36a8115347ae369af1b3aef0a32a333490fff96262a6161d6c57022e27681fc8

Sharing

Copy URL Twitter E-mail

General

Target

36a8115347ae369af1b3aef0a32a333490fff96262a6161d6c57022e27681fc8
Size

115KB
MD5

a454fc3449860d26bb6d28e466255442
SHA1

ba3c87a6c9554a798c64e0eaec086b97818769ec
SHA256

36a8115347ae369af1b3aef0a32a333490fff96262a6161d6c57022e27681fc8
SHA512

d42ef45bc74ff03fb003e7415c58d78ccf97ba72086a396304f34189e8d5aa891b9953abf46a22f0f3631d059cf9d3da0c151cd7b9d123c86cbbdbc111ea312f
SSDEEP

3072:ysHa7HITQkrrM3MVbgb5hN8pPKRrckVPxIiTSvi:yV6rkKuN82mvi

Score

1^/10

Malware Config

Signatures

Files

36a8115347ae369af1b3aef0a32a333490fff96262a6161d6c57022e27681fc8
.dll windows x64

d7e73738c11c3cd4e55552f763e7d6fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCommandLineW
CreateFileW
GetFileSize
OutputDebugStringW
SetLastError
GetCurrentProcess
ExitProcess
FlushInstructionCache
GetSystemDirectoryW
VirtualProtectEx
CreateFileMappingW
MapViewOfFile
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
lstrcpyW
lstrcatW
K32GetModuleInformation
CloseHandle
GetLastError
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
VirtualProtect
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
MultiByteToWideChar
GetModuleHandleExW
FreeLibrary
RaiseException
EncodePointer
InterlockedFlushSList
RtlUnwindEx
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

user32

wsprintfW

shell32

ShellExecuteExW
CommandLineToArgvW

shlwapi

PathCanonicalizeW
PathRemoveFileSpecW

msvcrt

strcpy_s
abort
_errno
__pctype_func
tolower
___mb_cur_max_func
wcsnlen
wcstol
_mbtowc_l
__CppXcptFilter
__getmainargs
_initterm
?terminate@@YAXXZ
___lc_codepage_func
ceil
log10
_clearfp
memcpy
memcmp
memchr
_CxxThrowException
wcsstr
_callnewh
wcscmp
strcmp
malloc
free
_memicmp
_initterm_e
isspace
__DestructExceptionObject
__CxxFrameHandler3
_amsg_exit
__C_specific_handler
memmove
memset
strrchr

Exports

Exports

GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7e73738c11c3cd4e55552f763e7d6fa

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 83KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 308B

.reloc Size: 512B - Virtual size: 228B

.text
Size: 84KB - Virtual size: 83KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 308B

.reloc
Size: 512B - Virtual size: 228B