312162529aee7f087dd84efd49974a9ab396cc1cc6f053fd5f60885c97ccfbd6

Sharing

Copy URL Twitter E-mail

General

Target

312162529aee7f087dd84efd49974a9ab396cc1cc6f053fd5f60885c97ccfbd6
Size

541KB
MD5

80a5526bd3ae197dd517c466579343b0
SHA1

37444c0608a75d68068fc79d2e63fd06baf1ef8c
SHA256

312162529aee7f087dd84efd49974a9ab396cc1cc6f053fd5f60885c97ccfbd6
SHA512

843aa03eb29dd3c68b3ee5a44a304877dd987cd31b88502471f0ca7ceba96324e50e3ec3f5fda6aea986b6944386e848c94667f174fc130534f8e2e1d07fdd5f
SSDEEP

6144:r83BGCQ2JKRmDS0Cu4whjkFq0BbaDvCJWWqALjiEJIYWZD5:rlCQ2JKMeJq4QjOVjFIYYD5

Score

N/A

Malware Config

Signatures

Files

312162529aee7f087dd84efd49974a9ab396cc1cc6f053fd5f60885c97ccfbd6
.dll windows x86

da09c8222f2aab3594d99cc2f63878cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_ultow
strncmp
atoi
_stricmp
_vsnwprintf
_wcsnicmp
towupper
_wcsicmp
_ftol2
ceil
wcschr
_purecall
_wtoi
memmove
memset
memcpy
malloc
free
_initterm
_amsg_exit
_adjust_fdiv
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_vsnprintf
_ultoa
wcscpy_s
_XcptFilter
_ftol2_sse

rpcrt4

I_RpcBindingIsClientLocal
I_RpcServerInqLocalConnAddress
I_RpcGetPortAllocationData
UuidIsNil
I_RpcServerCheckClientRestriction
RpcServerUnregisterIf
RpcServerInqCallAttributesW
RpcServerSubscribeForNotification
RpcAsyncAbortCall
RpcServerUnsubscribeForNotification
NdrAsyncServerCall
UuidToStringW
I_RpcBindingInqSecurityContextKeyInfo
NdrAsyncClientCall
RpcBindingCopy
RpcBindingReset
RpcBindingFree
I_RpcServerInqRemoteConnAddress
TowerExplode
I_RpcServerRegisterForwardFunction
RpcServerRegisterIf2
I_RpcExceptionFilter
I_RpcServerSetAddressChangeFn
I_RpcSystemFunction001
NdrClientCall2
RpcRaiseException
NdrServerCall2
MesEncodeFixedBufferHandleCreate
MesHandleFree
MesDecodeBufferHandleCreate
NdrMesTypeAlignSize2
NdrMesTypeEncode2
NdrMesTypeDecode2
RpcErrorSaveErrorInfo
RpcErrorGetNextRecord
RpcErrorResetEnumeration
RpcErrorEndEnumeration
RpcErrorStartEnumeration
I_RpcFwThisIsTheManager
RpcServerListen
RpcMgmtIsServerListening
RpcMgmtSetServerStackSize
I_RpcAllocate
I_RpcFree
RpcServerUseProtseqEpExW
RpcStringBindingComposeW
RpcRevertToSelf
I_RpcFilterDCOMActivation
RpcMgmtEnableIdleCleanup
RpcBindingServerFromClient
RpcBindingSetObject
RpcBindingCreateW
RpcBindingBind
RpcBindingUnbind
RpcAsyncCancelCall
RpcBindingFromStringBindingW
RpcServerRegisterIfEx
RpcBindingSetAuthInfoExW
RpcAsyncCompleteCall
UuidCreate
RpcAsyncInitializeHandle
RpcRevertToSelfEx
RpcServerRegisterAuthInfoW
RpcServerInqBindings
RpcBindingVectorFree
RpcStringFreeW
RpcBindingToStringBindingW
RpcStringBindingParseW
I_RpcBindingInqWireIdForSnego
I_RpcBindingInqMarshalledTargetInfo
RpcBindingSetOption
I_RpcBindingInqLocalClientPID
I_RpcBindingInqTransportType
RpcImpersonateClient
RpcBindingSetAuthInfoW

advapi32

LsaClose
EventWrite
GetUserNameW
DuplicateToken
CreateProcessAsUserW
StartServiceW
ImpersonateLoggedOnUser
CheckTokenMembership
RegSetValueExW
DuplicateTokenEx
LsaOpenPolicy
LsaRetrievePrivateData
LogonUserExExW
LsaFreeMemory
LookupAccountNameW
SetTokenInformation
A_SHAInit
A_SHAUpdate
A_SHAFinal
AccessCheck
TraceMessage
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegCloseKey
EventRegister
RegQueryValueExW
RegOpenKeyExW
AllocateLocallyUniqueId
SetServiceStatus
RegisterServiceCtrlHandlerExW
GetSecurityDescriptorLength
ControlService
SaferCreateLevel
SaferComputeTokenFromLevel
SaferCloseLevel
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
OpenSCManagerW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountSidW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertSidToStringSidW
IsValidSecurityDescriptor
GetSecurityDescriptorDacl
GetAce
RegGetValueW
RegQueryValueW
CommandLineFromMsiDescriptor
RegLoadMUIStringW
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExA
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumValueW
ImpersonateAnonymousToken
RevertToSelf
RegOpenUserClassesRoot
OpenThreadToken
SetThreadToken
SaferiCompareTokenLevels
GetSidSubAuthority
EqualSid
CopySid
GetSidLengthRequired
InitializeSid
GetTokenInformation
IsValidSid
CreateWellKnownSid
QueryServiceStatus
EventEnabled

kernel32

GetModuleHandleExW
GetSystemWow64DirectoryW
GetSystemDirectoryW
SearchPathW
CreateFileMappingW
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange64
ResetEvent
TlsGetValue
SwitchToThread
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
LoadLibraryExW
AddRefActCtx
OpenEventW
GetComputerNameExW
OpenProcess
InitializeCriticalSection
TlsSetValue
GetDriveTypeW
GetVersionExW
ExpandEnvironmentStringsW
WaitForMultipleObjects
CompareFileTime
GetExitCodeProcess
CheckElevationEnabled
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
InterlockedExchange
LoadLibraryA
InterlockedCompareExchange
FreeLibrary
GetProcAddress
TlsAlloc
Sleep
GetComputerNameA
GetLastError
QueryPerformanceCounter
GlobalMemoryStatus
GetDiskFreeSpaceA
lstrcmpW
GetProcessHeap
HeapAlloc
HeapFree
CreateMutexW
GetProcessIdOfThread
OpenThread
GetFullPathNameW
SetThreadpoolWait
CreateThreadpoolWait
SetEvent
CloseThreadpool
SetThreadpoolThreadMinimum
SetThreadpoolThreadMaximum
CreateThreadpool
FindClose
FindFirstFileW
ReleaseMutex
UnregisterWait
CompareStringA
MapViewOfFileEx
VirtualFree
DelayLoadFailureHook
SetLastError
LocalFree
CloseHandle
DeviceIoControl
CreateFileW
LocalAlloc
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetVersion
SleepEx
InterlockedIncrement
InterlockedDecrement
CreateThread
RegisterWaitForSingleObject
lstrlenW
CreateEventW
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
QueueUserWorkItem
DuplicateHandle
CompareStringW
GetCurrentThread
InterlockedExchangeAdd
DeleteTimerQueueTimer
CreateTimerQueueTimer
GetModuleFileNameW
DeleteCriticalSection

ntdll

DbgPrintEx
RtlIntegerToUnicodeString
NtOpenDirectoryObject
NtQueryDirectoryObject
NtOpenSection
RtlGetNtProductType
WinSqmIsOptedIn
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetSaclSecurityDescriptor
NtQueryMutant
NtDuplicateToken
RtlUpcaseUnicodeString
NtAllocateLocallyUniqueId
RtlLengthRequiredSid
RtlOemStringToUnicodeString
RtlInitAnsiString
RtlInitializeSid
RtlSubAuthoritySid
RtlCreateUnicodeString
RtlFreeUnicodeString
NtQueryInformationFile
NtClose
RtlAllocateAndInitializeSid
WinSqmEventEnabled
WinSqmEventWrite
RtlGetSaclSecurityDescriptor
RtlLengthSid
RtlCopySid
NtOpenKey
NtQueryKey
DbgPrint
RtlInitializeCriticalSectionAndSpinCount
NtQuerySystemInformation
NtQueryInformationToken
NtCompareTokens
RtlEqualSid
RtlDeleteCriticalSection
RtlImageNtHeader
RtlAllocateHeap
RtlFreeHeap
NtOpenFile
RtlNtStatusToDosError
RtlInitUnicodeString
RtlEqualUnicodeString
RtlInitializeCriticalSection
NtSetUuidSeed

ws2_32

WSAGetLastError
WSASocketW
WSAEnumProtocolsW
WSAAddressToStringW
WSAIoctl

secur32

EnumerateSecurityPackagesW
FreeContextBuffer

firewallapi

FWResetIndicatedPortInUse
FWIndicatePortInUse

Exports

Exports

CoGetComCatalog
GetRPCSSInfo
ServiceMain
WhichService

Sections

.text
Size: 381KB - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da09c8222f2aab3594d99cc2f63878cf

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

rpcrt4

advapi32

kernel32

ntdll

ws2_32

secur32

firewallapi

Exports

Exports

Sections

.text Size: 381KB - Virtual size: 381KB

.data Size: 133KB - Virtual size: 133KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 381KB - Virtual size: 381KB

.data
Size: 133KB - Virtual size: 133KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 20KB - Virtual size: 20KB