d1ef68b3305009a003bee404f5103aaf3501c4344a5cd5d93f355984b015d7a1

Sharing

Copy URL Twitter E-mail

General

Target

d1ef68b3305009a003bee404f5103aaf3501c4344a5cd5d93f355984b015d7a1
Size

323KB
MD5

0593cf1b5b188e378ac66fb89549a65b
SHA1

9cf5ad92c1e4c6d07de5a6c840d075fda68e9bbc
SHA256

d1ef68b3305009a003bee404f5103aaf3501c4344a5cd5d93f355984b015d7a1
SHA512

fc3eeb6f9e9195a2b15a8fe0b5cd4c1346a216f4a9a25a88f41a2945759dbeb1b52fa1f916d9ac7a9768a71ff04e5438d76ebbac340fb52f52bd3159b9a44a2e
SSDEEP

6144:YT6nY03vgNyI0OzAokTvBo9TBUIo5aqZ7nOI2e6arho5PW1k3fIRXODFSL:Y9uIkWzkto9Tm7v7EesPWq3fYODFSL

Score

N/A

Malware Config

Signatures

Files

d1ef68b3305009a003bee404f5103aaf3501c4344a5cd5d93f355984b015d7a1
.dll windows x86

75672fa6cff2a1d2238972ae83d2f07d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nss3

CERT_DupCertList
SECKEY_CacheStaticFlags
PK11_MapSignKeyType
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_ReferenceSlot
CERT_DistNamesFromCertList
CERT_DupDistNames
CERT_DestroyCertificate
CERT_FreeNicknames
CERT_CheckCertValidTimes
CERT_GetCertNicknames
PK11_FindKeyByAnyCert
CERT_FindUserCertByUsage
CERT_FindCertByName
PK11_VerifyKeyOK
PK11_ReferenceSymKey
PK11_GetBestKeyLength
PK11_SaveContextAlloc
PK11_DigestKey
PK11_RestoreContext
PK11_CreateDigestContext
PK11_Derive
PK11_GetSlotFromKey
CERT_GetSSLCACerts
PK11_SymKeyFromHandle
SECMOD_LookupSlot
PK11_IsPresent
PK11_GetSlotSeries
PK11_GetSlotID
PK11_GetModuleID
PK11_NeedLogin
PK11_IsLoggedIn
PK11_DigestBegin
PK11_DigestOp
PK11_DigestFinal
PK11_CreateContextBySymKey
PK11_IVFromParam
PK11_CipherOp
PK11_ParamFromIV
PK11_DestroyContext
PK11_HashBuf
DSAU_DecodeDerSig
PK11_Verify
PK11_SignatureLen
PK11_Sign
DSAU_EncodeDerSigWithLen
PK11_GenerateRandom
PK11_TokenExists
CERT_FreeDistNames
PK11_Finalize
NSS_RegisterShutdown
NSS_VersionCheck
VFY_CreateContext
VFY_Begin
VFY_Update
VFY_End
VFY_DestroyContext
SGN_NewContext
SGN_Begin
SGN_Update
SGN_End
SGN_DestroyContext
PK11_PubEncryptRaw
PK11_PubDecryptRaw
PK11_GetBestSlot
__PK11_CreateContextByRawKey
HASH_GetHashObject
CERT_VerifyCertName
CERT_NameToAscii
SECKEY_CopyPrivateKey
CERT_NewTempCertificate
SECKEY_UpdateCertPQG
CERT_VerifyCertNow
PK11_UnwrapSymKeyWithFlags
PK11_ImportSymKey
SECKEY_PublicKeyStrengthInBits
SECKEY_CreateDHPrivateKey
PK11_PubDerive
CERT_DupCertificate
CERT_CertChainFromCert
PK11_GetSlotFromPrivateKey
PK11_GetInternalSlot
PK11_GetKeyData
CERT_DestroyCertificateList
SECKEY_CreateRSAPrivateKey
SECKEY_DestroyPrivateKey
PK11_GetCurrentWrapIndex
PK11_GetWrapKey
PK11_GetBestWrapMechanism
PK11_SetWrapKey
PK11_GetMechanism
PK11_FreeSymKey
PK11_WrapSymKey
CERT_ExtractPublicKey
SECKEY_GetPrivateKeyType
PK11_GetPrivateModulusLen
PK11_GetBestSlotMultiple
PK11_KeyGen
PK11_FreeSlot
SECKEY_PublicKeyStrength
PK11_PubWrapSymKey
PK11_PrivDecryptPKCS1
PK11_PubUnwrapSymKey
SECKEY_DestroyPublicKey
PK11_DeriveWithFlags
PK11_ExtractKeyValue
CERT_GetDefaultCertDB

nssutil3

PORT_NewArena_Util
PORT_SetError_Util
SECITEM_DupItem_Util
DER_Lengths_Util
NSSRWLock_New_Util
NSSRWLock_Destroy_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
NSS_PutEnv_Util
SECITEM_Hash
SECOID_GetAlgorithmTag_Util
PORT_Realloc_Util
SECITEM_AllocItem_Util
SECITEM_ZfreeItem_Util
NSS_SecureMemcmp
PORT_ArenaAlloc_Util
SECITEM_CompareItem_Util
PORT_ArenaZAlloc_Util
PORT_GetError_Util
PORT_FreeArena_Util
PORT_ZAlloc_Util
SECITEM_CopyItem_Util
PORT_Strdup_Util
PORT_ZFree_Util
NSSRWLock_LockRead_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_UnlockWrite_Util
PORT_Free_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util

plc4

PL_strdup

nspr4

PR_FindFunctionSymbol
PR_UnloadLibrary
PR_GetLibraryFilePathname
PR_Free
PR_GetDirectorySeparator
PR_LoadLibraryWithFlags
PR_Now
PR_Close
PR_NewMonitor
PR_CreateIOLayerStub
PR_PushIOLayer
PR_GetUniqueIdentity
PR_GetDefaultIOMethods
PR_GetSocketOption
PR_ConvertIPv4AddrToIPv6
PR_SetError
PR_DestroyMonitor
PR_GetIdentitiesLayer
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_ImportFileMapFromString
PR_ExportFileMapAsString
PR_smprintf
PR_OpenAnonFileMap
PR_smprintf_free
PR_MemMap
PR_MemUnmap
PR_CloseFileMap
PR_StringToNetAddr
PR_CallOnce
PR_CallOnceWithArg
PR_PopIOLayer
PR_GetCurrentThread
PR_ExitMonitor
PR_Sleep
PR_EnterMonitor
PR_GetError
PR_AtomicDecrement
PR_NewLock
PR_Lock
PR_Unlock
PR_DestroyLock
PR_AtomicIncrement
PR_GetEnv

msvcr90

_crt_debugger_hook
__clean_type_info_names_internal
__CppXcptFilter
__dllonexit
_lock
_onexit
_except_handler4_common
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
memcpy
memmove
memset
_getpid
strstr
_time64
strchr
getenv
strrchr
malloc
free
_encode_pointer
_malloc_crt
_unlock
_encoded_null

kernel32

GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentThreadId
WaitForSingleObject
ReleaseMutex
CloseHandle
CreateMutexA
GetLastError
GetSystemTimeAsFileTime

Exports

Exports

NSSSSL_VersionCheck
NSS_CmpCertChainWCANames
NSS_FindCertKEAType
NSS_GetClientAuthData
NSS_SetDomesticPolicy
NSS_SetExportPolicy
NSS_SetFrancePolicy
SSL_AuthCertificate
SSL_AuthCertificateHook
SSL_BadCertHook
SSL_CanBypass
SSL_CertDBHandleSet
SSL_CipherPolicyGet
SSL_CipherPolicySet
SSL_CipherPrefGet
SSL_CipherPrefGetDefault
SSL_CipherPrefSet
SSL_CipherPrefSetDefault
SSL_ClearSessionCache
SSL_ConfigMPServerSIDCache
SSL_ConfigSecureServer
SSL_ConfigServerSessionIDCache
SSL_ConfigServerSessionIDCacheWithOpt
SSL_DataPending
SSL_ForceHandshake
SSL_ForceHandshakeWithTimeout
SSL_GetChannelInfo
SSL_GetCipherSuiteInfo
SSL_GetClientAuthDataHook
SSL_GetImplementedCiphers
SSL_GetMaxServerCacheLocks
SSL_GetNegotiatedHostInfo
SSL_GetNumImplementedCiphers
SSL_GetSessionID
SSL_GetStatistics
SSL_HandshakeCallback
SSL_HandshakeNegotiatedExtension
SSL_ImplementedCiphers
SSL_ImportFD
SSL_InheritMPServerSIDCache
SSL_InvalidateSession
SSL_LocalCertificate
SSL_NumImplementedCiphers
SSL_OptionGet
SSL_OptionGetDefault
SSL_OptionSet
SSL_OptionSetDefault
SSL_PeerCertificate
SSL_PreencryptedFileToStream
SSL_PreencryptedStreamToFile
SSL_ReHandshake
SSL_ReHandshakeWithTimeout
SSL_ReconfigFD
SSL_ResetHandshake
SSL_RestartHandshakeAfterCertReq
SSL_RestartHandshakeAfterServerCert
SSL_RevealCert
SSL_RevealPinArg
SSL_RevealURL
SSL_SNISocketConfigHook
SSL_SecurityStatus
SSL_SetMaxServerCacheLocks
SSL_SetPKCS11PinArg
SSL_SetSockPeerID
SSL_SetTrustAnchors
SSL_SetURL
SSL_ShutdownServerSessionIDCache

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

75672fa6cff2a1d2238972ae83d2f07d

Headers

File Characteristics

Imports

nss3

nssutil3

plc4

nspr4

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 127KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

.text Size: 156KB - Virtual size: 156KB

.text
Size: 128KB - Virtual size: 127KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 156KB - Virtual size: 156KB