fb1f589c6e771c40109070729bc7f3db47ae76f69c0402b06d48e7f2ab96f7f7

General

Target

fb1f589c6e771c40109070729bc7f3db47ae76f69c0402b06d48e7f2ab96f7f7
Size

512KB
MD5

2d32f90c4b75f9ec420d6e928c179a70
SHA1

9d11b7c92034618f7626bea22e66a170e6ea7b7b
SHA256

fb1f589c6e771c40109070729bc7f3db47ae76f69c0402b06d48e7f2ab96f7f7
SHA512

ca47e38f8e467b0fefdf4097f0eb2fc78902e65a4eca4ee2c0c998758cd3e335a236fe241ecd28238d667205d7ec5423e96e924145d5da2469d1527361a64c10
SSDEEP

12288:wGh2lhKe779l/cilv+dKaLDVed0A0KijP:/27N9l/V9anIj0jjP

Score

N/A

Malware Config

Signatures

Files

fb1f589c6e771c40109070729bc7f3db47ae76f69c0402b06d48e7f2ab96f7f7
.exe windows x86

1f2e828cced8d0d4e66324d602a347db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

kernel32

GetVersion
GetModuleHandleW
GetProcAddress
ExpandEnvironmentStringsA
LoadLibraryA
MultiByteToWideChar
FreeLibrary
GetVersionExA
VirtualAlloc
SetProcessDEPPolicy
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange

msvcrt

rand_s
??2@YAPAXI@Z
??3@YAXPAX@Z
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
_ismbblead
__setusermatherr
_initterm
_acmdln
?terminate@@YAXXZ
_controlfp
_except_handler4_common

iertutil

ord650

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vmp0
Size: 500KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1f2e828cced8d0d4e66324d602a347db

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

iertutil

Sections

.text Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 840B

.vmp0 Size: 500KB - Virtual size: 1.6MB

.text
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 840B

.vmp0
Size: 500KB - Virtual size: 1.6MB