxG/V9r450iEsB1Nwt5/7

Score

N/A

Malware Config

Signatures

Files

0e04cb8a972105f1a5148ab63581cdbf1dfb6631bf64328c2e7074efbf047bc2
.dll windows x86

fd72c7cab8c605b72a80e97c9baeeac4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
DeviceIoControl
FreeLibrary
GetProcAddress
LoadLibraryA
CreateFileA
GetVersion
SetEvent
ReadFile
SetLastError
FindResourceA
LoadResource
SizeofResource
GetCommandLineA
HeapFree
HeapAlloc
GetLastError
DeleteFileA
SetFilePointer
GetFileType
WriteFile
InterlockedDecrement
InterlockedIncrement
HeapReAlloc
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetCurrentThread
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
ResetEvent
VirtualFree
RaiseException
VirtualAlloc
InitializeCriticalSection
RtlUnwind
SetStdHandle
SetEndOfFile
Sleep
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
FlushFileBuffers
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
CompareStringA
CompareStringW
SetEnvironmentVariableA
LocalFree
FormatMessageA
AllocConsole
SetThreadAffinityMask
GetProcessAffinityMask
SetThreadPriority
GetSystemInfo
QueryPerformanceFrequency
TerminateThread
QueryPerformanceCounter
CreateThread
DuplicateHandle
GetExitCodeThread
SleepEx
VirtualQuery
WaitForSingleObject
CloseHandle
GetCurrentProcessId
HeapCreate
GetModuleFileNameA
HeapSize

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegQueryValueA
RegOpenKeyA

Exports

Exports

SetAuthPaht
WDeCSSGetLba
WDeCSSParseIFO
WDeCSSSetProcess
WMPEG2EndDec
WMPEG2GetDownsampling
WMPEG2GetFrameData
WMPEG2GetHeight
WMPEG2GetPass
WMPEG2GetRatio
WMPEG2GetTime
WMPEG2GetVolume
WMPEG2GetWidth
WMPEG2InitDec
WMPEG2ReInit
WMPEG2ScanFiles
WMPEG2Seek
WMPEG2SetPass
WMPEG2SetVolume

Sections

.text
Size: 320KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd72c7cab8c605b72a80e97c9baeeac4

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 320KB - Virtual size: 317KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 36KB - Virtual size: 2.3MB

_RDATA Size: 56KB - Virtual size: 53KB

.reloc Size: 44KB - Virtual size: 42KB

.text
Size: 320KB - Virtual size: 317KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 36KB - Virtual size: 2.3MB

_RDATA
Size: 56KB - Virtual size: 53KB

.reloc
Size: 44KB - Virtual size: 42KB