Sample details: 39388bae8fb967f742cb56377707a334 --

Hashes
MD5: 39388bae8fb967f742cb56377707a334
SHA1: f4749853f9c2af26ce76aca83eed3de453556f89
SHA256: a2113b06fff9f3151989760e27d0896b5ace5f8757d8c898cbe1d3a4320be2ae
SSDEEP: 1536:M2gCIYF8Zo4DPsmkZEWfxqvqrggRD/PIEdwSTlx:QwiDHLU/xwSTlx
Details
File Type: data
Yara Hits
YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/contentis_base64 | YRP/DebuggerCheck__QueryInfo | YRP/disable_dep | YRP/win_token | YRP/CRC32_poly_Constant | YRP/MD5_Constants |
Strings
		eCriticalSection
tProcAddress
trcmpA
trlenA
itializeCriticalSection
trcpyA
tCurrentThreadId
rtualFree
rtualAlloc
tModuleHandleExW
eateNamedPipeW
ncelIo
tOverlappedResult
itNamedPipeW
iteFile
sconnectNamedPipe
ushFileBuffers
eateEventA
nnectNamedPipe
adFile
llNamedPipeW
eateFileW
stowcs
MapViewOfSection
QuerySection
OpenSection
lInitUnicodeString
QueryInformationProcess
SuspendProcess
ResumeProcess
SetInformationProcess
UnmapViewOfSection
ProtectVirtualMemory
stombs
lImageNtHeader
CreateSection
QueryInformationToken
OpenProcessToken
QueryValueKey
SetValueKey
CreateKey
OpenKey
tSystemTimeAsFileTime
tFilePointer
enProcess
sumeThread
itForMultipleObjects
tCurrentProcessId
ocessIdToSessionId
adLibraryW
adLibraryA
trcmpW
trcmpiA
tModuleFileNameW
C_specific_handler
D$"mF$8
T$@_^[
J%A<4nL
lTqVWI
jyBf)j"
UVWATAUAVAWH
A_A^A]A\_^]
L$@L!\$0L!\$XL!\$`L!\$pL!\$xA
WATAUH
0A]A\_
UVWATAUAVAWH
0A_A^A]A\_^]
E$<	T$ 
R`}Mu^
?A{;"Y}
2V"i6z
p7y$k,p
WATAUAVAWH
A_A^A]A\_
 LcY<A
@SUVWATAUAVAWH
8Lca<H
8A_A^A]A\_^][
x ATAUAVH
A^A]A\
SUVWATAUAVAWH
A_A^A]A\_^][
WATAUH
 A]A\_
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
8rLoau
8rGetu
A_A1B1%|1;*c
(d'?]k
A^A]A\
UVWATAUAVAWH
`A_A^A]A\_^]
VWATAUAWH
Y0H9;t
H9x(uLH
A_A]A\_^
L$ UVWATAUAVAWH
L!d$(H
G<307<
WATAUAVAWH
A_A^A]A\_
UVWATAUAVAWH
H!l$0L
PA_A^A]A\_^]
SUVWATAUAVAWH
|$0MZt
XA_A^A[A\_^][
x ATAUAVH
fD9abH
rQ7<Jb
`4c$E3!
AhH`& 
gsDtES,KX
C^J pe
K18#7o
pnyzoH
5QROM3JK
5<tb#H
3wHr#H
DL30ut>
yUAU	U
A$@2O$@
Y;VO3)
sg0r$P
elAh+ 
P!8b$(
}~HweA2
@HaX$He
%@Dva 
AiLDu+
t;sHKh
?Tk`5A
G=Y lC
L2}W_Q
TG?is$\H
!grN@;
'Ng{Z2
a+{b;A#=
%4v[rAE