0d7443038c28a20c3b45c4e49cb5a8890520f0d5aa9743fc8d6abae04ca50535

Sharing

Copy URL Twitter E-mail

General

Target

0d7443038c28a20c3b45c4e49cb5a8890520f0d5aa9743fc8d6abae04ca50535
Size

92KB
MD5

4fa23e975e92903ec86a05b37149a89d
SHA1

2feae2112eb978f8c0e473f67a5d52a273053046
SHA256

0d7443038c28a20c3b45c4e49cb5a8890520f0d5aa9743fc8d6abae04ca50535
SHA512

e8c180b4416c9c64c062410023dd64eabb0e29c47d8f5588eeab0937996d608aa0417b85c99ee1b245d342683f61be8f8051faa0e75ef33af97c581544cbce10
SSDEEP

1536:QWIJInqQSeJFez7z+3cmMeGXuEeie1RCNhHWfN++NAgA:sI7SwxsVeGHe1MPWdtA

Score

N/A

Malware Config

Signatures

Files

0d7443038c28a20c3b45c4e49cb5a8890520f0d5aa9743fc8d6abae04ca50535
.dll windows x86

a06529690d58edd08ef4703a44d5e7db

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlUnwind
wcslen
wcschr
_stricmp
atoi
NtClose
NtStopProfile
_snprintf
DbgPrint
RtlUnicodeToOemN
RtlAdjustPrivilege
RtlMultiByteToUnicodeN
NtAllocateVirtualMemory
NtCreateProfile
NtSetIntervalProfile
NtStartProfile
NtWriteFile
NtSetInformationProcess
NtQueryInformationProcess
NtQueryVirtualMemory
NtQuerySystemInformation
RtlNtStatusToDosError

kernel32

GetSystemInfo
LoadLibraryA
InterlockedExchange
FreeLibrary
GetProcAddress
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLastError
DisableThreadLibraryCalls
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateFileA
CloseHandle
GetProcessHeap
SetLastError
LocalFree
LocalAlloc
MultiByteToWideChar
WideCharToMultiByte
ReadProcessMemory
RaiseException
SetProcessWorkingSetSize
GetProcessWorkingSetSize
lstrcpyA
lstrlenA
HeapFree
HeapAlloc

Exports

Exports

EmptyWorkingSet
EnumDeviceDrivers
EnumPageFilesA
EnumPageFilesW
EnumProcessModules
EnumProcesses
GetDeviceDriverBaseNameA
GetDeviceDriverBaseNameW
GetDeviceDriverFileNameA
GetDeviceDriverFileNameW
GetMappedFileNameA
GetMappedFileNameW
GetModuleBaseNameA
GetModuleBaseNameW
GetModuleFileNameExA
GetModuleFileNameExW
GetModuleInformation
GetPerformanceInfo
GetProcessImageFileNameA
GetProcessImageFileNameW
GetProcessMemoryInfo
GetWsChanges
InitializeProcessForWsWatch
QueryWorkingSet
QueryWorkingSetEx

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a06529690d58edd08ef4703a44d5e7db

Headers

File Characteristics

Imports

ntdll

kernel32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.data Size: 72KB - Virtual size: 85KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 15KB

.data
Size: 72KB - Virtual size: 85KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 1KB - Virtual size: 1KB