97b0c193dd5576ea56f16869dc9a7709f7d96fba8b74011b9042f6657e5662a9

Sharing

Copy URL Twitter E-mail

General

Target

97b0c193dd5576ea56f16869dc9a7709f7d96fba8b74011b9042f6657e5662a9
Size

874KB
MD5

6013fbe046b77bdcda3cd3bf80ed7340
SHA1

607e55416256ffb6cf9f3cd0110f7a869ab03977
SHA256

97b0c193dd5576ea56f16869dc9a7709f7d96fba8b74011b9042f6657e5662a9
SHA512

9ce90839357c542d23be10459d1708a4fb6bb3e348270e34074929dd9f3a355c4e58623740661840a1d44bb270b4b9870d3d3b4f6de90ddac3e31d1707ef7de6
SSDEEP

24576:NN3WC3CLTpzX1ZU41i1+7cQQumXz8TPPec8RtghO:NNGjTpH12+8umD6MEhO

Score

N/A

Malware Config

Signatures

Files

97b0c193dd5576ea56f16869dc9a7709f7d96fba8b74011b9042f6657e5662a9
.exe windows x86

3069c56da298a7318b65e6ea7e3709aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mshtml

CreateHTMLPropertyPage
ShowModelessHTMLDialog

msdart

?IsWriteUnlocked@CSpinLock@@QBE_NXZ
?ReadLock@CReaderWriterLock3@@QAEXXZ
?IsWin9x@CMdVersionInfo@@SAHXZ
??1CReaderWriterLock2@@QAE@XZ
?ReadLock@CFakeLock@@QAEXXZ
?First@CLockedDoubleList@@QAEQAVCListEntry@@XZ
?NumSubTables@CLKRLinearHashTable@@QBEHXZ
?IsWinNT@CMdVersionInfo@@SAHXZ
?ReadOrWriteLock@CSpinLock@@QAE_NXZ
?ReadLock@CLKRLinearHashTable@@QBEXXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SGNXZ
?GetSpinCount@CSmallSpinLock@@QBEGXZ
?IsLocked@CLockedDoubleList@@QBE_NXZ
?SetSpinCount@CCritSec@@SGKPAPAVCCriticalSection@@K@Z
??4CSpinLock@@QAEAAV0@ABV0@@Z
?_InsertThisIntoGlobalList@CLKRLinearHashTable@@AAEXXZ
?FindKey@CLKRLinearHashTable@@QBE?AW4LK_RETCODE@@KPAPBX@Z
FXMemAttach
?sm_wDefaultSpinCount@CReaderWriterLock3@@1GA

rasman

RasBundleClearStatisticsEx
RasGetUnicodeDeviceName
RasSetCachedCredentials
RasRpcGetErrorString
RasRegisterPnPEvent
RasSetPortUserData
RasPortGetStatistics
RasSecurityDialogGetInfo
RasPortReceiveEx
RasSetKey
RasRegisterRedialCallback
RasRPCBind
RasRegisterPnPHandler
RasEnableIpSec
RasGetInfo
RasPortSetProtocolCompression
RasPortReserve
RasConnectionEnum
RasDeviceGetInfo
RasPortSetFraming
RasGetCalledIdInfo
RasPortListen
RasGetKey
RasPortGetFramingEx
RasSetDialParams
RasBundleClearStatistics
RasStartRasAutoIfRequired

mapistub

MAPISendDocuments
BMAPISendMail
WrapCompressedRTFStream
ScCopyProps@16
MAPIResolveName
ChangeIdleRoutine@28
MAPIAllocateBuffer@8
GetTnefStreamCodepage@12
ScCopyNotifications@16
FixMAPI@0
FBadRowSet@4
PpropFindProp@12
OpenIMsgSession@12
BMAPIReadMail
UNKOBJ_ScCOAllocate@12
ScMAPIXFromCMC
MAPILogoff
RTFSync
FtgRegisterIdleRoutine@20
MAPIFreeBuffer

kernel32

CreateJobSet
LoadLibraryA
UnlockFileEx
GetComputerNameA
LocalLock
GetConsoleInputExeNameW
BackupRead
FillConsoleOutputAttribute
SleepEx
TlsSetValue
ProcessIdToSessionId

wininet

InternetFindNextFileW
InternetGetConnectedStateExW
FtpRemoveDirectoryW
InternetConfirmZoneCrossingW
InternetSetStatusCallbackW
InternetQueryOptionW
ResumeSuspendedDownload
FtpPutFileA

dhcpsapi

DhcpEnumMScopeElements
DhcpEnumOptionValuesV5
DhcpCreateClientInfo
DhcpAddServer
DhcpScanDatabase
DhcpRemoveOptionValue
DhcpEnumSubnetClients
DhcpServerRestoreDatabase
DhcpSetClientInfo
DhcpRemoveOption
DhcpServerQueryAttributes
DhcpEnumSubnetElements
DhcpServerQueryDnsRegCredentials
DhcpServerSetConfigV4
DhcpModifyClass

odbcconf

RunDLL32_UnregisterApplication
SetActionLogFile
UnregisterApplication
AppRegEnum
CloseAppRegEnum

Sections

.text
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 174KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3069c56da298a7318b65e6ea7e3709aa

Headers

DLL Characteristics

File Characteristics

Imports

mshtml

msdart

rasman

mapistub

kernel32

wininet

dhcpsapi

odbcconf

Sections

.text Size: 400KB - Virtual size: 400KB

.rdata Size: 92KB - Virtual size: 92KB

.data Size: 174KB - Virtual size: 1.7MB

.rsrc Size: 205KB - Virtual size: 204KB

.reloc Size: 1024B - Virtual size: 920B

.text
Size: 400KB - Virtual size: 400KB

.rdata
Size: 92KB - Virtual size: 92KB

.data
Size: 174KB - Virtual size: 1.7MB

.rsrc
Size: 205KB - Virtual size: 204KB

.reloc
Size: 1024B - Virtual size: 920B