dd89e98d4d6de3de5a53ba6f61929ea54376a6e2f978d27a4d671f8f8df07664

Sharing

Copy URL Twitter E-mail

General

Target

dd89e98d4d6de3de5a53ba6f61929ea54376a6e2f978d27a4d671f8f8df07664
Size

540KB
MD5

848d22cccdc01fb6a5c536e03a2d6aa5
SHA1

10b3272f1c8c286d1fa7aaebb2d0503ea5923dd2
SHA256

dd89e98d4d6de3de5a53ba6f61929ea54376a6e2f978d27a4d671f8f8df07664
SHA512

e6fbb051357e82ffbe149b3ce8870e749a5947f3cf97af15bd2b44a1ef8be93c3f5df51a02e4b6ff0be100039faf4c9200c011de94f3d21d2c79a0370ad80dd6
SSDEEP

12288:fMYc77jDjuFk4LJnqe4qRQhQePCdMgl6kf1TcE+rveuca3cHG+FjuqAM/xliDiEY:tc77jDjuFkuJnqe4qRQhQePCd9l6kf/T

Score

N/A

Malware Config

Signatures

Files

dd89e98d4d6de3de5a53ba6f61929ea54376a6e2f978d27a4d671f8f8df07664
.dll windows x86

eae246beb73e3bcc52802a7793ee5b42

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

msvcrt

malloc
_onexit
__dllonexit
_adjust_fdiv
_initterm
free
_splitpath
_vsnprintf
memmove
_ismbcalpha
realloc
_mbslen
_mbschr
wcscpy
_mbstrlen
_mbscpy
sprintf
_snprintf
_itoa
_mbsninc
_mbsdec
_mbsnbcmp
_mbsnbset
_mbsstr
qsort
_mbstok
_mbsnbcpy
_mbsinc
_mbsrchr
_mbsicmp
_wcsicmp
wcslen
_mbscmp
_except_handler3
_stricmp

rpcrt4

NdrComplexStructMarshall
NdrGetBuffer
NdrSendReceive
NdrConvert
NdrPointerUnmarshall
RpcRaiseException
NdrFreeBuffer
RpcBindingServerFromClient
RpcBindingToStringBindingA
RpcStringBindingParseA
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcStringFreeA
RpcServerUseProtseqEpA
RpcServerRegisterIfEx
RpcServerListen
RpcServerRegisterIf
RpcServerRegisterAuthInfoA
RpcMgmtStopServerListening
RpcMgmtWaitServerListen
RpcServerUnregisterIf
RpcBindingFree
RpcBindingSetAuthInfoA
RpcBindingInqAuthClientA
NdrConformantArrayBufferSize
NdrSimpleTypeMarshall
NdrSimpleStructUnmarshall
NdrConformantStringMarshall
NdrConformantStringBufferSize
NdrComplexStructBufferSize
NdrConformantArrayMarshall
NdrClientInitializeNew
NdrConformantArrayUnmarshall
NdrPointerBufferSize
NdrPointerMarshall
NdrSimpleStructBufferSize
NdrSimpleStructMarshall
NDRCContextBinding
NdrClientContextMarshall
NdrConformantStringUnmarshall
NdrServerContextMarshall
I_RpcGetBuffer
NDRSContextUnmarshall
NdrServerInitializeNew
NdrServerContextUnmarshall
NdrMapCommAndFaultStatus
NdrClientContextUnmarshall

kernel32

GetSystemTimeAsFileTime
LeaveCriticalSection
IsBadReadPtr
EnterCriticalSection
LocalFree
LocalAlloc
lstrlenW
DeleteCriticalSection
InitializeCriticalSection
FileTimeToSystemTime
LocalFileTimeToFileTime
PostQueuedCompletionStatus
ReadFile
DeleteFileA
CloseHandle
WriteFile
GetFileSize
GetFullPathNameA
GetTempFileNameA
GetTempPathA
WideCharToMultiByte
GetFileAttributesA
GetComputerNameW
GetLocalTime
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
DisableThreadLibraryCalls
QueryPerformanceCounter
GetComputerNameA
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
ExpandEnvironmentStringsA
GetDateFormatA
lstrlenA
CreateDirectoryA
GetVersion
GetVersionExA
Sleep
OpenEventA
SetEvent
CreateEventA
WaitForSingleObject
SetEndOfFile
SetFilePointer
UnmapViewOfFile
GetFileType
CreateFileA
GetSystemTime
MapViewOfFileEx
MultiByteToWideChar
CopyFileA
GetStringTypeExA
GetTimeFormatA
GetLastError
SetLastError
MulDiv
OpenMutexA
CreateMutexA
SetEnvironmentVariableA
MapViewOfFile
WaitForMultipleObjects
ReleaseMutex
VirtualAlloc
VirtualFree
GetTickCount
SystemTimeToFileTime
CreateFileMappingA

shell32

ShellExecuteExA
SHGetMalloc
SHGetSpecialFolderLocation
SHChangeNotify

advapi32

RegSetValueExA
RegOpenKeyA
RegQueryValueExA
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorLength
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
CloseServiceHandle
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegNotifyChangeKeyValue
StartServiceA

winspool.drv

SetPrinterA
EnumPrintersA
ClosePrinter
OpenPrinterA
GetPrinterA
DocumentPropertiesA
SetJobA
GetJobA
AddPrinterA

gdi32

DeleteDC
EndPage
StartPage
StartDocA
CreateDCA
EndDoc
CreateRectRgnIndirect
SelectClipRgn
SaveDC
SetEnhMetaFileBits
GetEnhMetaFileHeader
PlayEnhMetaFile
RestoreDC
SetBkMode
SetMapMode
SetWindowExtEx
DeleteObject
CreateFontIndirectA
SelectObject
StretchDIBits
GetDeviceCaps
DeleteEnhMetaFile
GetTextMetricsA
SetViewportExtEx
SetWindowOrgEx
LPtoDP
SetTextColor

user32

DrawTextA
wsprintfA
PostMessageA

ole32

CLSIDFromString

Exports

Exports

FXSAPIFree
FXSAPIInitialize
FaxAbort
FaxAccessCheck
FaxAccessCheckEx
FaxAddOutboundGroupA
FaxAddOutboundGroupW
FaxAddOutboundRuleA
FaxAddOutboundRuleW
FaxAnswerCall
FaxCheckValidFaxFolder
FaxClose
FaxCompleteJobParamsA
FaxCompleteJobParamsW
FaxConnectFaxServerA
FaxConnectFaxServerW
FaxEnableRoutingMethodA
FaxEnableRoutingMethodW
FaxEndMessagesEnum
FaxEnumGlobalRoutingInfoA
FaxEnumGlobalRoutingInfoW
FaxEnumJobsA
FaxEnumJobsExA
FaxEnumJobsExW
FaxEnumJobsW
FaxEnumMessagesA
FaxEnumMessagesW
FaxEnumOutboundGroupsA
FaxEnumOutboundGroupsW
FaxEnumOutboundRulesA
FaxEnumOutboundRulesW
FaxEnumPortsA
FaxEnumPortsExA
FaxEnumPortsExW
FaxEnumPortsW
FaxEnumRoutingExtensionsA
FaxEnumRoutingExtensionsW
FaxEnumRoutingMethodsA
FaxEnumRoutingMethodsW
FaxEnumerateProvidersA
FaxEnumerateProvidersW
FaxFreeBuffer
FaxFreeSenderInformation
FaxGetActivityLoggingConfigurationA
FaxGetActivityLoggingConfigurationW
FaxGetArchiveConfigurationA
FaxGetArchiveConfigurationW
FaxGetConfigWizardUsed
FaxGetConfigurationA
FaxGetConfigurationW
FaxGetCountryListA
FaxGetCountryListW
FaxGetDeviceStatusA
FaxGetDeviceStatusW
FaxGetExtensionDataA
FaxGetExtensionDataW
FaxGetJobA
FaxGetJobExA
FaxGetJobExW
FaxGetJobW
FaxGetLoggingCategoriesA
FaxGetLoggingCategoriesW
FaxGetMessageA
FaxGetMessageTiffA
FaxGetMessageTiffW
FaxGetMessageW
FaxGetOutboxConfiguration
FaxGetPageData
FaxGetPersonalCoverPagesOption
FaxGetPortA
FaxGetPortExA
FaxGetPortExW
FaxGetPortW
FaxGetQueueStates
FaxGetReceiptsConfigurationA
FaxGetReceiptsConfigurationW
FaxGetReceiptsOptions
FaxGetRecipientInfoA
FaxGetRecipientInfoW
FaxGetRecipientsLimit
FaxGetReportedServerAPIVersion
FaxGetRoutingInfoA
FaxGetRoutingInfoW
FaxGetSecurity
FaxGetSecurityEx
FaxGetSenderInfoA
FaxGetSenderInfoW
FaxGetSenderInformation
FaxGetServerActivity
FaxGetServerSKU
FaxGetServicePrintersA
FaxGetServicePrintersW
FaxGetVersion
FaxInitializeEventQueue
FaxOpenPort
FaxPrintCoverPageA
FaxPrintCoverPageW
FaxRefreshArchive
FaxRegisterForServerEvents
FaxRegisterRoutingExtensionW
FaxRegisterServiceProviderExA
FaxRegisterServiceProviderExW
FaxRelease
FaxRemoveMessage
FaxRemoveOutboundGroupA
FaxRemoveOutboundGroupW
FaxRemoveOutboundRule
FaxSendDocumentA
FaxSendDocumentExA
FaxSendDocumentExW
FaxSendDocumentForBroadcastA
FaxSendDocumentForBroadcastW
FaxSendDocumentW
FaxSetActivityLoggingConfigurationA
FaxSetActivityLoggingConfigurationW
FaxSetArchiveConfigurationA
FaxSetArchiveConfigurationW
FaxSetConfigWizardUsed
FaxSetConfigurationA
FaxSetConfigurationW
FaxSetDeviceOrderInGroupA
FaxSetDeviceOrderInGroupW
FaxSetExtensionDataA
FaxSetExtensionDataW
FaxSetGlobalRoutingInfoA
FaxSetGlobalRoutingInfoW
FaxSetJobA
FaxSetJobW
FaxSetLoggingCategoriesA
FaxSetLoggingCategoriesW
FaxSetOutboundGroupA
FaxSetOutboundGroupW
FaxSetOutboundRuleA
FaxSetOutboundRuleW
FaxSetOutboxConfiguration
FaxSetPortA
FaxSetPortExA
FaxSetPortExW
FaxSetPortW
FaxSetQueue
FaxSetReceiptsConfigurationA
FaxSetReceiptsConfigurationW
FaxSetRoutingInfoA
FaxSetRoutingInfoW
FaxSetSecurity
FaxSetSenderInformation
FaxStartMessagesEnum
FaxStartPrintJob2W
FaxStartPrintJobA
FaxStartPrintJobW
FaxUnregisterForServerEvents
FaxUnregisterRoutingExtensionA
FaxUnregisterRoutingExtensionW
FaxUnregisterServiceProviderExA
FaxUnregisterServiceProviderExW
IsDeviceVirtual

Sections

.text
Size: 463KB - Virtual size: 462KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eae246beb73e3bcc52802a7793ee5b42

Headers

File Characteristics

Imports

version

msvcrt

rpcrt4

kernel32

shell32

advapi32

winspool.drv

gdi32

user32

ole32

Exports

Exports

Sections

.text Size: 463KB - Virtual size: 462KB

.data Size: 66KB - Virtual size: 66KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 463KB - Virtual size: 462KB

.data
Size: 66KB - Virtual size: 66KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB