36f552ff08b2d1c2c9df760eabb47616a9ef067df738ea3560a30ba39c4fcab5

Sharing

Copy URL Twitter E-mail

General

Target

36f552ff08b2d1c2c9df760eabb47616a9ef067df738ea3560a30ba39c4fcab5
Size

712KB
MD5

34356cb53524f3e223844f869f51b123
SHA1

e55642da47fe16e4eba78bc409d9196c0d69f12e
SHA256

36f552ff08b2d1c2c9df760eabb47616a9ef067df738ea3560a30ba39c4fcab5
SHA512

bc2caf3c6d0be4cd9133d6c3a45bd65e5fe607ee5ce7e04762c5e70d57959a6f0fc1e45ca843e074eebbfccee75d30042f9b172d76db56ab58fcb7ddfdcc5aa8
SSDEEP

12288:bCdQT2KcXhrK58Kh0N4kZbBXFxZSmCHYGzXWgJ952wRFbucAwoaVrslcp9:e+c+2KGN4+b4HLzl/ZRFy8oAo

Score

N/A

Malware Config

Signatures

Files

36f552ff08b2d1c2c9df760eabb47616a9ef067df738ea3560a30ba39c4fcab5
.exe windows x86

5569273a6e90a8f701d070eee56d83d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

winspool.drv

AbortPrinter
GetPrintProcessorDirectoryA
ClosePrinter
DocumentPropertiesW
DeviceCapabilitiesA
DeviceCapabilitiesW
EnumPrinterDataExW
EnumPortsW
EnumMonitorsA
DeletePrinterConnectionW
FlushPrinter

advapi32

CryptGetHashParam
GetSidSubAuthorityCount
StartServiceW
RegQueryInfoKeyA
CryptSignHashA
LsaOpenPolicy
GetSidIdentifierAuthority
SetKernelObjectSecurity
SystemFunction005
AccessCheckAndAuditAlarmW
GetSidSubAuthority
GetCurrentHwProfileA
RegSetValueW
ImpersonateSelf

rtutils

MprSetupProtocolFree
RouterLogEventExW
TraceDeregisterExA
TraceVprintfExA
TraceDeregisterW
RouterLogRegisterA
RouterLogEventStringA
TraceRegisterExW
LogEventW
TracePrintfExA
TracePutsExA
TraceDumpExA
LogEventA
TraceDeregisterA
TracePrintfW
RouterLogEventA

netapi32

NetGroupGetInfo
NetShareAdd
DsGetDcNameW
NetUnjoinDomain
NetGetDCName
NetUseEnum
NetUserSetInfo
NetServerTransportEnum
NetStatisticsGet

kernel32

GetNumberOfConsoleFonts
CreateMailslotA
PrivCopyFileExW
GetAtomNameA
OpenThread
VirtualAlloc
GetDiskFreeSpaceExW
GetBinaryTypeW
IsBadWritePtr
SetThreadPriorityBoost
ReadConsoleA
GetCommandLineA
MapViewOfFileEx
WritePrivateProfileStructW
UpdateResourceW
CreateFiber
GetProcessVersion

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.raJV
Size: 196KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.NC
Size: 480KB - Virtual size: 599KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5569273a6e90a8f701d070eee56d83d1

Headers

DLL Characteristics

File Characteristics

Imports

winspool.drv

advapi32

rtutils

netapi32

kernel32

Sections

.text Size: 16KB - Virtual size: 14KB

.raJV Size: 196KB - Virtual size: 320KB

.NC Size: 480KB - Virtual size: 599KB

.rsrc Size: 12KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 194B

.text
Size: 16KB - Virtual size: 14KB

.raJV
Size: 196KB - Virtual size: 320KB

.NC
Size: 480KB - Virtual size: 599KB

.rsrc
Size: 12KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 194B