de2f67b1602dab8c4e8cb43b5116ae3a2769382ccea90104694c55386ca8812e

Sharing

Copy URL Twitter E-mail

General

Target

de2f67b1602dab8c4e8cb43b5116ae3a2769382ccea90104694c55386ca8812e
Size

324KB
MD5

11dbee42c6e6032d378eb6a3e7319a70
SHA1

26854b304a18fb80d8a18994bfc45fc45bf1cdf0
SHA256

de2f67b1602dab8c4e8cb43b5116ae3a2769382ccea90104694c55386ca8812e
SHA512

f0192b82c05ab796df2493ecbcbe09c9932530782c16c567530190076b9f74fc705c79d3d25f62df6dc738ca26bdc915e80d53ecc385f2f53da32a067fa43280
SSDEEP

6144:3aqt3o4J8Xc9kPG7RXgxGUhBH0usDxTIFaLEOAniZzo0naGH:vua69Ps3UsDhOaNPaGH

Score

N/A

Malware Config

Signatures

Files

de2f67b1602dab8c4e8cb43b5116ae3a2769382ccea90104694c55386ca8812e
.exe windows x86

1e466c253fe7df6dfb8cd64ecb5d700b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateThread
TerminateThread
QueryPerformanceCounter
GetCurrentDirectoryA
SetPriorityClass
GetCurrentProcess
QueryPerformanceFrequency
Sleep
LocalFree
FormatMessageA
GetLastError
SetConsoleCtrlHandler
GetStdHandle
AllocConsole
FreeConsole
ReadConsoleInputA
GetNumberOfConsoleInputEvents
WriteFile
GetConsoleScreenBufferInfo
WriteConsoleOutputCharacterA
WriteConsoleOutputAttribute
SetConsoleTitleA
GetModuleFileNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
RaiseException
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
CreateFileA
SetStdHandle
GetCPInfo
GetStringTypeW
HeapAlloc
GetCommandLineA
GetTickCount
ReadFile
GetFileType
SetHandleCount
SetFilePointer
CloseHandle
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadCodePtr
FlushFileBuffers
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
InitializeCriticalSection
GetEnvironmentVariableA
GetCurrentThreadId
HeapFree
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetLocalTime
ExitProcess
HeapReAlloc
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoA
GetVersion
TerminateProcess
CreateDirectoryA
GetProcAddress
HeapSize

wsock32

bind
select
WSACleanup
WSAStartup
gethostname
shutdown
recvfrom
sendto
socket
WSAGetLastError
inet_ntoa
setsockopt
closesocket
ioctlsocket
gethostbyname
ntohs
htons
inet_addr
connect
send
recv

wonauth

?GetRawLen@WON_AuthFamilyBuffer@@QBEGXZ
?GetCommunityId@WON_AuthCertificate1@@QBEKXZ
?GetBlockId@WON_AuthPublicKeyBlock1@@QBEGXZ
?GetIssueTime@WON_AuthFamilyBuffer@@QBEJXZ
?GetExpireTime@WON_AuthFamilyBuffer@@QBEJXZ
?NewAuthPublicKeyBlock1@WON_AuthFactory@@SAPAVWON_AuthPublicKeyBlock1@@PBEG@Z
?GetNumKeys@WON_AuthPublicKeyBlock1@@QBEHXZ
?GetFirstKey@WON_AuthPublicKeyBlock1@@QBE?AUPubKeyReturn@1@XZ
?GetNextKey@WON_AuthPublicKeyBlock1@@QBE?AUPubKeyReturn@1@XZ
?Verify@WON_AuthFamilyBuffer@@QBEHPBEG@Z
?DeleteAuthPublicKeyBlock1@WON_AuthFactory@@SAXPAVWON_AuthPublicKeyBlock1@@@Z
?NewAuthCertificate1@WON_AuthFactory@@SAPAVWON_AuthCertificate1@@PBEG@Z
?IsValid@WON_AuthFamilyBuffer@@QBEHXZ
?DeleteAuthCertificate1@WON_AuthFactory@@SAXPAVWON_AuthCertificate1@@@Z
?GetUserId@WON_AuthCertificate1@@QBEKXZ
?GetPubKey@WON_AuthCertificate1@@QBEPBEXZ
?GetPubKeyLen@WON_AuthCertificate1@@QBEGXZ
?GetRaw@WON_AuthFamilyBuffer@@QBEPBEXZ

woncrypt

?NewBFSymmetricKey@WON_CryptFactory@@SAPAVWON_BFSymmetricKey@@GPBE@Z
?DeleteEGPrivateKey@WON_CryptFactory@@SAXPAVWON_EGPrivateKey@@@Z
?Decrypt@WON_BFSymmetricKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBEK@Z
?Encrypt@WON_BFSymmetricKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBXK@Z
?Sign@WON_EGPrivateKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBXK@Z
?Decrypt@WON_EGPrivateKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBEK@Z
?NewEGPublicKey@WON_CryptFactory@@SAPAVWON_EGPublicKey@@GPBE@Z
?DeleteEGPublicKey@WON_CryptFactory@@SAXPAVWON_EGPublicKey@@@Z
??0CryptReturn@WON_CryptKeyBase@@QAE@PAEK@Z
?Encrypt@WON_EGPublicKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBXK@Z
??4CryptReturn@WON_CryptKeyBase@@QAEAAV01@ABV01@@Z
??1CryptReturn@WON_CryptKeyBase@@QAE@XZ
?GetKeyLen@WON_CryptKeyBase@@QBEGXZ
?GetKey@WON_CryptKeyBase@@QBEPBEXZ
?DeleteBFSymmetricKey@WON_CryptFactory@@SAXPAVWON_BFSymmetricKey@@@Z
?NewEGPrivateKey@WON_CryptFactory@@SAPAVWON_EGPrivateKey@@GPBE@Z

Sections

.text
Size: 212KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 895KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e466c253fe7df6dfb8cd64ecb5d700b

Headers

File Characteristics

Imports

kernel32

wsock32

wonauth

woncrypt

Sections

.text Size: 212KB - Virtual size: 210KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 48KB - Virtual size: 895KB

.rsrc Size: 44KB - Virtual size: 43KB

.text
Size: 212KB - Virtual size: 210KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 48KB - Virtual size: 895KB

.rsrc
Size: 44KB - Virtual size: 43KB