1dcb2f33a7dcea365b7eaa8a934026449fae1c716a1e435219d6bfe370ab6801

Sharing

Copy URL Twitter E-mail

General

Target

1dcb2f33a7dcea365b7eaa8a934026449fae1c716a1e435219d6bfe370ab6801
Size

1.7MB
MD5

8e79cf36086e36fb040d872f60c8e7b1
SHA1

13c60b3db08455d006398dcc22f6d3674ec61844
SHA256

1dcb2f33a7dcea365b7eaa8a934026449fae1c716a1e435219d6bfe370ab6801
SHA512

f20b2850379d1465f002929aa3994a4610c725025d8dbe37a769ed859c05ab62871b74815d94d13b074e68dc40f2dfeb9950ebfbd7c5944c1f932ed7e377a680
SSDEEP

24576:b3rXSF9OQwaRyIyMFcXn1ttO3VH6AN2AdHp7dvC9fmhMY/6j:bLSFgQwaRylM81bO3VH6AN2Ad5EY

Score

N/A

Malware Config

Signatures

Files

1dcb2f33a7dcea365b7eaa8a934026449fae1c716a1e435219d6bfe370ab6801
.exe windows x64

89b519bfd4b238bee092ebf1b1445814

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptImportKey
CryptReleaseContext

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringW
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryW
PFXImportCertStore

kernel32

CloseHandle
CreateFileW
CreateHardLinkW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
FormatMessageW
FreeLibrary
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableA
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemDirectoryW
GetTempPathW
GetTickCount
GetVolumeInformationW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
MoveFileExW
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSemaphore
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepEx
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_assert
_beginthreadex
_cexit
_close
_commode
_errno
_findclose
_fmode
_fstat64
_get_osfhandle
_getpid
_gmtime64
_initterm
_localtime64
_lseeki64
_mkdir
_mktime64
_onexit
_stat64
_strnicmp
_sys_errlist
_sys_nerr
_telli64
_time64
_utime64
_waccess
_wchdir
_wchmod
_wcsdup
_wfindfirst64
_wfindnext64
_wfopen
_wfullpath
_wgetcwd
_wmkdir
_wopen
_wstat64
_wutime64
abort
atoi
calloc
exit
fclose
feof
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
freopen
fseek
ftell
fwrite
getc
getenv
islower
isspace
isupper
iswctype
isxdigit
localeconv
malloc
mbstowcs
memchr
memcmp
memcpy
memmove
memset
qsort
realloc
remove
setlocale
setvbuf
signal
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
strxfrm
tolower
towlower
towupper
ungetc
vfprintf
wcscat
wcschr
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncmp
wcsncpy
wcspbrk
wcstombs
wcsxfrm
_write
_unlink
_strdup
_read
_fileno
_fdopen
_close
_chmod

user32

MessageBoxA

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetEvent
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89b519bfd4b238bee092ebf1b1445814

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

crypt32

kernel32

msvcrt

user32

ws2_32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.data Size: 8KB - Virtual size: 7KB

.rdata Size: 156KB - Virtual size: 156KB

.pdata Size: 59KB - Virtual size: 58KB

.xdata Size: 81KB - Virtual size: 80KB

.bss Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 9KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 8KB - Virtual size: 7KB

.rdata
Size: 156KB - Virtual size: 156KB

.pdata
Size: 59KB - Virtual size: 58KB

.xdata
Size: 81KB - Virtual size: 80KB

.bss
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 7KB - Virtual size: 6KB