2d1adb83a5bbbc7b09b3028c8154286a3c7d82e64cfe6d4637c3399a23fdeed6

Sharing

Copy URL Twitter E-mail

General

Target

2d1adb83a5bbbc7b09b3028c8154286a3c7d82e64cfe6d4637c3399a23fdeed6
Size

148KB
MD5

7b2c0d9604b0af599a8999bbd894581c
SHA1

d66c10919c29236aa27f2b2d50134dc169ddf6d3
SHA256

2d1adb83a5bbbc7b09b3028c8154286a3c7d82e64cfe6d4637c3399a23fdeed6
SHA512

f2831ee16467c48a9842ff557a4afac86088b5c22bd08e3f9098343ef9f9ab6872f277ecf2bc8db111f3131eda49607f0a998eabf4514f30b560fa2af128e028
SSDEEP

1536:x1yndFsEZvgQPbQXj/2DuxEL08W29Ce6PtM+Ww8V5r90WEKneqDD4JIA/jzKMfv5:x1OgNTSuM0/29Ce8Mx1aVKvD4J16MWS

Score

N/A

Malware Config

Signatures

Files

2d1adb83a5bbbc7b09b3028c8154286a3c7d82e64cfe6d4637c3399a23fdeed6
.dll windows x86

3d74a5f979592c265b3c26f8fea4ea50

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
TraceEvent
RegisterTraceGuidsA
UnregisterTraceGuids
GetTraceLoggerHandle
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
RegCreateKeyExW
RegOpenKeyExW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
RegisterEventSourceW
ReportEventA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExW
RegCreateKeyExA
RegDeleteKeyA
RegSetValueExW
RegQueryValueExA
DeregisterEventSource

kernel32

MultiByteToWideChar
WideCharToMultiByte
LocalFree
LocalReAlloc
QueryPerformanceCounter
LoadLibraryExW
CompareStringW
HeapDestroy
GetProcessHeap
LeaveCriticalSection
CloseHandle
EnterCriticalSection
WaitForSingleObject
SetEvent
HeapAlloc
HeapFree
SetLastError
GetLastError
CreateEventA
HeapCreate
PulseEvent
WaitForMultipleObjects
CreateThread
ResetEvent
LocalAlloc
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
ExitThread
CreateSemaphoreA
ReleaseSemaphore
GetSystemDirectoryA
GetTickCount
GetEnvironmentVariableW
GetVersionExA
GetVersion
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
FreeLibrary
InterlockedCompareExchange
LoadLibraryA
Sleep
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CompareStringA
LCMapStringW
DelayLoadFailureHook

msvcrt

_adjust_fdiv
malloc
_initterm
free
srand
rand
atoi
_snwprintf
wcstoul
wcscat
swprintf
_snprintf
wcschr
strncpy
wcsncpy
_strlwr
strchr
strtoul
strncmp
_strupr
_except_handler3
wcscpy
fopen
wcslen
wcscmp
_wcsnicmp
vsprintf
fputs
time
localtime
fprintf
fgets
_strnicmp
strpbrk
fclose
rewind
sprintf
sscanf
_stricmp

ntdll

RtlIpv6StringToAddressW
RtlIpv6StringToAddressA
RtlInitializeCriticalSection
RtlIpv6AddressToStringA

rpcrt4

NdrClientCall2
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
UuidCreateSequential
RpcBindingFree
I_RpcExceptionFilter

ws2_32

connect
WSAStartup
WSACleanup
bind
closesocket
setsockopt
WSASocketA
WSAJoinLeaf
WSAIoctl
shutdown
send
sendto
recv
ntohs
select
WSAGetLastError
recvfrom
htonl
htons
inet_addr
inet_ntoa
getprotobyname
getservbyport
getprotobynumber
ntohl

Exports

Exports

BreakRecordsIntoBlob
CombineRecordsInBlob
DnsAcquireContextHandle_A
DnsAcquireContextHandle_W
DnsAddRecordSet_A
DnsAddRecordSet_UTF8
DnsAddRecordSet_W
DnsAllocateRecord
DnsApiAlloc
DnsApiFree
DnsApiHeapReset
DnsApiRealloc
DnsApiSetDebugGlobals
DnsAsyncRegisterHostAddrs
DnsAsyncRegisterInit
DnsAsyncRegisterTerm
DnsCopyStringEx
DnsCreateReverseNameStringForIpAddress
DnsCreateStandardDnsNameCopy
DnsCreateStringCopy
DnsDhcpSrvRegisterHostName
DnsDhcpSrvRegisterInit
DnsDhcpSrvRegisterInitialize
DnsDhcpSrvRegisterTerm
DnsDowncaseDnsNameLabel
DnsExtractRecordsFromMessage_UTF8
DnsExtractRecordsFromMessage_W
DnsFindAuthoritativeZone
DnsFlushResolverCache
DnsFlushResolverCacheEntry_A
DnsFlushResolverCacheEntry_UTF8
DnsFlushResolverCacheEntry_W
DnsFree
DnsFreeConfigStructure
DnsGetBufferLengthForStringCopy
DnsGetCacheDataTable
DnsGetDnsServerList
DnsGetDomainName
DnsGetIpAddressInfoList
DnsGetLastFailedUpdateInfo
DnsGetLocalAddrArray
DnsGetLocalAddrArrayDirect
DnsGetPrimaryDomainName_A
DnsGlobals
DnsIpv6AddressToString
DnsIpv6StringToAddress
DnsIsAMailboxType
DnsIsStatusRcode
DnsIsStringCountValidForTextType
DnsMapRcodeToStatus
DnsModifyRecordSet_A
DnsModifyRecordSet_UTF8
DnsModifyRecordSet_W
DnsModifyRecordsInSet_A
DnsModifyRecordsInSet_UTF8
DnsModifyRecordsInSet_W
DnsNameCompareEx_A
DnsNameCompareEx_UTF8
DnsNameCompareEx_W
DnsNameCompare_A
DnsNameCompare_UTF8
DnsNameCompare_W
DnsNameCopy
DnsNameCopyAllocate
DnsNotifyResolver
DnsNotifyResolverClusterIp
DnsNotifyResolverEx
DnsQueryConfig
DnsQueryConfigAllocEx
DnsQueryConfigDword
DnsQueryExA
DnsQueryExUTF8
DnsQueryExW
DnsQuery_A
DnsQuery_UTF8
DnsQuery_W
DnsRecordBuild_UTF8
DnsRecordBuild_W
DnsRecordCompare
DnsRecordCopyEx
DnsRecordListFree
DnsRecordSetCompare
DnsRecordSetCopyEx
DnsRecordSetDetach
DnsRecordStringForType
DnsRecordStringForWritableType
DnsRecordTypeForName
DnsRegisterClusterAddress
DnsReleaseContextHandle
DnsRemoveRegistrations
DnsReplaceRecordSetA
DnsReplaceRecordSetUTF8
DnsReplaceRecordSetW
DnsSetConfigDword
DnsStatusString
DnsStringCopyAllocateEx
DnsUnicodeToUtf8
DnsUpdate
DnsUpdateTest_A
DnsUpdateTest_UTF8
DnsUpdateTest_W
DnsUtf8ToUnicode
DnsValidateName_A
DnsValidateName_UTF8
DnsValidateName_W
DnsValidateUtf8Byte
DnsWriteQuestionToBuffer_UTF8
DnsWriteQuestionToBuffer_W
DnsWriteReverseNameStringForIpAddress
Dns_AddRecordsToMessage
Dns_AllocateMsgBuf
Dns_BuildPacket
Dns_CacheSocketCleanup
Dns_CacheSocketInit
Dns_CleanupWinsock
Dns_CloseConnection
Dns_CloseHostFile
Dns_CloseSocket
Dns_CreateMulticastSocket
Dns_CreateSocket
Dns_CreateSocketEx
Dns_FindAuthoritativeZoneLib
Dns_GetIpAddresses
Dns_GetLocalIpAddressArray
Dns_GetRandomXid
Dns_InitQueryTimeouts
Dns_InitializeMsgRemoteSockaddr
Dns_InitializeWinsock
Dns_OpenHostFile
Dns_OpenTcpConnectionAndSend
Dns_ParseMessage
Dns_ParsePacketRecord
Dns_PingAdapterServers
Dns_ReadHostFileLine
Dns_ReadPacketName
Dns_ReadPacketNameAllocate
Dns_ReadRecordStructureFromPacket
Dns_RecvTcp
Dns_ResetNetworkInfo
Dns_SendAndRecvUdp
Dns_SendEx
Dns_SetRecordDatalength
Dns_SkipPacketName
Dns_SkipToRecord
Dns_UpdateLib
Dns_UpdateLibEx
Dns_WriteDottedNameToPacket
Dns_WriteQuestionToMessage
Dns_WriteRecordStructureToPacketEx
GetCurrentTimeInSeconds
GetRecordsForLocalName
NetInfo_Build
NetInfo_Clean
NetInfo_Copy
NetInfo_Free
NetInfo_IsForUpdate
NetInfo_ResetServerPriorities
QueryDirectEx
Query_Main
Reg_ReadGlobalsEx

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text8
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3d74a5f979592c265b3c26f8fea4ea50

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

rpcrt4

ws2_32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 128KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 5KB - Virtual size: 8KB

.text8 Size: 2KB - Virtual size: 4KB

.text
Size: 128KB - Virtual size: 128KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 5KB - Virtual size: 8KB

.text8
Size: 2KB - Virtual size: 4KB