sodinokibi | 2024-06-01_2d9904f11a1bc47a88e07d7b82abdfb5_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-01_2d9904f11a1bc47a88e07d7b82abdfb5_revil
Size

421KB
MD5

2d9904f11a1bc47a88e07d7b82abdfb5
SHA1

9ab04299df961348b74a1bfbf297ede32d78c202
SHA256

6eb063dbb7ec35e8a05b9f7972ee3b0bf01b80a0658074dde98ce4c1f108526c
SHA512

3b27a8688c5e38d57911698cdd52173cb73021d68922cb44ddf7b5fb37e4dd92c00d852fe1750f75c284cf5bc2233049079dc724d37bf115dad4fb99f0536e38
SSDEEP

3072:TFrOdhfkQlnjrAprhFmyvEjQDKaUznxQaCyZ0SSxXNFIlW5cmuW2Eyv4miKIbeAx:JadFkaAhFjED39Y3NiWWLb9N5

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-01_2d9904f11a1bc47a88e07d7b82abdfb5_revil

Files

2024-06-01_2d9904f11a1bc47a88e07d7b82abdfb5_revil
.exe windows:5 windows x86 arch:x86

f5ef0afbffbb50f7929990243e2b1eb6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode

msacm32

acmStreamOpen

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

msvcr110

vsprintf
exp

api-ms-win-core-localization-l1-2-0

GetCPInfo

msvbvm60

ProcCallEngine

ntdll

RtlCreateActivationContext

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

version

GetFileVersionInfoA

cmutil

CmStrCpyAllocA

api-ms-win-core-console-l1-1-0

GetNumberOfConsoleInputEvents

netman

HrLanConnectionNameFromGuidOrPath

msls31

LssbGetNumberDnodesInSubline

msnetobj

DllRegisterServer

hlink

HlinkResolveStringForData

spp

SxTracerGetThreadContextRetail

w32topl

ToplSTHeapDestroy
ToplScheduleCacheDestroy

dui70

EnableAnimations

syssetup

AsrAddSifEntryW

clusapi

FailClusterResource
CreateClusterNotifyPort
ClusterNodeControl

iertutil

RevertImpersonate

iassvcs

IASVariantChangeType

loadperf

UpdatePerfNameFilesA

ir50_qc

FreeInstanceData

scecli

SceGenerateRollback
SceCloseProfile

spoolss

ReplyPrinterChangeNotification

rtutils

RouterLogDeregisterA

ndfapi

NdfCloseIncident

wer

WerpGetReportConsent

duser

GetStdColorI

nsi

NsiGetParameter

wininet

GetUrlCacheEntryInfoA

wship6

WSHGetWildcardSockaddr

api-ms-win-crt-string-l1-1-0

wcsspn

wiaservc

wiasGetRootItem

secur32

GetUserNameExW
LsaEnumerateLogonSessions

oleacc

CreateStdAccessibleObject

api-ms-win-crt-runtime-l1-1-0

signal

pdh

PdhCollectQueryData
PdhGetFormattedCounterValue

psapi

EnumProcessModules

odbc32

VFreeErrors

powrprof

PowerSetActiveScheme

sysntfy

SysNotifyStartServer

api-ms-win-core-namedpipe-l1-1-0

GetNamedPipeClientComputerNameW

lpk

LpkUseGDIWidthCache

msvcrt

rename

urlmon

HlinkNavigateString

sspisrv

SspiSrvClientCallback

winhttp

WinHttpSetTimeouts

api-ms-win-crt-stdio-l1-1-0

fputs

ntmarta

AccProvGetAccessInfoPerObjectType

polstore

IPSecGetFilterData

eappprxy

EapHostPeerGetAuthStatus

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext

ncrypt

BCryptDestroyHash

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW

crtdll

vsprintf

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

imm32

ImmRequestMessageA

crypt32

CryptHashCertificate

api-ms-win-service-core-l1-1-0

SetServiceStatus

onex

OneXRestartReasonCodeToString

mprapi

MprAdminUserReadProfFlags

netapi32

NetGroupGetUsers

ole32

StgOpenStorageOnILockBytes

advapi32

InitializeSecurityDescriptor

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.z2iai
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.l1
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f5ef0afbffbb50f7929990243e2b1eb6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msacm32

api-ms-win-core-util-l1-1-0

msvcr110

api-ms-win-core-localization-l1-2-0

msvbvm60

ntdll

api-ms-win-core-string-l1-1-0

api-ms-win-core-timezone-l1-1-0

version

cmutil

api-ms-win-core-console-l1-1-0

netman

msls31

msnetobj

hlink

spp

w32topl

dui70

syssetup

clusapi

iertutil

iassvcs

loadperf

ir50_qc

scecli

spoolss

rtutils

ndfapi

wer

duser

nsi

wininet

wship6

api-ms-win-crt-string-l1-1-0

wiaservc

secur32

oleacc

api-ms-win-crt-runtime-l1-1-0

pdh

psapi

odbc32

powrprof

sysntfy

api-ms-win-core-namedpipe-l1-1-0

lpk

msvcrt

urlmon

sspisrv

winhttp

api-ms-win-crt-stdio-l1-1-0

ntmarta

polstore

eappprxy

api-ms-win-core-rtlsupport-l1-1-0

ncrypt

api-ms-win-crt-heap-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

crtdll

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-debug-l1-1-0

imm32

crypt32

api-ms-win-service-core-l1-1-0

onex

mprapi

netapi32

ole32

advapi32

Sections

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 57KB - Virtual size: 58KB

.z2iai
Size: 50KB - Virtual size: 50KB

.reloc
Size: 1KB - Virtual size: 1KB

.l1
Size: 512B - Virtual size: 512B

.l1
Size: 512B - Virtual size: 512B

.l1
Size: 512B - Virtual size: 512B

.l1
Size: 512B - Virtual size: 512B

.l1
Size: 512B - Virtual size: 512B

.l1
Size: 1024B - Virtual size: 1024B

.l1
Size: 1024B - Virtual size: 1024B

.l1
Size: 1024B - Virtual size: 1024B

.l1
Size: 1024B - Virtual size: 1024B

.l1
Size: 1024B - Virtual size: 1024B

.l1
Size: 1024B - Virtual size: 1024B

.l1
Size: 1KB - Virtual size: 1KB

.l1
Size: 1KB - Virtual size: 1KB

.l1
Size: 1KB - Virtual size: 1KB

.l1
Size: 1KB - Virtual size: 1KB

.l1
Size: 1KB - Virtual size: 1KB

.l1
Size: 1KB - Virtual size: 1KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 2KB - Virtual size: 2KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 3KB - Virtual size: 3KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB