1c68679df8fac2b78c608cea73efe329a40ec56406f37c8f70f6fd44c84179c2

Sharing

Copy URL

Twitter E-mail

General

Target

1c68679df8fac2b78c608cea73efe329a40ec56406f37c8f70f6fd44c84179c2
Size

212KB
MD5

629a19ade2b8acd30ee7a2961b2931d1
SHA1

c207f780d550dd71e127b9176c89adb1c79ea8ee
SHA256

1c68679df8fac2b78c608cea73efe329a40ec56406f37c8f70f6fd44c84179c2
SHA512

f817bbd61e978176fea6a1cafe038722dcaef318fdb4bf84bc61d548192dce0928caefed460dc65004f06350177ab60a67e296b7c6c828c087d32de64a4d4342
SSDEEP

6144:gPUZ1jxhINfRN02uxJekQ4ARtXFWuVD1GbNA/:gPSTuDwx0kQjtXFWuR1GbO/

Score

N/A

Malware Config

Signatures

Files

1c68679df8fac2b78c608cea73efe329a40ec56406f37c8f70f6fd44c84179c2
.exe windows x86

ab4aa11ae8320ead77ce7c7b320b7775

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToFileTime
GetProcessHeap
GetOEMCP
LoadLibraryW
lstrlenA
CloseHandle
GetEnvironmentStringsW
GetUserDefaultLCID
GetCurrentProcess
GetSystemDefaultLCID
HeapFree
lstrcmpA
FreeResource
LockResource
MultiByteToWideChar
CreateFileA
LoadResource
FindResourceA
QueryPerformanceCounter
GetLocalTime
HeapAlloc
GetCurrentProcessId
SetUnhandledExceptionFilter
lstrcpyA
WideCharToMultiByte
GetLocaleInfoW
DeviceIoControl
QueryDosDeviceA
GetVolumeInformationA
GetTickCount
GetSystemTimeAsFileTime
SetLastError

raschap

RasCpEnumProtocolIds
RasEapGetInfo
RasCpGetInfo

rasctrs

CloseRasPerformanceData
OpenRasPerformanceData
CollectRasPerformanceData

rasman

RasAddNotification
IsRasmanProcess
RasActivateRouteEx
RasAddConnectionPort
RasAllocateRoute

rasdlg

RasPhonebookDlgW
DwTerminalDlg
GetRasDialOutProtocols
RasSrvAddPropPages
RouterEntryDlgW
RasUserGetManualDial
RasAutodialQueryDlgA
RasSrvIsConnectionConnected
RouterEntryDlgA
RasSrvHangupConnection
RasDialDlgW
RasSrvIsServiceRunning
RasUserPrefsDlg
RasUserEnableManualDial
RasAutodialQueryDlgW
RasSrvInitializeService
RasEntryDlgW
RasSrvCleanupService
RasSrvAllowConnectionsConfig
RasPhonebookDlgA
RasDialDlgA
RasEntryDlgA
RasSrvEnumConnections

rasapi32

RasValidateEntryNameA
RasSetSubEntryPropertiesW
DwCloneEntry
RasValidateEntryNameW

advapi32

RegOpenKeyExA
RegOpenKeyW
RegQueryValueExA
RegCloseKey
RegQueryValueExW

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hdata
Size: 21KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab4aa11ae8320ead77ce7c7b320b7775

Headers

File Characteristics

Imports

kernel32

raschap

rasctrs

rasman

rasdlg

rasapi32

advapi32

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 73KB - Virtual size: 72KB

.hdata Size: 21KB - Virtual size: 2.0MB

.zdata Size: 14KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 73KB - Virtual size: 72KB

.hdata
Size: 21KB - Virtual size: 2.0MB

.zdata
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB