b46ff318196680e4915c95be040b3d6cb26dd3aa34b80314fb38d3ac22e0070b

Sharing

Copy URL

Twitter E-mail

General

Target

b46ff318196680e4915c95be040b3d6cb26dd3aa34b80314fb38d3ac22e0070b
Size

20KB
MD5

41436d7d3bb241ceadbeb0193bcd96d0
SHA1

edb8347965fb32f74c3e1a770381768f1d37b658
SHA256

b46ff318196680e4915c95be040b3d6cb26dd3aa34b80314fb38d3ac22e0070b
SHA512

217b46dca266d3cb4d4fdcc708a8269fedd2b2e68cb401b4bf9a6c32e938beaf4d0852c44504fa9c5a95020e299876c22ebfc1cc903387b8c2e3a83a3327b47c
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplqCAu8UaWHuqaTlX0wG:zfYh2oCtpXPqx2OqaewG

Score

N/A

Malware Config

Signatures

Files

b46ff318196680e4915c95be040b3d6cb26dd3aa34b80314fb38d3ac22e0070b
.dll windows x86

36df56ad47b0b3d1173c2bc36dbc879c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegSetValueExA

kernel32

CreateMutexA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
OutputDebugStringA
ReleaseMutex
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
_errno
_iob
_winmajor
abort
calloc
fflush
free
fwrite
malloc
memcpy
sprintf
vfprintf

Exports

Exports

CalcHash
CalcHashW
CheckUnblock
DynamicImports
GetGlobalKey
GetKernel32
GetProcessParent
Inject@4
Injecting
IsPatched
IsStarted
Kernel32Base
KernelGetProcAddressEx
LoopInject@4
MapFileToMemory
PatchDLL
Peb
ResolveDynamicImports
__CloseHandle
__ConnectNamedPipe
__CopyFile
__CreateEvent
__CreateFile
__CreateFileMapping
__CreateMailslot
__CreateNamedPipe
__CreateProcess
__CreateRemoteThread
__CreateService
__CreateToolhelp32Snapshot
__DeleteFile
__ExitProcess
__FindResource
__GetCommandLine
__GetCurrentProcessId
__GetFileSize
__GetFullPathName
__GetKernelObjectSecurity
__GetLongPathName
__GetMailslotInfo
__GetModuleFileName
__GetModuleHandle
__GetProcAddress
__GetProcessId
__GetSystemDirectory
__GetTempFileName
__GetTempPath
__GetTickCount
__GetUserNameW
__GlobalAlloc
__GlobalFree
__LoadLibrary
__LoadResource
__LockResource
__MapViewOfFile
__MessageBox
__NtClose
__NtCreateFile
__NtCreateSection
__NtExtendSection
__NtMapViewOfSection
__NtOpenDirectoryObject
__NtOpenFile
__NtOpenSection
__NtUnmapViewOfSection
__ObReferenceObjectByHandle
__OpenEvent
__OpenProcess
__OpenSCManager
__OpenService
__OpenThread
__Process32First
__Process32Next
__ReadFile
__ReadProcessMemory
__RegOpenKey
__RegQueryValueEx
__ResetEvent
__ResumeThread
__RtlAdjustPrivilege
__RtlInitUnicodeString
__RtlNtStatusToDosError
__SHGetFolderPath
__SetEvent
__SetMailslotInfo
__SizeofResource
__Sleep
__StartService
__SuspendThread
__Thread32First
__Thread32Next
__UnmapViewOfFile
__VirtualAlloc
__VirtualAllocEx
__VirtualFree
__VirtualFreeEx
__WaitForSingleObject
__WinExec
__WriteFile
__WriteProcessMemory
__ZwCreateDirectoryObject
__ZwCreateFile
__ZwCreateSection
__ZwLoadDriver
__ZwMakeTemporaryObject
__ZwQueryInformationProcess
__ZwUnloadDriver
___memset
___strlwr
___strupr
___wcslen
___wcsncpy
__atoi
__lstrcpyn
__lstrlen
__mbstowcs
__memcmp
__memcpy
__memset
__puts
__rand
__srand
__sscanf
__strlwr
__strrchr
__strstr
__time
__wcslen
__wcsncpy
__wsprintf
_strchr
advapi32
emul
hGlobalKey
kernel32
m2
msvcrt
ntdll
shell32
szAutoloadName
szAutoloadPath
szDriverPath
szIsAutoload
user32
xwcslwr

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 712B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36df56ad47b0b3d1173c2bc36dbc879c

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.data Size: 3KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.eh_fram Size: 512B - Virtual size: 4B

.bss Size: - Virtual size: 712B

.edata Size: 3KB - Virtual size: 3KB

.idata Size: 1024B - Virtual size: 1016B

.CRT Size: 512B - Virtual size: 24B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 1024B - Virtual size: 1020B

.text
Size: 7KB - Virtual size: 7KB

.data
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.eh_fram
Size: 512B - Virtual size: 4B

.bss
Size: - Virtual size: 712B

.edata
Size: 3KB - Virtual size: 3KB

.idata
Size: 1024B - Virtual size: 1016B

.CRT
Size: 512B - Virtual size: 24B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 1024B - Virtual size: 1020B