e59f8e5d4d1c086491c9813600b3f403cbaff44d3ba7fdfa351fc98882dab9dd

Sharing

Copy URL

Twitter E-mail

General

Target

e59f8e5d4d1c086491c9813600b3f403cbaff44d3ba7fdfa351fc98882dab9dd
Size

534KB
MD5

42a6a338fbea86ae2931925dba6c79f1
SHA1

bb7e80503a7ead40c70d44bc58879647272a0d46
SHA256

e59f8e5d4d1c086491c9813600b3f403cbaff44d3ba7fdfa351fc98882dab9dd
SHA512

85e2ca4dbbfee6a21f7a3834fe7cad82934cc8bd5d560c5f5387c327e99553b0b0e71fddf8eaff518523c89a8455eda9541ea6f1b795372e14ee554c4371b63c
SSDEEP

12288:op8FI+GOdHL7iHQJSUCzy6C7H5JoI2l1lIOEq4VBpF4:6Qr7iHQ0SNJF2flUR/F4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
e59f8e5d4d1c086491c9813600b3f403cbaff44d3ba7fdfa351fc98882dab9dd

Files

e59f8e5d4d1c086491c9813600b3f403cbaff44d3ba7fdfa351fc98882dab9dd
.exe windows:5 windows x86 arch:x86

296622fe6d93ca5407882b3ad42a3a64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\DC\_main\Output\Release\VssFreeze-XP.pdb

Imports

vssapi

?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z
ord6

kernel32

GetSystemTimeAsFileTime
CompareStringW
CompareStringA
GetLastError
GetVolumeNameForVolumeMountPointW
CloseHandle
CreateEventW
WideCharToMultiByte
GetVolumePathNamesForVolumeNameW
WriteFile
CreateFileW
GetVolumePathNameW
FindNextFileW
FindFirstFileW
GetFileAttributesW
QueryDosDeviceW
FindClose
GetTimeFormatW
GetDateFormatW
GetThreadLocale
FileTimeToSystemTime
FileTimeToLocalFileTime
DeleteFileW
GetModuleFileNameW
LocalFree
FormatMessageW
GetCommandLineW
WaitForSingleObject
SetEvent
CreateProcessW
ReadFile
GetFileSize
ExpandEnvironmentStringsW
GetProcessHeap
SetEndOfFile
CreateFileA
LoadLibraryA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
HeapFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
GetStringTypeW
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapAlloc
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
FlushFileBuffers
GetStringTypeA
GetModuleHandleA
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetTimeZoneInformation
HeapSize
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA

ole32

CLSIDFromString
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeSecurity

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

296622fe6d93ca5407882b3ad42a3a64

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vssapi

kernel32

ole32

oleaut32

Sections

.text Size: 303KB - Virtual size: 302KB

.rdata Size: 135KB - Virtual size: 135KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 74KB - Virtual size: 76KB

.text
Size: 303KB - Virtual size: 302KB

.rdata
Size: 135KB - Virtual size: 135KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 74KB - Virtual size: 76KB