af332fa64963ff22e01b7eb5912f6ecc463dc30406fdab0e833713bc1cfe0565

Sharing

Copy URL

Twitter E-mail

General

Target

af332fa64963ff22e01b7eb5912f6ecc463dc30406fdab0e833713bc1cfe0565
Size

707KB
MD5

6f22fd11d80940a6e05054d72c53a120
SHA1

4db450825f0f9d818fd1fd9f0c7f6364004460f8
SHA256

af332fa64963ff22e01b7eb5912f6ecc463dc30406fdab0e833713bc1cfe0565
SHA512

fbbc38f4b50dcbe1c88ea206dbae95ddaf76496fdfafcbc1dbacc2f7327bafae3727827657b6b5f91188180c7e34dd886c6f918c09e7e7c9a9d425dd0cad117f
SSDEEP

12288:fsLuTI8YYFcOA83kDKAD416pLVz98mC/93dhq/7570oHm+sogG81l2kpZNukklro:fsLudYYFcrZOAD416pLn8mC/ddhq/75Y

Score

N/A

Malware Config

Signatures

Files

af332fa64963ff22e01b7eb5912f6ecc463dc30406fdab0e833713bc1cfe0565
.dll windows x64

69a2919d6b79378da2a754bc322a0398

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wcsicmp
_purecall
wcschr
memmove
_wtoi
towupper
wcsstr
_wcsnicmp
_vsnwprintf
_stricmp
malloc
_initterm
free
atoi
__C_specific_handler
_unlock
__dllonexit
_lock
_onexit
memset
_vsnprintf
_ultoa
memcmp
wcscpy_s
memcpy
strncmp
_ultow
_amsg_exit
_XcptFilter
ceil

rpcrt4

RpcServerUnregisterIf
RpcServerInqCallAttributesW
NdrClientCall3
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
RpcAsyncAbortCall
NdrAsyncServerCall
Ndr64AsyncServerCallAll
UuidToStringW
I_RpcBindingInqSecurityContextKeyInfo
Ndr64AsyncClientCall
UuidIsNil
I_RpcGetPortAllocationData
I_RpcServerInqLocalConnAddress
I_RpcBindingIsClientLocal
I_RpcServerInqRemoteConnAddress
TowerExplode
NdrServerCallAll
I_RpcServerRegisterForwardFunction
RpcServerRegisterIf2
I_RpcExceptionFilter
I_RpcServerSetAddressChangeFn
I_RpcSystemFunction001
NdrClientCall2
NdrServerCall2
RpcRaiseException
NdrAsyncClientCall
MesEncodeFixedBufferHandleCreate
MesDecodeBufferHandleCreate
MesHandleFree
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeEncode2
RpcErrorGetNextRecord
RpcErrorEndEnumeration
RpcErrorResetEnumeration
RpcErrorStartEnumeration
RpcErrorSaveErrorInfo
RpcStringBindingComposeW
RpcMgmtSetServerStackSize
I_RpcFwThisIsTheManager
I_RpcAllocate
I_RpcFree
RpcMgmtIsServerListening
RpcServerListen
RpcServerUseProtseqEpExW
RpcMgmtEnableIdleCleanup
I_RpcFilterDCOMActivation
RpcRevertToSelf
RpcBindingServerFromClient
RpcBindingUnbind
RpcBindingBind
RpcBindingCreateW
RpcBindingSetObject
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcServerRegisterAuthInfoW
RpcStringFreeW
RpcStringBindingParseW
RpcBindingToStringBindingW
RpcBindingVectorFree
I_RpcServerCheckClientRestriction
RpcServerInqBindings
RpcRevertToSelfEx
I_RpcBindingInqMarshalledTargetInfo
I_RpcBindingInqWireIdForSnego
RpcBindingSetOption
RpcImpersonateClient
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
UuidCreate
RpcBindingSetAuthInfoW
RpcBindingSetAuthInfoExW
RpcBindingReset
RpcServerRegisterIfEx
RpcBindingFree
RpcBindingCopy

advapi32

LsaClose
EventWrite
DuplicateToken
GetUserNameW
StartServiceW
CreateProcessAsUserW
ImpersonateLoggedOnUser
CheckTokenMembership
RegSetValueExW
DuplicateTokenEx
LsaFreeMemory
LogonUserExExW
LsaRetrievePrivateData
LsaOpenPolicy
SetTokenInformation
A_SHAFinal
A_SHAUpdate
A_SHAInit
LookupAccountNameW
TraceMessage
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
AddAccessAllowedAce
FreeSid
RegOpenKeyExW
EventRegister
GetLengthSid
RegCloseKey
RegisterServiceCtrlHandlerExW
AllocateLocallyUniqueId
SetServiceStatus
AccessCheck
GetSecurityDescriptorLength
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
ControlService
CloseServiceHandle
QueryServiceStatusEx
OpenServiceW
SaferCloseLevel
SaferComputeTokenFromLevel
SaferCreateLevel
GetSecurityDescriptorDacl
ConvertSidToStringSidW
IsValidSecurityDescriptor
ReportEventW
RegGetValueW
LookupAccountSidW
GetAce
DeregisterEventSource
RegisterEventSourceW
RegQueryValueW
RegLoadMUIStringW
CommandLineFromMsiDescriptor
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegOpenKeyExA
RegQueryValueExA
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceLoggerHandle
GetTraceEnableFlags
SaferiCompareTokenLevels
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
SetThreadToken
RegOpenUserClassesRoot
RevertToSelf
ImpersonateAnonymousToken
EqualSid
CopySid
GetTokenInformation
OpenThreadToken
RegEnumValueW
RegQueryInfoKeyW
RegNotifyChangeKeyValue
IsValidSid
CreateWellKnownSid
QueryServiceStatus
EventEnabled

kernel32

GetSystemWow64DirectoryW
GetSystemDirectoryW
SearchPathW
CreateFileMappingW
OpenFileMappingW
InitializeCriticalSectionAndSpinCount
UnmapViewOfFile
MapViewOfFile
SwitchToThread
InterlockedPushEntrySList
ResetEvent
InterlockedPopEntrySList
GetModuleHandleW
LoadLibraryExW
FindActCtxSectionGuid
ReleaseActCtx
FindActCtxSectionStringW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
InitializeSRWLock
AcquireSRWLockShared
AddRefActCtx
GetDriveTypeW
TlsSetValue
OpenProcess
InitializeCriticalSection
IsWow64Process
GetComputerNameExW
OpenEventW
ExpandEnvironmentStringsW
GetVersionExW
WaitForMultipleObjects
GetExitCodeProcess
CompareFileTime
CheckElevationEnabled
GetFullPathNameW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
LoadLibraryA
GetProcAddress
FreeLibrary
TlsAlloc
GetDiskFreeSpaceA
GetLastError
Sleep
QueryPerformanceCounter
GlobalMemoryStatus
GetComputerNameA
lstrcmpW
GetProcessHeap
HeapFree
HeapAlloc
CreateMutexW
SetThreadpoolWait
CreateThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CloseThreadpool
CreateThreadpoolWait
DuplicateHandle
OpenThread
GetProcessIdOfThread
ReleaseMutex
FindFirstFileW
FindClose
UnregisterWait
CompareStringA
MapViewOfFileEx
VirtualFree
GetModuleHandleExW
DelayLoadFailureHook
CreateFileW
SetLastError
LocalAlloc
DeviceIoControl
CloseHandle
LocalFree
VirtualQuery
VirtualAlloc
GetSystemInfo
VirtualProtect
SetThreadStackGuarantee
CreateThread
SleepEx
lstrlenW
RegisterWaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
CreateEventW
SetEvent
WaitForSingleObject
QueueUserWorkItem
CompareStringW
GetCurrentThread
DeleteTimerQueueTimer
CreateTimerQueueTimer
GetModuleFileNameW
DeleteCriticalSection
TlsGetValue
InitializeSListHead

ntdll

RtlIntegerToUnicodeString
DbgPrintEx
NtQueryDirectoryObject
NtOpenDirectoryObject
NtOpenSection
RtlGetNtProductType
WinSqmIsOptedIn
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
NtQueryMutant
RtlOemStringToUnicodeString
RtlInitAnsiString
NtDuplicateToken
RtlUpcaseUnicodeString
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
NtAllocateLocallyUniqueId
RtlAllocateAndInitializeSid
WinSqmEventWrite
WinSqmEventEnabled
NtClose
NtQueryInformationFile
RtlFreeUnicodeString
RtlCreateUnicodeString
RtlLengthSid
RtlGetSaclSecurityDescriptor
RtlCopySid
NtOpenKey
NtQueryKey
DbgPrint
RtlInitializeCriticalSectionAndSpinCount
NtQuerySystemInformation
NtQueryInformationToken
NtCompareTokens
RtlEqualSid
RtlDeleteCriticalSection
RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap
NtOpenFile
RtlNtStatusToDosError
RtlInitializeCriticalSection
NtSetUuidSeed
RtlEqualUnicodeString
RtlInitUnicodeString

ws2_32

WSASocketW
WSAGetLastError
WSAIoctl
WSAAddressToStringW
WSAEnumProtocolsW

secur32

FreeContextBuffer
EnumerateSecurityPackagesW

firewallapi

FWIndicatePortInUse
FWResetIndicatedPortInUse

Exports

Exports

CoGetComCatalog
GetRPCSSInfo
ServiceMain
WhichService

Sections

.text
Size: 446KB - Virtual size: 446KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69a2919d6b79378da2a754bc322a0398

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

rpcrt4

advapi32

kernel32

ntdll

ws2_32

secur32

firewallapi

Exports

Exports

Sections

.text Size: 446KB - Virtual size: 446KB

.rdata Size: 79KB - Virtual size: 79KB

.data Size: 146KB - Virtual size: 146KB

.pdata Size: 24KB - Virtual size: 24KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 446KB - Virtual size: 446KB

.rdata
Size: 79KB - Virtual size: 79KB

.data
Size: 146KB - Virtual size: 146KB

.pdata
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 3KB - Virtual size: 3KB