9f996aa6903b78e2ecab815248b84bde3bbf7fa584e9c231d8b2a51d2840ab3f

Sharing

Copy URL Twitter E-mail

General

Target

9f996aa6903b78e2ecab815248b84bde3bbf7fa584e9c231d8b2a51d2840ab3f
Size

59KB
MD5

6eb05346e50017d2a51cf9f5c4a92c66
SHA1

600e14cdafd46355fda36ec199d0797fab7c24f4
SHA256

9f996aa6903b78e2ecab815248b84bde3bbf7fa584e9c231d8b2a51d2840ab3f
SHA512

959f6c1f8829c1bee6aa3669881a86c2521af7e4d9a981f26c7b1de6b8f3993dc9caee9ff5100281215c1f3a1f04f3fd33daf4208e50e3d3658ef60e736ed0e4
SSDEEP

768:3d57ntLnqFkSiodZcRARlOh9aJ7/wSrjwVuHcEaggBNrfJVuQ:tNnBnqFkSiT0Q9+7/HrcofGBJfJN

Score

N/A

Malware Config

Signatures

Files

9f996aa6903b78e2ecab815248b84bde3bbf7fa584e9c231d8b2a51d2840ab3f
.dll windows x86

941f8edbc8f4a1e0db2f15d590ac0fbb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

api-ms-win-core-crt-l1-1-0

wcsrchr
memset
_except_handler4_common
memcpy_s
wcsncmp
memcpy
wcschr
_vsnwprintf_s
_vsnprintf_s

api-ms-win-core-crt-l2-1-0

_initterm
_initterm_e

ntdll

NtCreateFile
NtDeviceIoControlFile
RtlAddAce
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlDeleteSecurityObject
RtlCopySid
RtlSetGroupSecurityDescriptor
RtlSetSaclSecurityDescriptor
NtClose
NtOpenProcessToken
RtlLengthSid
RtlGUIDFromString
RtlSetOwnerSecurityDescriptor
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlStringFromGUID
EtwTraceMessage
NlsMbOemCodePageTag
RtlInitUnicodeString
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlxOemStringToUnicodeSize
RtlOemStringToUnicodeString
RtlInitString
RtlCreateSecurityDescriptor
RtlNewSecurityObject

rpcrt4

NdrClientCall2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetOption
RpcBindingSetAuthInfoW
RpcBindingFree

ws2_32

inet_ntoa
ntohs
ntohl

nsi

NsiGetAllParametersEx

api-ms-win-core-errorhandling-l1-1-1

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-core-file-l1-2-0

CreateFileW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-interlocked-l1-2-0

InterlockedIncrement

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-libraryloader-l1-1-1

DisableThreadLibraryCalls

api-ms-win-core-registry-l1-1-0

RegDeleteKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
LocalAlloc

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

OpenEventW
CreateEventA
InitializeCriticalSection
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount

api-ms-win-core-sysinfo-l1-2-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-security-base-l1-2-0

SetSecurityDescriptorDacl
GetLengthSid
InitializeSecurityDescriptor
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeAcl

api-ms-win-service-management-l1-1-0

OpenSCManagerW
StartServiceW
CloseServiceHandle
OpenServiceW

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

Exports

Exports

DhcpAcquireParameters
DhcpAcquireParametersByBroadcast
DhcpCApiCleanup
DhcpCApiInitialize
DhcpClient_Generalize
DhcpDeRegisterConnectionStateNotification
DhcpDeRegisterOptions
DhcpDeRegisterParamChange
DhcpDelPersistentRequestParams
DhcpEnableDhcp
DhcpEnableTracing
DhcpEnumClasses
DhcpEnumInterfaces
DhcpFallbackRefreshParams
DhcpFreeEnumeratedInterfaces
DhcpFreeLeaseInfo
DhcpFreeLeaseInfoArray
DhcpFreeMem
DhcpGetClassId
DhcpGetClientId
DhcpGetDhcpServicedConnections
DhcpGetFallbackParams
DhcpGetNotificationStatus
DhcpGetOriginalSubnetMask
DhcpGetTraceArray
DhcpGlobalIsShuttingDown
DhcpGlobalServiceSyncEvent
DhcpGlobalTerminateEvent
DhcpHandlePnPEvent
DhcpIsEnabled
DhcpLeaseIpAddress
DhcpLeaseIpAddressEx
DhcpNotifyConfigChange
DhcpNotifyConfigChangeEx
DhcpNotifyMediaReconnected
DhcpOpenGlobalEvent
DhcpPersistentRequestParams
DhcpQueryLeaseInfo
DhcpQueryLeaseInfoArray
DhcpQueryLeaseInfoEx
DhcpRegisterConnectionStateNotification
DhcpRegisterOptions
DhcpRegisterParamChange
DhcpReleaseIpAddressLease
DhcpReleaseIpAddressLeaseEx
DhcpReleaseParameters
DhcpRemoveDNSRegistrations
DhcpRenewIpAddressLease
DhcpRenewIpAddressLeaseEx
DhcpRequestCachedParams
DhcpRequestOptions
DhcpRequestParams
DhcpSetClassId
DhcpSetClientId
DhcpSetFallbackParams
DhcpSetMSFTVendorSpecificOptions
DhcpStaticRefreshParams
DhcpUndoRequestParams
Dhcpv4CheckServerAvailability
Dhcpv4EnableDhcpEx
McastApiCleanup
McastApiStartup
McastEnumerateScopes
McastGenUID
McastReleaseAddress
McastRenewAddress
McastRequestAddress

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

941f8edbc8f4a1e0db2f15d590ac0fbb

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-crt-l1-1-0

api-ms-win-core-crt-l2-1-0

ntdll

rpcrt4

ws2_32

nsi

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-interlocked-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-libraryloader-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-delayload-l1-1-1

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 47KB

.data Size: 1KB - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 47KB - Virtual size: 47KB

.data
Size: 1KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB