c0b72720ea048f69d5b11be9b0588952b5c5769fbabada15366d4b2eb4e72e1b

Sharing

Copy URL

Twitter E-mail

General

Target

c0b72720ea048f69d5b11be9b0588952b5c5769fbabada15366d4b2eb4e72e1b
Size

561KB
MD5

d4685d647bdb784b300ba11cee5dff33
SHA1

64abd988fe2fcb7f4dd47fde166d580b1ca08224
SHA256

c0b72720ea048f69d5b11be9b0588952b5c5769fbabada15366d4b2eb4e72e1b
SHA512

7df9383d8bd5caec3c3fa690f8e3a0106854f527995dc9b9d6f8320eb023b4523af3aca0f4458d8b67e30e4b86eef709c146b99843ee1eba60566a84c9928f4b
SSDEEP

12288:GR83TbD2AYTX+FpUlqkdcpUwfCeUTkw3Ae7vEps:GG3/DVUt+esw3Ae7s

Score

N/A

Malware Config

Signatures

Files

c0b72720ea048f69d5b11be9b0588952b5c5769fbabada15366d4b2eb4e72e1b
.dll windows x86

3d800d346b1c95eb65f30c323cd853fc

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtectEx
CloseHandle
TlsAlloc
LoadLibraryA
Sleep
WaitForSingleObject
FindClose
GetEnvironmentVariableA
FindNextFileA
DeviceIoControl
TlsSetValue
CreateFileW
DecodePointer
EncodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetStringTypeW
CreateThread
WaitForSingleObjectEx
WriteConsoleW
OutputDebugStringW
OutputDebugStringA
WriteFile
HeapQueryInformation
HeapSize
HeapReAlloc
HeapFree
GetCommandLineW
GetCommandLineA
GetFileType
GetStdHandle
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
GetACP
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleFileNameA
GetSystemInfo
HeapValidate
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleExW
ExitProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsGetValue
InitializeCriticalSectionAndSpinCount
RaiseException
InterlockedFlushSList
GetModuleFileNameW
GetLastError
FindFirstFileA
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

advapi32

SystemFunction036
SetSecurityDescriptorDacl
SetEntriesInAclA
CreateServiceW
RegEnumKeyA
RegCloseKey
StartServiceCtrlDispatcherA
QueryServiceStatus
RegDeleteKeyA
RegQueryValueExA
AllocateAndInitializeSid
LookupPrivilegeValueA
SetServiceStatus
OpenServiceA
OpenThreadToken
RegOpenKeyExA
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
RegSetValueExA
ControlService
RegCreateKeyExA
OpenSCManagerA
RegisterServiceCtrlHandlerA

mprapi

MprAdminInterfaceTransportGetInfo
MprConfigServerGetInfo
MprConfigInterfaceGetInfo
MprConfigServerInstall
MprAdminTransportSetInfo
MprAdminIsServiceRunning
MprAdminInterfaceDelete
MprConfigBufferFree
MprAdminInterfaceSetInfo
MprInfoBlockSet
MprAdminMIBEntryGetNext
MprAdminMIBEntryGetFirst
MprAdminInterfaceDeviceGetInfo
MprConfigInterfaceDelete
MprConfigInterfaceGetHandle
MprAdminMIBEntryCreate
MprAdminMIBEntrySet
MprAdminMIBBufferFree
MprConfigServerBackup
MprAdminInterfaceGetCredentialsEx
MprConfigInterfaceTransportSetInfo
MprConfigTransportDelete
MprAdminInterfaceQueryUpdateResult
MprConfigServerRestore
MprConfigGetFriendlyName
MprAdminTransportGetInfo
MprAdminPortEnum
MprAdminUserSetInfo
MprAdminMIBEntryGet
MprAdminPortDisconnect
MprInfoBlockQuerySize
MprInfoDelete
MprInfoCreate
MprAdminUserGetInfo
MprAdminServerGetInfo
MprInfoBlockFind
MprAdminServerGetCredentials
MprAdminServerDisconnect
MprAdminInterfaceDeviceSetInfo
MprConfigInterfaceTransportAdd
MprInfoBlockRemove
MprAdminInterfaceSetCredentials
MprAdminServerSetCredentials
MprConfigInterfaceTransportEnum
MprConfigServerRefresh
MprConfigGetGuidName
MprAdminInterfaceGetInfo
MprAdminSendUserMessage
MprConfigTransportCreate
MprAdminTransportCreate
MprAdminRegisterConnectionNotification
MprAdminGetPDCServer
MprConfigTransportGetInfo
MprAdminPortClearStats
MprConfigTransportEnum
MprAdminInterfaceGetCredentials
MprConfigInterfaceTransportGetInfo
MprAdminInterfaceConnect
MprAdminPortGetInfo
MprAdminPortReset
MprAdminMIBServerConnect
MprConfigInterfaceSetInfo
MprAdminGetErrorString
MprAdminInterfaceTransportAdd
MprConfigInterfaceTransportRemove
MprAdminInterfaceEnum
MprAdminInterfaceDisconnect
MprInfoDuplicate
MprInfoBlockAdd
MprConfigServerConnect
MprAdminDeregisterConnectionNotification
MprAdminInterfaceSetCredentialsEx
MprAdminDeviceEnum
MprConfigTransportSetInfo
MprAdminInterfaceTransportSetInfo
MprConfigTransportGetHandle
MprAdminInterfaceUpdatePhonebookInfo
MprAdminServerConnect
MprConfigInterfaceTransportGetHandle
MprAdminInterfaceGetHandle
MprConfigInterfaceCreate
MprConfigInterfaceEnum
MprAdminInterfaceTransportRemove
MprAdminConnectionGetInfo
MprAdminMIBServerDisconnect
MprConfigServerDisconnect
MprAdminInterfaceCreate
MprAdminInterfaceUpdateRoutes
MprAdminMIBEntryDelete

Sections

.text
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d800d346b1c95eb65f30c323cd853fc

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

mprapi

Sections

.text Size: 302KB - Virtual size: 301KB

.rdata Size: 189KB - Virtual size: 188KB

.data Size: 55KB - Virtual size: 165KB

.gfids Size: 512B - Virtual size: 248B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 302KB - Virtual size: 301KB

.rdata
Size: 189KB - Virtual size: 188KB

.data
Size: 55KB - Virtual size: 165KB

.gfids
Size: 512B - Virtual size: 248B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB