fa8d61d2ac1de41585843f2791a9e00fe5563c4771bbbbc0c82d819268bf9ff5

Sharing

Copy URL Twitter E-mail

General

Target

fa8d61d2ac1de41585843f2791a9e00fe5563c4771bbbbc0c82d819268bf9ff5
Size

64KB
MD5

5b30c4b3ce20ce55f38045923dbe3531
SHA1

bfbf0fecd193d46e59544a12e29ffb104333c56c
SHA256

fa8d61d2ac1de41585843f2791a9e00fe5563c4771bbbbc0c82d819268bf9ff5
SHA512

581f5d63cca4e885640cc2d12f3bbf07884e28d65e06b6dd97cb47a61c6bf2a47216e377416c396dfbee06f50b67695884b572a7668f9e4a0a9e5179738fd0ab
SSDEEP

1536:MIjzZvaRX8yGkwun2DHKj0rl77pVQvLCQkjb5I8H4Zcc7:7Zv9yGkwu2Wk7sJalIv

Score

N/A

Malware Config

Signatures

Files

fa8d61d2ac1de41585843f2791a9e00fe5563c4771bbbbc0c82d819268bf9ff5
.exe windows x86

b5c58c2bb7e4c90c0fbce9ac553c726a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateTimerQueueTimer
SetConsoleOutputCP
lstrcpyA
AddConsoleAliasW
WritePrivateProfileStringW
FindFirstChangeNotificationW
EnumTimeFormatsW
IsDBCSLeadByteEx
AllocateUserPhysicalPages
SetEnvironmentVariableA
BackupSeek
GetCurrentThreadId
GetSystemTimeAsFileTime
ReadFileScatter
GetCPInfo
CreateJobSet
CancelDeviceWakeupRequest
GetTapeStatus
GetCurrentProcessId
GetAtomNameW
UnlockFileEx
VirtualAlloc
ExpungeConsoleCommandHistoryA
QueryPerformanceCounter
GetConsoleAliasA
SetThreadPriorityBoost
SetHandleContext
SetConsoleNumberOfCommandsA
GetEnvironmentStrings
IsValidLanguageGroup
CopyLZFile
UTUnRegister
GetThreadLocale
BuildCommDCBW
GetComputerNameExA
GetStartupInfoW
SetTapePosition
ExitProcess
QueryDepthSList
RequestDeviceWakeup
GetModuleHandleW
SetClientTimeZoneInformation
GetTickCount
SleepEx
ReadFileEx
lstrcatA
IsWow64Process
FindCloseChangeNotification
OpenEventW
EnumSystemLanguageGroupsA
SetThreadIdealProcessor
EnumLanguageGroupLocalesA
CreateTapePartition
SetThreadUILanguage
LoadLibraryA
IsBadHugeReadPtr
GetVolumeInformationA

polstore

IPSecFreeISAKMPData
IPSecDeleteISAKMPData
IPSecClosePolicyStore
IPSecAllocPolMem
IPSecCreateNFAData
IPSecFreeMulFilterData
IPSecCopyPolicyData
IPSecEnumFilterData
IPSecCreatePolicyData
IPSecDeletePolicyData
IPSecFreeMulISAKMPData
IPSecGetISAKMPData
IPSecCopyNFAData
IPSecDeleteNegPolData
IPSecFreeMulNegPolData
IPSecImportPolicies
IPSecCreateNegPolData
IPSecEnumPolicyData
IPSecFreePolStr
IPSecSetISAKMPData
IPSecSetPolicyData
IPSecFreeNFAData
IPSecUnassignPolicy
IPSecCreateFilterData
IPSecEnumNFAData

user32

WaitForInputIdle
EnumPropsExA
BeginDeferWindowPos
GetWindowTextLengthA
RegisterClipboardFormatW
GetMenuItemCount
IsCharUpperA
SetWindowLongA
OemToCharBuffA
IMPQueryIMEA
CreateIconFromResourceEx
SetRect
EnumWindowStationsA
CloseDesktop
FlashWindowEx
GetDCEx
ExitWindowsEx
LockWorkStation
GetMenuStringW
SendNotifyMessageA
GetMessageA
GetMessageW
TabbedTextOutA
SetKeyboardState
DisableProcessWindowsGhosting
RegisterLogonProcess
MonitorFromRect
SetScrollRange
AllowSetForegroundWindow
SoftModalMessageBox

mapistub

HrComposeEID@28
BMAPIReadMail
MAPISendDocuments
FGetComponentPath
FBinFromHex@8
OpenTnefStream@28
HrDispatchNotifications@4
SzFindSz@8
MAPIFreeBuffer@4
ScLocalPathFromUNC@12
OpenTnefStreamEx@32
OpenTnefStream
PpropFindProp@12
MAPISaveMail
FixMAPI@0
FBadRowSet@4
SzFindCh@8
SzFindLastCh@8
ScCountProps@12
HrGetOmiProvidersFlags@8
GetTnefStreamCodepage
BMAPIResolveName
MAPIAllocateBuffer
__ValidateParameters@8
UNKOBJ_ScCOAllocate@12
ScInitMapiUtil@4
__CPPValidateParameters@8
CreateTable@36
CreateIProp@24

ntdll

RtlCreateUnicodeString
RtlRevertMemoryStream
ZwRemoveIoCompletion
RtlCopyUnicodeString
RtlAddAccessDeniedAceEx
NtSetDebugFilterState
ZwTestAlert
RtlRandom
RtlFindLeastSignificantBit
RtlxUnicodeStringToOemSize
RtlRealSuccessor
RtlAppendPathElement
NtCancelIoFile
RtlDowncaseUnicodeChar
RtlApplicationVerifierStop
RtlInitializeGenericTable
_CIpow
NtQueryInformationFile
ZwDeleteAtom
iswdigit
NtReplaceKey
NtQueryMultipleValueKey
ZwYieldExecution
NtQueryVolumeInformationFile
NtOpenSection
RtlLargeIntegerShiftLeft

crypt32

CertCreateContext
CryptUnregisterDefaultOIDFunction
CertFreeCertificateContext
CryptVerifyMessageHash
CryptHashToBeSigned
CertDuplicateCertificateContext
CertEnumCRLsInStore
CryptSIPGetSignedDataMsg
CertFindRDNAttr
I_CryptFreeTls
CertGetIssuerCertificateFromStore
CertOpenSystemStoreA
CryptSignCertificate
I_CryptAddRefLruEntry
CryptGetMessageCertificates
I_CryptInstallAsn1Module
CryptEnumOIDFunction
CertFindCRLInStore
CryptDecryptMessage
CryptUnregisterOIDFunction
I_CryptDetachTls
I_CryptDisableLruOfEntries

msvcp60

??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
_Stof
??0codecvt_base@std@@QAE@I@Z
??0bad_exception@std@@QAE@ABV01@@Z
??4?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
?open@?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXPBDH@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@M@0@@Z
??_7?$messages@D@std@@6B@
??0?$codecvt@GDH@std@@QAE@I@Z
?pow@std@@YA?AV?$complex@O@1@ABV21@H@Z
?epsilon@?$numeric_limits@M@std@@SAMXZ
?quiet_NaN@?$numeric_limits@M@std@@SAMXZ
?signaling_NaN@?$numeric_limits@O@std@@SAOXZ
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ
_LSnan
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z
??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QAEXXZ
_LNan
??Hstd@@YA?AV?$complex@N@0@ABV10@0@Z
??0ios_base@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?assign@?$char_traits@D@std@@SAXAADABD@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDF@Z
?do_thousands_sep@?$_Mpunct@G@std@@MBEGXZ
?to_char_type@?$char_traits@D@std@@SADABH@Z
??0money_base@std@@QAE@I@Z

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5c58c2bb7e4c90c0fbce9ac553c726a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

polstore

user32

mapistub

ntdll

crypt32

msvcp60

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 24KB - Virtual size: 72KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 324B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 24KB - Virtual size: 72KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 324B