c063a76a712bfff6e0ef6ffd8596fc6712a2ad8a0e5cb0baabe2eba0ae349e3c

Sharing

Copy URL Twitter E-mail

General

Target

c063a76a712bfff6e0ef6ffd8596fc6712a2ad8a0e5cb0baabe2eba0ae349e3c
Size

95KB
MD5

533d2644c92fe3fbbb1f3775a0643078
SHA1

a2ff8425c16860a064d354f9cfb43b075b4c52f6
SHA256

c063a76a712bfff6e0ef6ffd8596fc6712a2ad8a0e5cb0baabe2eba0ae349e3c
SHA512

ef948f1b21087ab8809e63a75fed8bd6c558f528d6b05e8760100238c486c198e09879d283c3a80854dad68070b15c879c8d95f192501fa84c179a54b13224da
SSDEEP

1536:fjIFH7PPJ/vz7ozMvTQw/bKJOtfGD7ckw9fI+4b6A7xKonsLcXxaYKjwC5:fjORHo6/PtackYf5+B9KJwduh

Score

N/A

Malware Config

Signatures

Files

c063a76a712bfff6e0ef6ffd8596fc6712a2ad8a0e5cb0baabe2eba0ae349e3c
.dll windows x86

8a01344d862953e94bf4049cf11af6b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

UpdateWindow
wvsprintfA
SetProgmanWindow
WINNLSGetIMEHotkey
GetGuiResources
SetWindowRgn
GetRawInputBuffer
DisplayExitWindowsWarnings
SetMenuItemInfoW
SetWindowsHookA
DrawAnimatedRects
GetMenuItemInfoA
DlgDirSelectExA
SystemParametersInfoA
GrayStringA
CharPrevW
GetLastInputInfo
FreeDDElParam
CallMsgFilterW
ClipCursor
IsWinEventHookInstalled
CascadeWindows
CallWindowProcW
EnableMenuItem
WindowFromPoint
CreateCursor
DlgDirListA
SetForegroundWindow
UnhookWindowsHookEx
DdeClientTransaction
SetClipboardViewer
DdeAccessData
GetKeyState
LockWindowUpdate
SendMessageW
OemToCharBuffW
BuildReasonArray

ifsutil

?AddVolumeName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
??0TLINK@@QAE@XZ
?QueryCanonicalNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?AddNext@NUMBER_SET@@QAEEVBIG_INT@@@Z
?Add@NUMBER_SET@@QAEEPBV1@@Z
?AddEdge@DIGRAPH@@QAEEKK@Z
??1MOUNT_POINT_MAP@@UAE@XZ
??0DIGRAPH@@QAE@XZ
?Set@BIG_INT@@QAEXEPBE@Z
?DeleteEntry@AUTOREG@@SGEPBVWSTRING@@E@Z
??0VOL_LIODPDRV@@IAE@XZ
?SetCache@IO_DP_DRIVE@@QAEXPAVDRIVE_CACHE@@@Z
?RemoveEdge@DIGRAPH@@QAEEKK@Z
??0SPARSE_SET@@QAE@XZ
??1CANNED_SECURITY@@UAE@XZ
?SetVolumeLabelAndPrintFormatReport@VOL_LIODPDRV@@QAEEPBVWSTRING@@PAVMESSAGE@@@Z
??1INTSTACK@@UAE@XZ
?QueryContainingRange@NUMBER_SET@@QBEEVBIG_INT@@PAV2@1@Z
?GetDrive@SECRUN@@QAEPAVIO_DP_DRIVE@@XZ
?EnableVolumeUpgrade@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
?GetBuffer@TLINK@@QAEPAXPAX@Z
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@0PAVMESSAGE@@EE@Z
?AddDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?QueryMediaByte@DP_DRIVE@@QBEEXZ
?Read@SECRUN@@UAEEXZ
??1VOL_LIODPDRV@@UAE@XZ
?QueryVolumeName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?Initialize@SPARSE_SET@@QAEEXZ
?QueryCompressedInteger@BIG_INT@@QBEXPAE0@Z
?Initialize@READ_WRITE_CACHE@@QAEEPAVIO_DP_DRIVE@@K@Z
?CheckValidSecurityDescriptor@IFS_SYSTEM@@SGEKPAU_SECURITY_DESCRIPTOR@@@Z
?Read@IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?InvalidateVolume@IO_DP_DRIVE@@QAEEXZ
?QueryDisjointRangeAndAssignBuffer@TLINK@@QAEPAXPAVBIG_INT@@PAG1PAXK2@Z
?SendSonyMSRequestSenseCmd@DP_DRIVE@@QAEEPAU_SENSE_DATA@@@Z
??0READ_WRITE_CACHE@@QAE@XZ
?GetMessageW@IO_DP_DRIVE@@QAEPAVMESSAGE@@XZ
?PushEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?GetAt@MOUNT_POINT_MAP@@QAEEKPAVWSTRING@@0@Z

netapi32

NetServiceEnum
I_NetLogonControl
NetReplExportDirAdd
NetServerComputerNameAdd
NetpwNameCanonicalize
NetUserGetGroups
I_NetServerPasswordSet
RxNetAccessGetUserPerms
NetWkstaTransportAdd
I_NetAccountSync
NetReplExportDirGetInfo
NetApiBufferReallocate
DsGetForestTrustInformationW
NetFileEnum
NetServiceControl
NetUseEnum
NetShareGetInfo
NetBrowserStatisticsGet
NetLocalGroupDel
NetpCopyFtinfoContext
I_NetDatabaseSync2
NlBindingRemoveServerFromCache
RxNetAccessGetInfo
I_NetServerGetTrustInfo
DsRoleGetDatabaseFacts
NetDfsGetDcAddress
NetGroupSetInfo
NetUserGetInfo
DsGetDcNextW
I_NetServerSetServiceBitsEx
NetGetDisplayInformationIndex
NetAuditRead
NetErrorLogWrite
I_NetGetForestTrustInformation
DsRoleGetPrimaryDomainInformation
NetRenameMachineInDomain
I_NetServerPasswordGet
NetDfsSetClientInfo
NetRemoveAlternateComputerName
NetWkstaUserGetInfo
NetReplGetInfo
DsGetDcOpenW
DsRoleGetDcOperationProgress

mfcsubs

?Append@CStringArray@@QAEHABV1@@Z
??8@YG_NABVCString@@0@Z
?AllocBeforeWrite@CString@@IAEXH@Z
?Lookup@CMapStringToPtr@@QBEHPBGAAPAX@Z
?SpanExcluding@CString@@QBE?AV1@PBG@Z
?Add@CStringArray@@QAEHPBG@Z
??H@YG?AVCString@@PBGABV0@@Z
??0CString@@QAE@PBG@Z
?Lock@CCriticalSection@@UAEHK@Z
??0CCriticalSection@@QAE@XZ
?MakeLower@CString@@QAEXXZ
?TrimRight@CString@@QAEXXZ
??1CCriticalSection@@UAE@XZ
?Empty@CString@@QAEXXZ
?AfxW2AHelper@@YGPADPADPBGH@Z
??9@YG_NABVCString@@PBG@Z
?AssignCopy@CString@@IAEXHPBG@Z
??0CString@@QAE@PBGH@Z
?data@CPlex@@QAEPAXXZ
??4CString@@QAEABV0@D@Z
??P@YG_NPBGABVCString@@@Z
??N@YG_NPBGABVCString@@@Z
?Collate@CString@@QBEHPBG@Z
??0CStringArray@@QAE@XZ
??YCString@@QAEABV0@G@Z
??4CString@@QAEABV0@ABV0@@Z
??ACStringArray@@QAEAAVCString@@H@Z
??_FCMapStringToPtr@@QAEXXZ
??8@YG_NPBGABVCString@@@Z
?GetStartPosition@CMapStringToPtr@@QBEPAU__POSITION@@XZ
??N@YG_NABVCString@@PBG@Z
?LoadStringW@CString@@QAEHI@Z
?Create@CPlex@@SGPAU1@AAPAU1@II@Z
??0CObject@@IAE@XZ
??4CString@@QAEABV0@PBG@Z
?Lock@CSyncObject@@UAEHK@Z
??_7CCriticalSection@@6B@
??P@YG_NABVCString@@0@Z
?GetUpperBound@CStringArray@@QBEHXZ
?IsEmpty@CString@@QBEHXZ
??N@YG_NABVCString@@0@Z
??_7CObject@@6B@

usp10

ScriptStringGetOrder
ScriptBreak
UspFreeMem
ScriptXtoCP
ScriptString_pcOutChars
LpkPresent
ScriptGetCMap
ScriptStringOut
ScriptGetGlyphABCWidth
ScriptGetProperties
ScriptPlace
ScriptCacheGetHeight
ScriptIsComplex
UspAllocCache
ScriptLayout
ScriptGetFontProperties
ScriptGetLogicalWidths
ScriptFreeCache
ScriptJustify
ScriptStringXtoCP
ScriptStringValidate
UspAllocTemp
ScriptString_pLogAttr
ScriptRecordDigitSubstitution
ScriptApplyDigitSubstitution
ScriptString_pSize
ScriptStringAnalyse
ScriptShape
ScriptStringGetLogicalWidths
ScriptItemize
ScriptTextOut
ScriptStringCPtoX
ScriptCPtoX
ScriptApplyLogicalWidth

kernel32

SetEnvironmentVariableA
SetFileValidData
FreeLibrary
EnumDateFormatsExW
SetThreadPriority
LCMapStringA
DebugSetProcessKillOnExit
GetConsoleFontSize
CreateMailslotA
SetTapeParameters
IsBadHugeReadPtr
DosDateTimeToFileTime
GetCommModemStatus
WritePrivateProfileSectionA
GetConsoleAliasExesW
VerifyVersionInfoA
CopyLZFile
DeviceIoControl
RtlCaptureContext
LoadLibraryA
GetCurrentThread
TransactNamedPipe
GetPrivateProfileIntW
GetStringTypeExW
GetNextVDMCommand
GlobalAlloc
QueryPerformanceFrequency
SetConsoleDisplayMode
FindFirstFileA
VirtualAlloc
GetCommConfig
GetConsoleFontInfo
SetCriticalSectionSpinCount
GlobalMemoryStatusEx
GetSystemPowerStatus
WaitForMultipleObjectsEx
GetLocaleInfoA
ReadConsoleOutputCharacterA
GetModuleHandleA
GetUserDefaultLCID

iassdo

DllGetClassObject

Exports

Exports

InstallU
PluginCommand
PluginMain
PluginName
PluginType
PluginVersion
WSPStartup

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a01344d862953e94bf4049cf11af6b2

Headers

File Characteristics

Imports

user32

ifsutil

netapi32

mfcsubs

usp10

kernel32

iassdo

Exports

Exports

Sections

.text Size: 37KB - Virtual size: 37KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 37KB - Virtual size: 112KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 792B

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 37KB - Virtual size: 112KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 792B