f2fdbccb6f9843d66792f4abd7509df2b1a215c4c8024c1a0fd4c96f39fc28fc

Sharing

Copy URL Twitter E-mail

General

Target

f2fdbccb6f9843d66792f4abd7509df2b1a215c4c8024c1a0fd4c96f39fc28fc
Size

56KB
MD5

f66537d9c0adf61667104ec3eab729af
SHA1

5aeeaad2bc637fd263f95976f880eb19271f7be6
SHA256

f2fdbccb6f9843d66792f4abd7509df2b1a215c4c8024c1a0fd4c96f39fc28fc
SHA512

66396e6c88253f9ee421d7df5aa43b68d58bd08d8d869a30fba3395204d34f785ddf391befe7d4c347dfe691aca0b43ed0e6f041abd67e67ecc8944c39f8fc4c
SSDEEP

768:v4W29dRXDoUt11DerQ/4Y4B9qBenxtm/SQ2zk5dGusvg0Cyzso1/nrVyBIuCdf:ERXDoUtXerwBYi6e5d6vvRzsopBzdf

Score

N/A

Malware Config

Signatures

Files

f2fdbccb6f9843d66792f4abd7509df2b1a215c4c8024c1a0fd4c96f39fc28fc
.dll windows x86

caff81c9f906ddf1c0ab329a22f44f39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBeep
SetProcessDefaultLayout
CallWindowProcW
InsertMenuW
GetWindowLongW
PostMessageW
DestroyAcceleratorTable
IsWindowVisible
IsWindowEnabled
SetCursor
GetClassNameA
GetSubMenu
GetWindowLongA
PeekMessageW
EnableMenuItem
DispatchMessageW
GetActiveWindow
CharUpperW
ReleaseCapture
IsMenu
SetTimer
GetDC
DestroyMenu
CreateDialogParamW
CreateDialogIndirectParamW
DrawTextW

shell32

DragQueryFileW
ord155

msvcrt

wcscoll
fclose
wcsstr
fread

shlwapi

PathFindExtensionW
PathFindFileNameW

ntdll

NtQueryDirectoryObject
NtOpenTimer
NtOpenEventPair
NtPulseEvent
NtOpenJobObject
NtOpenEvent
NtCancelTimer
NtQueryObject
NtQueryEvent
NtQueryMutant
NtOpenSection
NtQuerySection
NtCreateSemaphore

kbdsconf

_LEps
_FInf
_Sinh
_Dnorm
_Strcoll
_FSnan
_Wcrtomb
_LXbig
_Getcoll

kernel32

VirtualAlloc
GetCurrentProcessId
HeapReAlloc
FormatMessageW
LocalAlloc
GetUserDefaultLCID
GetShortPathNameW
InterlockedExchangeAdd
GetCurrentProcess
CompareStringW
GetLocaleInfoW
TerminateProcess
VirtualFree
GetStartupInfoA
HeapSize
LoadLibraryA
FindNextVolumeW
GetModuleHandleW
CloseHandle
GetCurrentThreadId

oleaut32

VariantClear
OleCreateFontIndirect

gdi32

CreateCompatibleBitmap
CreateCompatibleDC

ole32

CoRegisterClassObject
CoTaskMemRealloc
StringFromGUID2

comctl32

ImageList_Replace

Exports

Exports

CreateProcessNotify
ShimFlushCache
ApphelpCheckExe
PathCleanupSpec
DbgSetDebugPrintCallback
DbgQueryDebugFilterState
DbgPrintReturnControlC
DbgBreakPointWithStatus
ShimDumpCache
AllocADsStr
DbgPrompt
TraceDeregisterExA
DwCloneEntry
DwEnumEntriesForAllUsers
TraceRegisterExW
SetPermLayers
PathIsSlowA
TracePrintfExA
EtwActivityIdControl
BerBvFree
DwEnumEntryDetails
SdbUnregisterDatabase
DbgBreakPoint
EtwWriteEx
EmProviderRegister
EtwWrite
EtwUnregister
DbgPrint
PathResolve
EmProviderRegisterEntry
TracePrintfExW
DbgLoadImageSymbols
TracePutsExW
EtwWriteEndScenario
TracePrintfW
PathQualify
PathMakeUniqueName
EmProviderDeregisterEntry
TraceDeregisterExW

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

caff81c9f906ddf1c0ab329a22f44f39

Headers

DLL Characteristics

File Characteristics

Imports

user32

shell32

msvcrt

shlwapi

ntdll

kbdsconf

kernel32

oleaut32

gdi32

ole32

comctl32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 20KB

.data Size: 33KB - Virtual size: 32KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

.text
Size: 20KB - Virtual size: 20KB

.data
Size: 33KB - Virtual size: 32KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB