tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

179KB
MD5

a72d39131ef31b2a7250fff8a8cab220
SHA1

b681d109158ba0cef50829c0cfac57e474c1c7d7
SHA256

69cd0167b85413a0b0ce8a33110c163dd747e89853d9a2935f311325fde546ce
SHA512

9ff1c9c42a90a19f8d0854645788202ae92fcde41df840ec5f210af3fac23c663b9b1110979d8ec0e458a4e6145a20aef0b03b0574074141064f28a076152dca
SSDEEP

3072:UGBKzjTMllCh20Go6/hvOjsdTPs0OKPZ+xtoxsZQz4Q0xRS2jxzY/S:UUKz/MllKG4oRPfO0ZSr

Score

N/A

Malware Config

Signatures

Files

tmp
.exe windows x64

1391c451e69f9189f37a79adca9d065e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

MultiByteToWideChar
GetLastError
CreateFileA
CloseHandle
GetLocalTime
GetCurrentProcessId
WideCharToMultiByte
FileTimeToSystemTime
SystemTimeToFileTime
GetModuleFileNameA
GetCurrentProcess
WriteFile
WaitForSingleObject
TerminateProcess
GetProcAddress
Sleep
FindFirstFileA
GetDriveTypeA
FindNextFileA
FindClose
GetCurrentThreadId
CopyFileA
DeleteFileA
SetFileAttributesA
GetLogicalDriveStringsA
GetWindowsDirectoryA
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
ReadConsoleW
CreateFileW
SetLastError
SetCurrentDirectoryA
ReadFile
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
GetFileType
RtlUnwind
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleFileNameW
ExitProcess

winhttp

WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse

ws2_32

WSAStartup

shlwapi

PathFileExistsA

Sections

.text
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1391c451e69f9189f37a79adca9d065e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

winhttp

ws2_32

shlwapi

Sections

.text Size: 119KB - Virtual size: 118KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 119KB - Virtual size: 118KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB