571611ecf99ba98a3966b348a932ebdd4f281f5a692e35ec19328a65b5ce18b5

Sharing

Copy URL Twitter E-mail

General

Target

571611ecf99ba98a3966b348a932ebdd4f281f5a692e35ec19328a65b5ce18b5
Size

368KB
MD5

13101536581263a74bb449702cd46640
SHA1

12b8fb09f2b267e49b1bee6f0ec046b48504cf24
SHA256

571611ecf99ba98a3966b348a932ebdd4f281f5a692e35ec19328a65b5ce18b5
SHA512

0e9ddec7e054ff7806b8f4e6237bce6a4dbfc6eaaa86634fbb59bf2363c4d0e6f67f84f3b76119eb1c1e6644e2f5ea8048724a5905496458775a27222fd3da15
SSDEEP

6144:a1vKuCw81loxXJdQankhglgks6EY05+2FAl5es+Piqh6sDee3fel/DV7owKI9Ujy:YvdTmudnqh6s6e3mRA+/cJ4v6i

Score

N/A

Malware Config

Signatures

Files

571611ecf99ba98a3966b348a932ebdd4f281f5a692e35ec19328a65b5ce18b5
.dll windows x86

19f56f6f9b79d9de4755682e72bec782

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsicmp
mbstowcs
fclose
atoi
_strnicmp
strpbrk
fgets
memmove
fprintf
fputs
_except_handler3
fputc
qsort
free
realloc
_snwprintf
_itow
wcschr
bsearch
wcscat
wcscpy
wcslen
_initterm
malloc
_adjust_fdiv
_purecall
??2@YAPAXI@Z
wcscmp
wcstombs
_snprintf
wcsrchr
wcspbrk
iswalpha
wcsncmp
_wcsnicmp
iswdigit
??3@YAXPAX@Z
wcstoul
_ultow
fopen

atl

ord20
ord17
ord19
ord32
ord21
ord16

ntdll

RtlFindClearBitsAndSet
RtlClearBits
RtlFindSetBits
NtDeviceIoControlFile
RtlInitializeBitMap
RtlClearAllBits
NtCreateFile
RtlImpersonateSelf
NtUnloadDriver
NtLoadDriver
RtlQueueWorkItem
RtlRandom
RtlDeregisterWait
RtlRegisterWait
NtCreateEvent
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlGetElementGenericTable
RtlNumberGenericTableElements
RtlLookupElementGenericTable
RtlEnumerateGenericTable
RtlAnsiStringToUnicodeString
NtOpenFile
RtlFreeHeap
RtlAllocateHeap
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlIpv4StringToAddressW
RtlIpv4AddressToStringW
RtlNtStatusToDosError
RtlCreateTimerQueue
RtlCreateTimer
RtlUpdateTimer
RtlDeleteTimerQueue
RtlDeleteTimer
NtOpenKey
NtClose
RtlInitUnicodeString
NtQueryValueKey
RtlInsertElementGenericTable
NtQueryInformationProcess
RtlInitString
RtlAdjustPrivilege
NtSetEvent
RtlFreeUnicodeString
RtlStringFromGUID
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlInitAnsiString
RtlDeregisterWaitEx
NtNotifyChangeKey

advapi32

AccessCheck
RevertToSelf
QueryServiceConfigW
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
StartServiceW
FreeSid
AllocateAndInitializeSid
GetTokenInformation
LookupAccountSidW
OpenProcessToken
EqualSid
DuplicateTokenEx
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenThreadToken
CheckTokenMembership
CreateWellKnownSid
SetTraceCallback
OpenTraceW
ProcessTrace
CloseTrace
StartTraceW
EnableTrace
ControlTraceW
RemoveTraceCallback
QueryServiceConfigA
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumValueW
RegDeleteValueW
RegNotifyChangeKeyValue

dnsapi

Dns_BuildPacket
DnsUtf8ToUnicode
DnsGetBufferLengthForStringCopy
Dns_ParseMessage
DnsFreeConfigStructure
DnsQueryConfigAllocEx
DnsNameCompare_W
DnsGetPrimaryDomainName_A
DnsQuery_W
DnsRecordListFree
DnsQuery_UTF8

iphlpapi

NhpAllocateAndGetInterfaceInfoFromStack
SetIpForwardEntryToStack
AllocateAndGetIpAddrTableFromStack
AllocateAndGetIfTableFromStack
GetIpNetTable
SendARP
NotifyAddrChange
GetPerAdapterInfo
GetAdaptersInfo
GetInterfaceInfo
UnenableRouter
EnableRouter
GetAdaptersAddresses

kernel32

CreateTimerQueue
DeleteTimerQueueEx
UnregisterWaitEx
SystemTimeToFileTime
FileTimeToSystemTime
GetComputerNameExW
FormatMessageW
LocalAlloc
GetCurrentThread
DuplicateHandle
OpenProcess
GetSystemDirectoryW
MultiByteToWideChar
WideCharToMultiByte
SetLastError
QueueUserWorkItem
lstrcmpiW
lstrlenA
lstrcpyA
lstrcmpiA
LocalFree
SetEvent
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryW
lstrcmpW
CreateFileW
ExpandEnvironmentStringsA
InterlockedCompareExchange
ExpandEnvironmentStringsW
LoadLibraryExW
GetLongPathNameW
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
MoveFileExW
lstrcatW
FileTimeToLocalFileTime
DeleteTimerQueueTimer
TerminateThread
GetFileSize
GetLocalTime
CreateTimerQueueTimer
CreateThread
GetComputerNameW
GetVersionExW
Sleep
ResumeThread
WTSGetActiveConsoleSessionId
DeviceIoControl
lstrcpyW
InterlockedExchange
WaitForSingleObject
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
BindIoCompletionCallback
CreateEventW
RegisterWaitForSingleObject
HeapAlloc
GetProcessHeap
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapFree
InterlockedIncrement
DeleteCriticalSection
GetProcAddress
LoadLibraryA
CloseHandle
GetLastError
CreateEventA
FreeLibrary
DisableThreadLibraryCalls
lstrlenW
UnregisterWait
ReadFile
WriteFile

mprapi

MprInfoDelete
MprInfoBlockAdd
MprInfoBlockFind
MprInfoCreate

mswsock

AcceptEx

rasapi32

RasQuerySharedConnection
RasGetCredentialsW
RasDialW
RasHangUpW
RasGetConnectionStatistics
RasConnectionNotificationW
RasGetEntryPropertiesW
RasQuerySharedAutoDial
RasGetAutodialAddressA
RasGetEntryHrasconnW
RasGetProjectionInfoA
RasAutoDialSharedConnection

rtutils

TracePrintfExA
TraceRegisterExW
RouterLogDeregisterW
RouterLogRegisterA
TraceVprintfExA
TraceDeregisterW
TraceRegisterExA
RouterLogEventValistExA

ws2_32

socket
connect
ntohs
htons
inet_addr
inet_ntoa
WSAProviderConfigChange
setsockopt
WSAIoctl
bind
WSASendTo
WSARecvFrom
WSAAddressToStringA
WSAEnumProtocolsW
WSASocketW
htonl
ntohl
WSACleanup
WSAStartup
closesocket
getsockname
WSAGetLastError

ole32

CoTaskMemFree
CoUninitialize
CLSIDFromString
CoSwitchCallContext
CoImpersonateClient
CoRevertToSelf
StringFromGUID2
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx

oleaut32

VariantInit
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
SysFreeString
SysAllocString
SysAllocStringLen
SysStringLen
VariantClear

shlwapi

PathIsRelativeW
PathFindNextComponentW
PathCanonicalizeW
ord487
AssocQueryStringW
PathFindFileNameW
PathSkipRootW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

netshell

NcFreeNetconProperties

rasman

RasInitialize
RasReferenceRasman

wmi

WmiCloseBlock
WmiSetSingleInstanceW
WmiOpenBlock

authz

AuthzInitializeResourceManager
AuthziLogAuditEvent
AuthzFreeAuditEvent
AuthzFreeResourceManager

rpcrt4

RpcServerUnregisterIfEx
RpcBindingVectorFree
RpcEpUnregister
RpcEpRegisterW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUseProtseqW
RpcBindingInqAuthClientW
RpcStringBindingParseW
RpcBindingToStringBindingW
I_RpcBindingIsClientLocal
I_RpcBindingInqLocalClientPID
NdrServerCall2
RpcServerRegisterAuthInfoW
RpcStringFreeW
RpcRaiseException
RpcRevertToSelf
RpcImpersonateClient
RpcServerInqDefaultPrincNameW

user32

LoadStringW

Exports

Exports

NatAcquirePortReservation
NatCancelDynamicRedirect
NatCancelRedirect
NatCreateDynamicFullRedirect
NatCreateDynamicRedirect
NatCreateDynamicRedirectEx
NatCreateRedirect
NatCreateRedirectEx
NatInitializePortReservation
NatInitializeTranslator
NatLookupAndQueryInformationSessionMapping
NatQueryInformationRedirect
NatQueryInformationRedirectHandle
NatReleasePortReservation
NatShutdownPortReservation
NatShutdownTranslator
NhAcceptStreamSocket
NhAcquireFixedLengthBuffer
NhAcquireVariableLengthBuffer
NhCreateDatagramSocket
NhCreateStreamSocket
NhDeleteSocket
NhInitializeBufferManagement
NhInitializeTraceManagement
NhReadDatagramSocket
NhReadStreamSocket
NhReleaseBuffer
NhWriteDatagramSocket
NhWriteStreamSocket
RegisterProtocol
ServiceMain

Sections

.text
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

19f56f6f9b79d9de4755682e72bec782

Headers

File Characteristics

Imports

msvcrt

atl

ntdll

advapi32

dnsapi

iphlpapi

kernel32

mprapi

mswsock

rasapi32

rtutils

ws2_32

ole32

oleaut32

shlwapi

wtsapi32

netshell

rasman

wmi

authz

rpcrt4

user32

Exports

Exports

Sections

.text Size: 258KB - Virtual size: 258KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 16KB - Virtual size: 16KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 258KB - Virtual size: 258KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 16KB - Virtual size: 16KB

.rmnet
Size: 56KB - Virtual size: 60KB