tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

76KB
MD5

70f7d4806f949550ba5ac0afec9c042f
SHA1

b7a53f5f90a5b78e8663e7372dfa61517d57d72d
SHA256

6e118b779673183850a0acb474efa30bc4e91d47925aee5311364112d660e4ee
SHA512

db915bbc0c5938814b767963d443a2d4110ea594619a91052d4bb17020779868c65ce8c1aa7a0e7e574dc14c2fa1066810ba083bff1f832cba51c06efbb4f963
SSDEEP

1536:0U+3fBeGLOU6p+YA4/e3YGfti+kbZX/MXH/wuFsaw+NhQ:RoH6tAeeBY+kbp0XH/3G

Score

1^/10

Malware Config

Signatures

Files

tmp
.exe windows x64

e23d0d255881589fa1c2d3899d8c2c34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids

kernel32

WaitForSingleObject
CreateThread
CreateEventW
Sleep
RaiseException
GetCurrentThreadId
SetEvent
GetCommandLineW
CompareStringW
CloseHandle
CreateProcessW
GetCurrentProcessId
MultiByteToWideChar
GetModuleHandleExA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetModuleFileNameW
FindResourceExW
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
LoadResource
SizeofResource
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
OutputDebugStringA

user32

CharNextW
PostThreadMessageW
CharUpperW
GetMessageW
TranslateMessage
UnregisterClassA
DispatchMessageW
AllowSetForegroundWindow

msvcrt

exit
_exit
_cexit
__setusermatherr
_initterm
_wcmdln
_fmode
_commode
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_errno
realloc
_lock
memcmp
_unlock
__dllonexit
_onexit
??3@YAXPEAX@Z
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
wcscat_s
wcscpy_s
_purecall
memcpy_s
malloc
wcsncpy_s
free
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler3
memset

ole32

CoRegisterClassObject
StringFromGUID2
CoInitialize
CoUninitialize
CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc

oleaut32

SafeArrayGetLBound
SafeArrayDestroy
SafeArrayCreate
SafeArrayUnlock
SafeArrayLock
SysFreeString
VarUI4FromStr
SysStringLen
SysStringByteLen
LoadRegTypeLi
UnRegisterTypeLi
LoadTypeLi
SafeArrayGetUBound
SysAllocString
RegisterTypeLi

shlwapi

PathFindFileNameW

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e23d0d255881589fa1c2d3899d8c2c34

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

shlwapi

ntdll

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 1024B - Virtual size: 924B

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 1024B - Virtual size: 924B