374fd195f382dae1c74105d63cf862fc17dcb95cbe227e719ecdf1806b2ab008

Sharing

Copy URL Twitter E-mail

General

Target

374fd195f382dae1c74105d63cf862fc17dcb95cbe227e719ecdf1806b2ab008
Size

176KB
MD5

94877de706860dd65081c1569493955d
SHA1

622eb516e0aa030aef55569c9d3f8a087ff6c748
SHA256

374fd195f382dae1c74105d63cf862fc17dcb95cbe227e719ecdf1806b2ab008
SHA512

8704d837b1bfd692649b2695a0d5fe9a5a328e52f21ada6bd0a77052bcb0b66cd0c933d86b94e56bc8f95d93b7f29c62b85c86670bb65260aa88ce111151ddfe
SSDEEP

3072:M6VQsK7EVe34RZ3ZMYigb26nFFoWoxo3cSFMtjpAiVzb37DtKO:MonKw1MYnY1W3R2pACzr7D

Score

N/A

Malware Config

Signatures

Files

374fd195f382dae1c74105d63cf862fc17dcb95cbe227e719ecdf1806b2ab008
.dll windows x86

77b39c6c3943f61d5b7b7fa071bc9834

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

igtsnmp

?free_vb@Vb@@IAEXXZ
??1Pdu@@UAE@XZ
?get_printable_value@Vb@@QBEPBDXZ
?get_vb@Pdu@@QBEHAAVVb@@H@Z
?get@Snmp@@UAEHAAVPdu@@ABVSnmpTarget@@@Z
??YPdu@@QAEAAV0@ABVVb@@@Z
??0Pdu@@QAE@XZ
??1Oid@@UAE@XZ
??0Oid@@QAE@ABV0@@Z
??0Oid@@QAE@PBD@Z
?set_address@SnmpTarget@@UAEHABVAddress@@@Z
??0IpxAddress@@QAE@PBD@Z
?clone@SnmpTarget@@UBEPAV1@XZ
?get_next@Snmp@@UAEHAAVPdu@@ABVSnmpTarget@@@Z
?get_value@Vb@@QBEHPAD@Z
??0Oid@@QAE@XZ
?trim@Pdu@@QAEHH@Z
??0GenAddress@@QAE@XZ
??0GenAddress@@QAE@ABV0@@Z
??0UdpAddress@@QAE@XZ
??0UdpAddress@@QAE@ABV0@@Z
??0IpAddress@@QAE@ABV0@@Z
??0CTarget@@QAE@ABV0@@Z
??8@YAHABVAddress@@0@Z
??0GenAddress@@QAE@PBDW4addr_type@Address@@@Z
??0IpAddress@@QAE@PBD@Z
??4IpAddress@@QAEAAV0@ABV0@@Z
??4GenAddress@@UAEAAVSnmpSyntax@@ABV1@@Z
?parse_address@GenAddress@@MAE_NPBDW4addr_type@Address@@@Z
??4IpAddress@@UAEAAVSnmpSyntax@@ABV1@@Z
?clear@IpAddress@@UAEXXZ
?parse_address@IpAddress@@MAE_NPBD@Z
?format_output@IpAddress@@MBEXXZ
?map_to_ipv6@IpAddress@@UAEHXZ
??0IpxSockAddress@@QAE@PBD@Z
??0Snmp@@QAE@AAHABVIpxSockAddress@@@Z
?broadcast_discovery@Snmp@@UAEHAAV?$SnmpCollection@VGenAddress@@@@HABVIpxSockAddress@@W4snmp_version@@PBVOctetStr@@@Z
?socket_startup@Snmp@@SAXXZ
??0Snmp@@QAE@AAHG_N@Z
??0UdpAddress@@QAE@PBD@Z
??0OctetStr@@QAE@PBD@Z
?broadcast_discovery@Snmp@@UAEHAAV?$SnmpCollection@VUdpAddress@@@@HABVUdpAddress@@W4snmp_version@@PBVOctetStr@@@Z
??1OctetStr@@UAE@XZ
?socket_cleanup@Snmp@@SAXXZ
??1Snmp@@UAE@XZ
??0IpAddress@@QAE@XZ
??0CTarget@@QAE@XZ
??4IpAddress@@QAEAAV0@PBD@Z

ws2_32

WSAStartup
gethostname
gethostbyname
socket
WSAIoctl
closesocket

mfc42

ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3742
ord818
ord540
ord567
ord825
ord800
ord858
ord4275
ord2379
ord6129
ord6130
ord4694
ord5768
ord5148
ord2859
ord755
ord470
ord3626
ord3663
ord5875
ord2414
ord283
ord5787
ord5788
ord640
ord5785
ord1640
ord323
ord773
ord501
ord5600
ord3619
ord535
ord1641
ord472
ord823
ord3571
ord1146
ord1083
ord5607
ord4133
ord4297
ord4299
ord2514
ord6467
ord4274
ord6375
ord4486
ord2554
ord2512
ord2976
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord3953
ord1134
ord2582
ord4402
ord3370
ord3640
ord5265
ord4998
ord6052
ord1775
ord4425
ord3597
ord686
ord693
ord641
ord860
ord1233
ord1168
ord4224
ord384
ord324
ord795
ord3301
ord2302
ord4234
ord6907
ord3998
ord3302
ord6199
ord6880
ord2862
ord2096
ord3996
ord2642
ord3092
ord6241
ord4710
ord5981
ord6197
ord2863
ord2652
ord1669
ord924
ord926
ord537
ord941
ord613
ord289
ord939
ord4853
ord922
ord656
ord6515
ord4376
ord5280
ord1829
ord2864
ord2860
ord2450
ord5789
ord3089
ord2405
ord2754
ord3797
ord4123
ord2818
ord3402
ord6743
ord2737
ord5271
ord6669
ord2358
ord2301
ord6380
ord3610
ord2289
ord2370
ord2764
ord2763
ord6334
ord1929
ord3721
ord3874
ord4160
ord5572
ord2915
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord269
ord826
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1575
ord1176
ord1116
ord5731

msvcrt

??1type_info@@UAE@XZ
_adjust_fdiv
__CxxFrameHandler
_getmbcp
_mbsnbcpy
_purecall
_mbschr
_mbscmp
_mbsstr
_stricmp
_mbsrchr
sprintf
_mbsicmp
atol
_ftol
_CIpow
_EH_prolog
__dllonexit
_onexit
free
_initterm
malloc
_strcmpi

kernel32

LocalFree
LocalAlloc
GetLastError
CreateEventA
LoadLibraryA
SetCurrentDirectoryA
GetVersionExA
FreeLibrary
lstrcpyA
lstrcmpiA
OpenEventA
GetTickCount
lstrlenA
GetModuleFileNameA
GetProcAddress
CloseHandle
GetWindowsDirectoryA

user32

GetSystemMenu
DispatchMessageA
TranslateMessage
PeekMessageA
IsWindow
GetFocus
GetParent
ShowCaret
SetCaretPos
CreateCaret
DestroyCaret
GetDC
GetKeyState
MessageBeep
SetCapture
EnableMenuItem
GetCapture
SetCursor
CopyIcon
InvalidateRect
KillTimer
UpdateWindow
SetTimer
LoadStringA
GetWindowRect
SetWindowTextA
SendMessageA
GetSysColor
LoadCursorA
RegisterWindowMessageA
EnableWindow
LoadBitmapA
GetClientRect
ReleaseCapture
wsprintfA
ShowScrollBar
ReleaseDC
PtInRect
DrawFocusRect
InflateRect
FillRect
RedrawWindow
GetWindowDC

gdi32

CreateCompatibleBitmap
CreateFontIndirectA
CreateSolidBrush
GetTextExtentPoint32A
CreateFontA
GetTextMetricsA
CreateCompatibleDC
GetObjectA
BitBlt
GetStockObject
Rectangle

winspool.drv

GetPrinterDriverDirectoryA

advapi32

RegCreateKeyExA
RegDeleteValueA
RegEnumValueA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteA

comctl32

ImageList_Draw
ImageList_AddMasked

Exports

Exports

DoNetworkDiscovery
DoNetworkDiscoveryFax
DoNetworkDiscoveryInstaller
DoNetworkDiscoveryRh
GetPrinterAddress

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77b39c6c3943f61d5b7b7fa071bc9834

Headers

File Characteristics

Imports

igtsnmp

ws2_32

mfc42

msvcrt

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 58KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 72KB - Virtual size: 74KB

.rsrc Size: 16KB - Virtual size: 12KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 60KB - Virtual size: 58KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 72KB - Virtual size: 74KB

.rsrc
Size: 16KB - Virtual size: 12KB

.reloc
Size: 8KB - Virtual size: 6KB