7ef20e6d063542f7eeb528b686f84dd6c04767d143e4f91085590a5b30f1107b

Sharing

Copy URL Twitter E-mail

General

Target

7ef20e6d063542f7eeb528b686f84dd6c04767d143e4f91085590a5b30f1107b
Size

376KB
MD5

9279bacf3a291d00dba4e8ee29e91c75
SHA1

479b3a22c0b899c7c57e1d4449f296f629adc2f7
SHA256

7ef20e6d063542f7eeb528b686f84dd6c04767d143e4f91085590a5b30f1107b
SHA512

ff2b7bc1e747ddac3ff155f8ddc8a6cca2ce52c831daec2ddb9873cbe04754ebe373fc393f7ab55711ff8789340df5946067bb37bbf11e0d51af5e8978aa6c14
SSDEEP

6144:fly6tTzdxET0REvrExknP5F6PK6o1cCdanO+5dAXdKXp+IE1MRwoH:fg6tf8IREvlnP5FkoqAaeXdkp+II+LH

Score

N/A

Malware Config

Signatures

Files

7ef20e6d063542f7eeb528b686f84dd6c04767d143e4f91085590a5b30f1107b
.exe windows x86

230e504eaf7b0eb8ea863ac6d1afcce9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfo
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateThread
TerminateThread
QueryPerformanceCounter
GetCurrentDirectoryA
SetPriorityClass
GetCurrentProcess
QueryPerformanceFrequency
Sleep
LocalFree
FormatMessageA
GetLastError
SetConsoleCtrlHandler
GetStdHandle
AllocConsole
FreeConsole
ReadConsoleInputA
GetNumberOfConsoleInputEvents
WriteFile
GetConsoleScreenBufferInfo
WriteConsoleOutputCharacterA
WriteConsoleOutputAttribute
SetConsoleTitleA
GetModuleFileNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
RaiseException
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
CreateFileA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
GetSystemTime
GetLocalTime
InterlockedDecrement
InterlockedIncrement
GetVersionExA
GetEnvironmentVariableA
ReadFile
GetFileType
SetHandleCount
SetFilePointer
CloseHandle
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
FatalAppExitA
GetCurrentThread
TlsGetValue
SetLastError
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadCodePtr
IsValidLocale
FlushFileBuffers
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
InitializeCriticalSection
GetTickCount
RtlUnwind
TlsAlloc
TlsFree
HeapAlloc
HeapReAlloc
HeapFree
GetTimeZoneInformation
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
CreateDirectoryA
GetProcAddress
TerminateProcess
HeapSize

wsock32

closesocket
select
WSACleanup
WSAStartup
shutdown
recvfrom
sendto
socket
WSAGetLastError
inet_ntoa
setsockopt
bind
ioctlsocket
gethostbyname
ntohs
htons
inet_addr
gethostname
getsockname
htonl
connect
send
recv

wonauth

?GetRawLen@WON_AuthFamilyBuffer@@QBEGXZ
?GetUserId@WON_AuthCertificate1@@QBEKXZ
?GetCommunityId@WON_AuthCertificate1@@QBEKXZ
?GetBlockId@WON_AuthPublicKeyBlock1@@QBEGXZ
?GetIssueTime@WON_AuthFamilyBuffer@@QBEJXZ
?GetExpireTime@WON_AuthFamilyBuffer@@QBEJXZ
?NewAuthPublicKeyBlock1@WON_AuthFactory@@SAPAVWON_AuthPublicKeyBlock1@@PBEG@Z
?GetNumKeys@WON_AuthPublicKeyBlock1@@QBEHXZ
?GetFirstKey@WON_AuthPublicKeyBlock1@@QBE?AUPubKeyReturn@1@XZ
?GetNextKey@WON_AuthPublicKeyBlock1@@QBE?AUPubKeyReturn@1@XZ
?Verify@WON_AuthFamilyBuffer@@QBEHPBEG@Z
?DeleteAuthPublicKeyBlock1@WON_AuthFactory@@SAXPAVWON_AuthPublicKeyBlock1@@@Z
?NewAuthCertificate1@WON_AuthFactory@@SAPAVWON_AuthCertificate1@@PBEG@Z
?IsValid@WON_AuthFamilyBuffer@@QBEHXZ
?DeleteAuthCertificate1@WON_AuthFactory@@SAXPAVWON_AuthCertificate1@@@Z
?GetPubKey@WON_AuthCertificate1@@QBEPBEXZ
?GetPubKeyLen@WON_AuthCertificate1@@QBEGXZ
?GetRaw@WON_AuthFamilyBuffer@@QBEPBEXZ

woncrypt

?GetKeyLen@WON_CryptKeyBase@@QBEGXZ
?DeleteEGPrivateKey@WON_CryptFactory@@SAXPAVWON_EGPrivateKey@@@Z
?Decrypt@WON_EGPrivateKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBEK@Z
?NewEGPublicKey@WON_CryptFactory@@SAPAVWON_EGPublicKey@@GPBE@Z
?DeleteEGPublicKey@WON_CryptFactory@@SAXPAVWON_EGPublicKey@@@Z
?Encrypt@WON_EGPublicKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBXK@Z
?NewEGPrivateKey@WON_CryptFactory@@SAPAVWON_EGPrivateKey@@GPBE@Z
?GetKey@WON_CryptKeyBase@@QBEPBEXZ
?Decrypt@WON_BFSymmetricKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBEK@Z
??0CryptReturn@WON_CryptKeyBase@@QAE@PAEK@Z
??1CryptReturn@WON_CryptKeyBase@@QAE@XZ
?DeleteBFSymmetricKey@WON_CryptFactory@@SAXPAVWON_BFSymmetricKey@@@Z
?NewBFSymmetricKey@WON_CryptFactory@@SAPAVWON_BFSymmetricKey@@GPBE@Z
??4CryptReturn@WON_CryptKeyBase@@QAEAAV01@ABV01@@Z
?Encrypt@WON_BFSymmetricKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBXK@Z

Sections

.text
Size: 216KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 806KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vrdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

230e504eaf7b0eb8ea863ac6d1afcce9

Headers

File Characteristics

Imports

kernel32

wsock32

wonauth

woncrypt

Sections

.text Size: 216KB - Virtual size: 213KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 44KB - Virtual size: 806KB

.idata Size: 8KB - Virtual size: 5KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 16KB - Virtual size: 15KB

.vrdata Size: 68KB - Virtual size: 68KB

.text
Size: 216KB - Virtual size: 213KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 44KB - Virtual size: 806KB

.idata
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 16KB - Virtual size: 15KB

.vrdata
Size: 68KB - Virtual size: 68KB