bc5d76a5dd4a163f51c5b33c6d5ff2efe4c8d87c6778be7676e4bebdae958766

Sharing

Copy URL Twitter E-mail

General

Target

bc5d76a5dd4a163f51c5b33c6d5ff2efe4c8d87c6778be7676e4bebdae958766
Size

745KB
MD5

009d8faf8ec0e88c0674245acfe1b2a0
SHA1

7fce2a85511a8ddab088c1ee89dbd9317c505a87
SHA256

bc5d76a5dd4a163f51c5b33c6d5ff2efe4c8d87c6778be7676e4bebdae958766
SHA512

67645aa9c33e2cdc3fc4443b895396a200a486778fbdaf7a3d0b3c57a4919ba15369d826b6d51603afac45e6709d21cb53b110f97bc079e7f383c8e7568bf61d
SSDEEP

12288:2nVBDCSOE4oVT6kCc1tMwsjI79el+Rea2J0rdEa2QboLJGYZcIH4hX1z7/McQHDb:2nVvOE4oVT6kCc1tMwsE79eTa2C6mwYG

Score

N/A

Malware Config

Signatures

Files

bc5d76a5dd4a163f51c5b33c6d5ff2efe4c8d87c6778be7676e4bebdae958766
.dll windows x86

aa69a92de5b52535c9ddd932acc4189f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

tier0

ThreadSleep
Plat_MSTime
Plat_FloatTime
Error
?DevMsg@@YAXPBDZZ
Warning
?DevWarning@@YAXPBDZZ
Msg
g_pMemAlloc
Plat_ExitProcess
Plat_IsInDebugSession
WriteMiniDump

vstdlib

RandomFloat
RandomInt

wsock32

WSAStartup
htonl
htons
WSACleanup
recv
bind
socket
__WSAFDIsSet
listen
accept
select
closesocket
send

kernel32

SetLastError
GetProcessHeap
HeapFree
HeapAlloc
SetEndOfFile
WriteConsoleW
CreateFileW
GetFileAttributesExW
OutputDebugStringW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
SetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
DeleteFileW
GetTimeZoneInformation
MoveFileExW
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
CreatePipe
GetExitCodeProcess
FreeLibrary
FormatMessageA
GetLastError
GetProcAddress
LoadLibraryA
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
CloseHandle
GetCurrentProcessId
RaiseException
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetTempPathA
DuplicateHandle
GetCurrentProcess
CreateProcessA
ReadFile
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
SetEnvironmentVariableA
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryExW
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetConsoleMode
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW

Exports

Exports

CreateInterface

Sections

.text
Size: 505KB - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 54KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

aa69a92de5b52535c9ddd932acc4189f

Headers

DLL Characteristics

File Characteristics

Imports

tier0

vstdlib

wsock32

kernel32

Exports

Exports

Sections

.text Size: 505KB - Virtual size: 504KB

.rdata Size: 136KB - Virtual size: 136KB

.data Size: 28KB - Virtual size: 38KB

.reloc Size: 20KB - Virtual size: 20KB

.rmnet Size: 54KB - Virtual size: 56KB

.text
Size: 505KB - Virtual size: 504KB

.rdata
Size: 136KB - Virtual size: 136KB

.data
Size: 28KB - Virtual size: 38KB

.reloc
Size: 20KB - Virtual size: 20KB

.rmnet
Size: 54KB - Virtual size: 56KB