4f600ac88784406d3ef686289d716c4362dba7a361f24c1a9aa19bbc618a7958

Sharing

Copy URL Twitter E-mail

General

Target

4f600ac88784406d3ef686289d716c4362dba7a361f24c1a9aa19bbc618a7958
Size

1.1MB
MD5

d7a95bbf36fa1c6dc2ed946a587ffc08
SHA1

5ff441bef373427b83fb6ed37d97e6b892af235b
SHA256

4f600ac88784406d3ef686289d716c4362dba7a361f24c1a9aa19bbc618a7958
SHA512

905dfc064a9e89bdbccb91d88ed29bd08dc6cd30c468291cfb76180eb946cc0105a965545b6807cef7aee1f7dd8116e3b02c525be17d1ebd5854fc191dfb6f83
SSDEEP

12288:glbwy5O+7I2KIoBkYe/8RU8WBvFFv7OSsixnU4OpRUsBneRHLCWfSny8NUYR6Ezc:jWdtxSykjR6dq4d6N6/5wftz/JlP0Q

Score

N/A

Malware Config

Signatures

Files

4f600ac88784406d3ef686289d716c4362dba7a361f24c1a9aa19bbc618a7958
.dll windows x64

a37c9a1cf5bfddbacbd8b50e3f4b0dbb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

shutdown
WSADuplicateSocketA
send
WSAGetLastError
WSASetLastError
WSAStartup
getservbyname
getservbyport
gethostbyname
gethostbyaddr
socket
setsockopt
select
recv
ntohs
ntohl
listen
inet_ntoa
inet_addr
htons
htonl
connect
closesocket
bind
accept

crypt32

CertGetCertificateContextProperty

winhttp

WinHttpOpen
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpSetCredentials
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpQueryOption
WinHttpReadData
WinHttpConnect

kernel32

CreateFileW
GetStringTypeW
LoadLibraryExW
OutputDebugStringW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
SetStdHandle
SetFilePointerEx
ReadConsoleW
GetConsoleCP
FlushFileBuffers
GetProcAddress
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WriteProcessMemory
LoadLibraryA
LoadLibraryW
GetModuleHandleA
ExitProcess
SetUnhandledExceptionFilter
GetFullPathNameW
GetSystemDirectoryW
GetVolumeInformationW
GetComputerNameW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SetLastError
GetModuleHandleW
Sleep
SetHandleInformation
GetSystemDirectoryA
GetStdHandle
GetFileType
MultiByteToWideChar
FindClose
WideCharToMultiByte
CloseHandle
QueryPerformanceCounter
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
CompareStringW
LCMapStringW
SetEnvironmentVariableA
FileTimeToLocalFileTime
GetFileInformationByHandle
GetLastError
PeekNamedPipe
GetCurrentDirectoryW
HeapSize
SetEndOfFile
ExitThread
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
GetFileSize
WriteFile
ReadFile
CreateFileA
CreateThread
TerminateThread
ResumeThread
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
WaitForMultipleObjects
GetSystemTime
SystemTimeToFileTime
VirtualAllocEx
OpenProcess
DuplicateHandle
OpenThread
SuspendThread
GetVersionExA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateRemoteThread
GetThreadId
HeapFree
HeapAlloc
HeapReAlloc
GetSystemTimeAsFileTime
RtlUnwindEx
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
EncodePointer
DecodePointer
SetConsoleCtrlHandler
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetProcessHeap
AreFileApisANSI
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

user32

GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
GetThreadDesktop
MessageBoxW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
ImpersonateLoggedOnUser
ReportEventW
RegisterEventSourceW
DeregisterEventSource
OpenThreadToken
OpenProcessToken

Exports

Exports

Init
ReflectiveLoader
buffer_from_file
buffer_to_file
channel_close
channel_create
channel_create_datagram
channel_create_pool
channel_create_stream
channel_default_io_handler
channel_destroy
channel_find_by_id
channel_get_buffered_io_context
channel_get_class
channel_get_flags
channel_get_id
channel_get_native_io_context
channel_get_type
channel_interact
channel_is_flag
channel_is_interactive
channel_open
channel_read
channel_read_from_buffered
channel_set_buffered_io_handler
channel_set_flags
channel_set_interactive
channel_set_native_io_context
channel_set_type
channel_write
channel_write_to_buffered
channel_write_to_remote
command_deregister
command_deregister_all
command_handle
command_join_threads
command_register
command_register_all
core_update_desktop
core_update_thread_token
packet_add_completion_handler
packet_add_exception
packet_add_group
packet_add_tlv_bool
packet_add_tlv_group
packet_add_tlv_qword
packet_add_tlv_raw
packet_add_tlv_string
packet_add_tlv_uint
packet_add_tlv_wstring
packet_add_tlv_wstring_len
packet_add_tlvs
packet_call_completion_handlers
packet_create
packet_create_group
packet_create_response
packet_destroy
packet_enum_tlv
packet_get_tlv
packet_get_tlv_group_entry
packet_get_tlv_meta
packet_get_tlv_string
packet_get_tlv_value_bool
packet_get_tlv_value_qword
packet_get_tlv_value_raw
packet_get_tlv_value_string
packet_get_tlv_value_uint
packet_get_tlv_value_wstring
packet_get_type
packet_is_tlv_null_terminated
packet_remove_completion_handler
packet_transmit_empty_response
scheduler_destroy
scheduler_initialize
scheduler_insert_waitable
scheduler_signal_waitable
scheduler_waitable_thread

Sections

.text
Size: 658KB - Virtual size: 657KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a37c9a1cf5bfddbacbd8b50e3f4b0dbb

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

winhttp

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 658KB - Virtual size: 657KB

.rdata Size: 237KB - Virtual size: 236KB

.data Size: 120KB - Virtual size: 149KB

.pdata Size: 37KB - Virtual size: 37KB

.reloc Size: 21KB - Virtual size: 21KB

.text
Size: 658KB - Virtual size: 657KB

.rdata
Size: 237KB - Virtual size: 236KB

.data
Size: 120KB - Virtual size: 149KB

.pdata
Size: 37KB - Virtual size: 37KB

.reloc
Size: 21KB - Virtual size: 21KB