befa61d16dadc4ee494e23623e029a2314698c496dd11757094f2b55793c4bf9

Sharing

Copy URL Twitter E-mail

General

Target

befa61d16dadc4ee494e23623e029a2314698c496dd11757094f2b55793c4bf9
Size

403KB
MD5

02fbc867b77c07b91e700f7a62315b5e
SHA1

6f63bc615d7b5f8cf74bde4112bca5cb34f3100a
SHA256

befa61d16dadc4ee494e23623e029a2314698c496dd11757094f2b55793c4bf9
SHA512

b43ae872b0a40f0f466c3a2e33c1976661cb368d046f349e3e33886643dd57f1cfb96d8e9756bb82fecfa71cf08a5ecd7fbce9a0eede8557680f0b7577855022
SSDEEP

6144:fostqMiTwzxZHmOz7Cifng3OvVDlEqazE/TXw7IoCYR/xpO7GpY0Nt:6MySgevVDl7ag/Lw7EuxpOiplt

Score

1^/10

Malware Config

Signatures

Files

befa61d16dadc4ee494e23623e029a2314698c496dd11757094f2b55793c4bf9
.exe windows x64

9d8ad576334559dc0e0454a7a5b1d789

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleW
lstrcpyW
lstrcatW
GetPrivateProfileStringW
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
GetStartupInfoW
InitializeSListHead
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
IsDebuggerPresent
GetCurrentThreadId
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
lstrcpyA
UnmapViewOfFile
WideCharToMultiByte
MapViewOfFile
CreateFileMappingW
TerminateProcess
GetCurrentProcessId
CreateEventW
SetEvent
CloseHandle
GetSystemTimeAsFileTime
OutputDebugStringA

user32

EndDialog
DialogBoxParamW
SystemParametersInfoW
LoadImageW
LoadIconW
LoadCursorW
MessageBoxW
MessageBoxA
InvalidateRect
GetWindowTextA
GetWindowTextLengthA
LoadBitmapW
LoadStringW
wvsprintfA
wsprintfA
wsprintfW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
DefWindowProcW
PostQuitMessage
RegisterClassExW
CreateWindowExW
DestroyWindow
EndPaint
MapWindowPoints
GetDlgItem
ShowWindow
LoadAcceleratorsW
TranslateAcceleratorW
DrawTextExW
UpdateWindow
BeginPaint
GetClientRect

gdi32

GetStockObject
DeleteDC
SetBkColor
SetTextColor
SetBkMode
SelectObject
DeleteObject
BitBlt
CreateCompatibleDC

advapi32

RegGetValueW

shell32

SHGetSpecialFolderPathA
ShellExecuteExW

ws2_32

socket
WSAStartup
WSACleanup
WSAAsyncSelect
ntohs
htons
connect
closesocket
ntohl
recv
send
htonl

shlwapi

PathFileExistsW
StrChrW

vcruntime140d

__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception
__std_type_info_destroy_list
__C_specific_handler_noexcept
__C_specific_handler
memcpy
memset
__current_exception_context
__vcrt_GetModuleFileNameW

ucrtbased

_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
strcpy_s
strcat_s
_cexit
_callnewh
_free_dbg
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_wmakepath_s
_wsplitpath_s
wcscpy_s
_set_fmode
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_c_exit
_configure_wide_argv
__setusermatherr
_set_app_type
_seh_filter_exe
_CrtDbgReport
_wtoi
realloc
malloc
free
strlen
rand
__stdio_common_vsprintf_s
_CrtDbgReportW

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 305KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d8ad576334559dc0e0454a7a5b1d789

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

shlwapi

vcruntime140d

ucrtbased

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 57KB - Virtual size: 57KB

.rdata Size: 19KB - Virtual size: 18KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 9KB - Virtual size: 9KB

.idata Size: 8KB - Virtual size: 7KB

.msvcjmc Size: 1024B - Virtual size: 848B

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 305KB - Virtual size: 304KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 19KB - Virtual size: 18KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 9KB - Virtual size: 9KB

.idata
Size: 8KB - Virtual size: 7KB

.msvcjmc
Size: 1024B - Virtual size: 848B

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 305KB - Virtual size: 304KB