6b1351343f5d267f77fbff7017f46554c7275fffeaa482da2e55723381ecadc4

Sharing

Copy URL Twitter E-mail

General

Target

6b1351343f5d267f77fbff7017f46554c7275fffeaa482da2e55723381ecadc4
Size

390KB
MD5

63d2ed828813cafac1cc7919863712d0
SHA1

4a672aa7544093dcdc34d381bae92d1a6f28b0ac
SHA256

6b1351343f5d267f77fbff7017f46554c7275fffeaa482da2e55723381ecadc4
SHA512

652708282281dac286e1976450159f693d60e19d45895125252e1f97bec155bc7ab60702073cf9bf77feabd617991b87fd5df7d3548d1e888537c10f2e1adc78
SSDEEP

6144:wHdTV1zcpVSeqcBqqBCn4U+htU0dOz5G/7QhFu3yMja75i:wHdDXexCIaQQhOykaM

Score

N/A

Malware Config

Signatures

Files

6b1351343f5d267f77fbff7017f46554c7275fffeaa482da2e55723381ecadc4
.dll windows x86

c879248519db31c2ace63fe03693d885

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

ControlService
SetTokenInformation
ImpersonateLoggedOnUser
CreateProcessAsUserW
StartServiceW
ConvertSidToStringSidW
QueryServiceStatus
DuplicateTokenEx
RegSetValueExW
LsaRetrievePrivateData
LookupAccountNameW
AccessCheck
GetSecurityDescriptorLength
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
QueryServiceStatusEx
SaferCreateLevel
SaferComputeTokenFromLevel
SaferCloseLevel
CommandLineFromMsiDescriptor
IsValidSecurityDescriptor
LookupAccountSidW
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
AllocateLocallyUniqueId
SetServiceStatus
RegQueryValueA
RegisterServiceCtrlHandlerExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorDacl
GetAce
RegOpenKeyW
RegQueryValueW
CryptAcquireContextW
CryptReleaseContext
SystemFunction036
CryptGenRandom
CopySid
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumValueW
ImpersonateAnonymousToken
OpenThreadToken
RevertToSelf
RegOpenUserClassesRoot
CheckTokenMembership
SaferiCompareTokenLevels
SetThreadToken
CreateWellKnownSid
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose
EqualSid
GetTokenInformation
OpenProcessToken
ChangeServiceConfigW
LsaFreeMemory

kernel32

DisableThreadLibraryCalls
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
LoadLibraryA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
TlsAlloc
LocalAlloc
CreateEventA
LocalFree
Sleep
GetComputerNameA
QueryPerformanceCounter
GlobalMemoryStatus
GetDiskFreeSpaceA
InterlockedExchange
EnterCriticalSection
LeaveCriticalSection
GetComputerNameW
GetLastError
lstrcmpW
GetProcessHeap
HeapAlloc
HeapFree
GetDriveTypeW
lstrcpynW
MultiByteToWideChar
lstrlenA
GetExitCodeProcess
WaitForMultipleObjects
CreateMutexW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
ResumeThread
OpenFileMappingW
CreateProcessW
ReadFile
GetModuleFileNameW
WriteFile
WaitNamedPipeW
InitializeCriticalSectionAndSpinCount
lstrcmpiA
MapViewOfFileEx
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
DelayLoadFailureHook
SetLastError
CloseHandle
DeviceIoControl
CreateFileW
SleepEx
InterlockedIncrement
InterlockedDecrement
CreateThread
GetSystemInfo
lstrcpyW
lstrlenW
RegisterWaitForSingleObject
CreateEventW
SetEvent
WaitForSingleObject
lstrcatW
TerminateJobObject
GetCurrentThread
InterlockedExchangeAdd
DeleteTimerQueueTimer
CreateTimerQueueTimer
DeleteCriticalSection
IsDebuggerPresent
DebugBreak
ResetEvent
TlsSetValue
TlsGetValue
GetModuleHandleW
LoadLibraryExA
ExpandEnvironmentStringsW
ReleaseMutex
ReleaseActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
LoadLibraryW
GetSystemDirectoryW
GetSystemWow64DirectoryW
lstrcmpiW
SearchPathW
AddRefActCtx
OpenProcess
DuplicateHandle
InitializeCriticalSection
OpenEventW
LoadLibraryExW
FindClose
FindFirstFileW

msvcrt

_onexit
__dllonexit
_adjust_fdiv
malloc
_initterm
free
_ftol
_resetstkoflw
_except_handler3
memmove
_wtoi
_purecall
ceil
wcslen
wcschr
_ultow
strncmp
wcstol
_stricmp
swprintf
_vsnwprintf
_wcsicmp
wcsncpy
towupper
wcscat
wcscpy

ntdll

RtlAllocateHeap
RtlFreeHeap
RtlImageNtHeader
RtlNtStatusToDosError
NtOpenFile
RtlInitString
RtlDeleteCriticalSection
NtCompareTokens
NtQueryInformationToken
DbgPrint
NtQuerySystemInformation
RtlCopySid
NtOpenSection
NtFsControlFile
NtCreateFile
RtlAdjustPrivilege
NtSetInformationProcess
NtDuplicateToken
RtlInitUnicodeString
RtlEqualUnicodeString
NtSetUuidSeed
RtlSetSaclSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlGetNtProductType
RtlInitializeCriticalSection
NtAllocateLocallyUniqueId
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlAllocateAndInitializeSid
NtClose
NtOpenKey
RtlLengthSid

rpcrt4

RpcServerRegisterIf2
RpcMgmtSetServerStackSize
UuidCreate
RpcServerListen
RpcMgmtIsServerListening
I_RpcAllocate
I_RpcFree
RpcServerUseProtseqEpExW
RpcBindingFree
RpcBindingSetAuthInfoW
RpcBindingSetAuthInfoExW
NdrAsyncServerCall
NdrAsyncClientCall
MesEncodeFixedBufferHandleCreate
MesHandleFree
MesDecodeBufferHandleCreate
NdrMesTypeAlignSize2
NdrMesTypeEncode2
NdrMesTypeDecode2
RpcRevertToSelfEx
RpcImpersonateClient
RpcRaiseException
I_RpcBindingInqTransportType
RpcAsyncCompleteCall
RpcBindingSetOption
I_RpcBindingInqWireIdForSnego
RpcServerUnregisterIf
I_RpcServerInqLocalConnAddress
I_RpcServerCheckClientRestriction
TowerExplode
I_RpcSystemFunction001
RpcServerRegisterIfEx
I_RpcServerRegisterForwardFunction
I_RpcServerSetAddressChangeFn
I_RpcExceptionFilter
NdrClientCall2
NdrServerCall2
RpcStringBindingComposeW
RpcMgmtEnableIdleCleanup
I_RpcBindingInqLocalClientPID
RpcRevertToSelf
RpcBindingReset
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcBindingSetObject
RpcAsyncInitializeHandle
RpcBindingCopy
RpcServerInqBindings
RpcBindingVectorFree
RpcStringFreeW
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcServerRegisterAuthInfoW

secur32

FreeContextBuffer
LsaLogonUser
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
LsaFreeReturnBuffer
EnumerateSecurityPackagesW

user32

wsprintfW
LoadStringW
CharUpperW

ws2_32

closesocket
WSAIoctl
WSAGetLastError
inet_ntoa
gethostname
gethostbyname
socket
bind
WSASetServiceW
htons
getsockname

Exports

Exports

CoGetComCatalog
GetRPCSSInfo
ServiceMain
WhichService

Sections

.text
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c879248519db31c2ace63fe03693d885

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

rpcrt4

secur32

user32

ws2_32

Exports

Exports

Sections

.text Size: 246KB - Virtual size: 245KB

.data Size: 131KB - Virtual size: 131KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 246KB - Virtual size: 245KB

.data
Size: 131KB - Virtual size: 131KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 11KB - Virtual size: 10KB