5e7a3b9c15e477885e3efc8bb3d336843283fb66c6add146b6191cd18abb877a

Sharing

Copy URL

Twitter E-mail

General

Target

5e7a3b9c15e477885e3efc8bb3d336843283fb66c6add146b6191cd18abb877a
Size

164KB
MD5

08403d375efa7d0ddab5a50ce242bf4b
SHA1

f0b9cefcf18590da135ce4efdc61197674a6bacb
SHA256

5e7a3b9c15e477885e3efc8bb3d336843283fb66c6add146b6191cd18abb877a
SHA512

0566b468bb3c45017f575ab1cc269804d6409f0c39712a87a1670a8f40af16c640f350538ab750d0607dff3fa0d36ddd44196bce6afb1ebdb02810b6fe92dbb2
SSDEEP

3072:4tU1hQ41IsO/vhmbPqeMNOzlvaMa3imXi4QU3/RSRH0qJ5jZagoE7/98kDpY:4tU1hQHhmzqKBaMa3imXigPRSRHl3jZM

Score

N/A

Malware Config

Signatures

Files

5e7a3b9c15e477885e3efc8bb3d336843283fb66c6add146b6191cd18abb877a
.dll windows x86

5a96c10130da317bbd44c78c333f41af

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

spoolss

SetPrinterW
RevertToPrinterSelf
ImpersonatePrinterClient
EnumPrintersW
OpenPrinterW
GetJobW
ClosePrinter
SetPortW
EnumJobsW
SetJobW
GetPrinterW

ws2_32

WSASetLastError
ntohs
ioctlsocket
inet_ntoa
recvfrom
sendto
inet_addr
gethostbyname
htons
send
connect
shutdown
select
__WSAFDIsSet
recv
htonl
bind
closesocket
socket
WSAStartup
WSAGetLastError
WSASocketW
WSACleanup
setsockopt
gethostname

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

hpzjsn01

??0OctetStr@@QAE@PBD@Z
??YOctetStr@@QAEAAV0@PBD@Z
??0SnmpInt32@@QAE@XZ
?get_printable@SnmpInt32@@UAEPADXZ
??0OctetStr@@QAE@XZ
?len@OctetStr@@QBEKXZ
??AOctetStr@@QAEAAEH@Z
??1OctetStr@@UAE@XZ
??1SnmpInt32@@UAE@XZ
??0IpAddress@@QAE@PBD@Z
??0CTarget@@QAE@ABVAddress@@@Z
??1IpAddress@@UAE@XZ
??0Oid@@QAE@PBD@Z
??0Vb@@QAE@ABVOid@@@Z
??1Oid@@UAE@XZ
??0Pdu@@QAE@XZ
??0Snmp@@QAE@AAHG@Z
??1Snmp@@QAE@XZ
??1Pdu@@QAE@XZ
??1Vb@@QAE@XZ
??1SnmpUInt32@@UAE@XZ
?valid@Address@@UBEHXZ
??1Address@@UAE@XZ
??1SnmpTarget@@UAE@XZ
?get_notify_filter@Snmp@@UAEHAAV?$SnmpCollection@VOid@@@@AAV?$SnmpCollection@VCTarget@@@@@Z
?notify_unregister@Snmp@@UAEHXZ
?notify_register@Snmp@@UAEHABV?$SnmpCollection@VOid@@@@ABV?$SnmpCollection@VCTarget@@@@Q6AXHPAV1@AAVPdu@@AAVSnmpTarget@@PAX@ZPBX@Z
?notify_register@Snmp@@UAEHABV?$SnmpCollection@VOid@@@@ABV?$SnmpCollection@VCTarget@@@@ABV?$SnmpCollection@VGenAddress@@@@Q6AXHPAV1@AAVPdu@@AAVSnmpTarget@@PAX@ZPBX@Z
?inform@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@@Z
?inform@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@Q6AXHPAV1@01PAX@ZPBX@Z
?trap@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@@Z
?get_bulk@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@HH@Z
?get_bulk@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@HHQ6AXHPAV1@01PAX@ZPBX@Z
?set@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@@Z
?set@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@Q6AXHPAV1@01PAX@ZPBX@Z
?get_next@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@@Z
?get_next@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@Q6AXHPAV1@01PAX@ZPBX@Z
?get@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@@Z
?get@Snmp@@UAEHAAVPdu@@AAVSnmpTarget@@Q6AXHPAV1@01PAX@ZPBX@Z
?cancel@Snmp@@UAEHK@Z
initSNMP
uninitSNMP
?get_value@Vb@@QAEHAAVSnmpSyntax@@@Z
?get_error_status@Pdu@@QAEHXZ
?get_vb@Pdu@@QBEHAAVVb@@H@Z
??YPdu@@QAEAAV0@AAVVb@@@Z
??1CTarget@@UAE@XZ
?get_printable@OctetStr@@UAEPADXZ

hpzjfw01

DeletePortMapping
AddPortMapping
NeedToChangeFirewall
AnyFirewalledConnection
COMFirewallOpen
CallMicrosoftFailingAPI
COMFirewallClose

hptcpmui

_DisplayVPNPrintWindow@0
_GetVPNString@8

kernel32

GetPrivateProfileStringW
GetSystemDirectoryW
ReleaseMutex
CreateMutexW
WriteFile
SetLastError
GetComputerNameW
WideCharToMultiByte
GetTempFileNameW
ReadFile
SetFilePointer
DeleteFileW
CreateSemaphoreW
ReleaseSemaphore
FreeLibrary
GetProcAddress
HeapAlloc
LoadLibraryW
GetVersionExW
MultiByteToWideChar
GetSystemTime
LocalFree
CreateEventW
CreateThread
SetThreadPriority
SetEvent
LocalAlloc
WaitForSingleObject
CloseHandle
DisableThreadLibraryCalls
GetPrivateProfileIntW
GetTickCount
GetCurrentProcessId
HeapFree
CreateFileW
GetProcessHeap
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
GetLastError

user32

LoadCursorW
SetCursor
LoadStringW

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DeregisterEventSource
RegQueryValueExW
RegisterEventSourceW
ReportEventW
RegSetValueExW
RegOpenKeyExW
RegCloseKey

msvcr71

?terminate@@YAXXZ
??_V@YAXPAX@Z
wcsncpy
time
strncpy
??_U@YAPAXI@Z
swprintf
_wcsicmp
wcscmp
??3@YAXPAX@Z
wcslen
??2@YAPAXI@Z
wcscpy
wcscat
wcsncat
sprintf
malloc
free
_snprintf
_mbsicmp
isxdigit
_mbsnbcat
_mbsstr
_ismbcdigit
rand
srand
__CxxFrameHandler
_except_handler3
__dllonexit
_onexit
_initterm
_purecall
printf
_iob
fprintf
_adjust_fdiv
__CppXcptFilter

Exports

Exports

??0Address@@QAE@ABV0@@Z
??0Address@@QAE@XZ
??0CPortABC@@QAE@ABV0@@Z
??0CPortABC@@QAE@XZ
??0CTcpMibABC@@QAE@ABV0@@Z
??0CTcpMibABC@@QAE@XZ
??0Snmp@@QAE@ABV0@@Z
??0SnmpSyntax@@QAE@ABV0@@Z
??0SnmpSyntax@@QAE@XZ
??0SnmpTarget@@QAE@ABV0@@Z
??0SnmpTarget@@QAE@XZ
??1CPortABC@@UAE@XZ
??1CTcpMibABC@@UAE@XZ
??1Counter32@@UAE@XZ
??1SnmpSyntax@@UAE@XZ
??4Address@@QAEAAV0@AAV0@@Z
??4CPortABC@@QAEAAV0@ABV0@@Z
??4CTcpMibABC@@QAEAAV0@ABV0@@Z
??4Snmp@@QAEAAV0@ABV0@@Z
??4SnmpSyntax@@UAEAAV0@AAV0@@Z
??4SnmpTarget@@QAEAAV0@ABV0@@Z
??_7Address@@6B@
??_7CPortABC@@6B@
??_7CTcpMibABC@@6B@
??_7Snmp@@6B@
??_7SnmpSyntax@@6B@
??_7SnmpTarget@@6B@
?Read@CPortABC@@UAEKQAXPAEKPAK@Z
?hashFunction@Address@@UBEIXZ
AddPortUIEx
AddPortW
ClosePort
ConfigPortUIEx
ConfigurePortW
DeletePortW
EndDocPort
EnumPortsW
InitializeMonitor
InitializeMonitorEx
InitializePrintMonitor
InitializePrintMonitor2
OpenPort
ReadPort
StartDocPort
WritePort
XcvClosePort
XcvDataPort
XcvOpenPort

Sections

.text
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a96c10130da317bbd44c78c333f41af

Headers

File Characteristics

Imports

spoolss

ws2_32

rpcrt4

hpzjsn01

hpzjfw01

hptcpmui

kernel32

user32

advapi32

msvcr71

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 65KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 60KB - Virtual size: 56KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 68KB - Virtual size: 65KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 60KB - Virtual size: 56KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 5KB