3ca13674a0cd76d73fdd247028fa5e6983fe274492224666ca064f34a1231f8d

Sharing

Copy URL

Twitter E-mail

General

Target

3ca13674a0cd76d73fdd247028fa5e6983fe274492224666ca064f34a1231f8d
Size

712KB
MD5

5308563d3c5492e1f8d01a41d1814854
SHA1

3a16beddf0fa3c7cc82dd296eca855a851c6fe2f
SHA256

3ca13674a0cd76d73fdd247028fa5e6983fe274492224666ca064f34a1231f8d
SHA512

244814395e5ac308b146f8863ee1b3e91031d4338ec063dafd191b3e053c06f37bc8831bf978f8a2f394c50390d4d96446de5ba065c418a082622073be1b9172
SSDEEP

12288:ECdQT2KcXhrK58Kh0N4kZbBXFxZSmCHYGzXWgJ952wRFbucAwoaVrslcpI:l+c+2KGN4+b4HLzl/ZRFy8oAo

Score

N/A

Malware Config

Signatures

Files

3ca13674a0cd76d73fdd247028fa5e6983fe274492224666ca064f34a1231f8d
.exe windows x86

5569273a6e90a8f701d070eee56d83d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

winspool.drv

AbortPrinter
GetPrintProcessorDirectoryA
ClosePrinter
DocumentPropertiesW
DeviceCapabilitiesA
DeviceCapabilitiesW
EnumPrinterDataExW
EnumPortsW
EnumMonitorsA
DeletePrinterConnectionW
FlushPrinter

advapi32

CryptGetHashParam
GetSidSubAuthorityCount
StartServiceW
RegQueryInfoKeyA
CryptSignHashA
LsaOpenPolicy
GetSidIdentifierAuthority
SetKernelObjectSecurity
SystemFunction005
AccessCheckAndAuditAlarmW
GetSidSubAuthority
GetCurrentHwProfileA
RegSetValueW
ImpersonateSelf

rtutils

MprSetupProtocolFree
RouterLogEventExW
TraceDeregisterExA
TraceVprintfExA
TraceDeregisterW
RouterLogRegisterA
RouterLogEventStringA
TraceRegisterExW
LogEventW
TracePrintfExA
TracePutsExA
TraceDumpExA
LogEventA
TraceDeregisterA
TracePrintfW
RouterLogEventA

netapi32

NetGroupGetInfo
NetShareAdd
DsGetDcNameW
NetUnjoinDomain
NetGetDCName
NetUseEnum
NetUserSetInfo
NetServerTransportEnum
NetStatisticsGet

kernel32

GetNumberOfConsoleFonts
CreateMailslotA
PrivCopyFileExW
GetAtomNameA
OpenThread
VirtualAlloc
GetDiskFreeSpaceExW
GetBinaryTypeW
IsBadWritePtr
SetThreadPriorityBoost
ReadConsoleA
GetCommandLineA
MapViewOfFileEx
WritePrivateProfileStructW
UpdateResourceW
CreateFiber
GetProcessVersion

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.raJV
Size: 196KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.NC
Size: 480KB - Virtual size: 599KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5569273a6e90a8f701d070eee56d83d1

Headers

DLL Characteristics

File Characteristics

Imports

winspool.drv

advapi32

rtutils

netapi32

kernel32

Sections

.text Size: 16KB - Virtual size: 14KB

.raJV Size: 196KB - Virtual size: 320KB

.NC Size: 480KB - Virtual size: 599KB

.rsrc Size: 12KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 194B

.text
Size: 16KB - Virtual size: 14KB

.raJV
Size: 196KB - Virtual size: 320KB

.NC
Size: 480KB - Virtual size: 599KB

.rsrc
Size: 12KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 194B